December 2003 - cypherpunks-legacy

Why Net Censorship Doesn't Work
by Duncan Frissell 17 Dec '03

17 Dec '03

Sometimes in the day-to-day wrangling with the net censors, we forget the larger picture. There is an assumption here and in the media (see the Newsweek year-end piece on the nets by Steven Levy) that the prospect of 2 years in stir and $100,000 fines will quell net speech. This seems unlikely because of the nature of the medium. Thought control is a very difficult task. It always has been. The Inquisition, Nazi Germany, the Soviet Union, and the People's Republic of China tried but three of the four are no longer with us. Short of totalitarian controls, thought controls will be ineffective. And totalitarian controls are difficult to impose these days. It used to be said that no country would be allowed to move from Communism to Capitalism. It can now be said that it is inconceivable that a modern country will move from a Market to a Command Economy. Market discipline is strong. Since only totalitarians have a shot (for a short time) to enforce thought control, the OECD countries will not succeed at thought control. This used to be unimportant because one's thoughts were trapped in one's head. You could speak only to a few people and "mass media" from books to TV was expensive, centralized and somewhat easy to control. You were free in your mind but cut off from communicating your thoughts freely to others. Those conditions no longer exist. If you can think it (or even not think it) you can communicate it easily and cheaply to others. Since thought is free and communications is almost free, control by others is difficult. The net is a fair mapping of the consciousness of its participants onto a world spanning communications system. Large companies and even quite small businesses are concerned about legal hassles. They have an investment to lose and they are more likely to be prosecuted than ordinary individuals. Ordinary people rightly suspect that their risk of punishment is quite low. Particularly since if they are worried about it, they can take many easy steps to protect themselves. In the coming world in which millions of households have multitasking computers with full-time highspeed connections to the nets, Java-like applets running wild, etc; the opportunities to stash info in easily accessible but hard to trace forms expands without limit. I was trying to imagine over the weekend how the Feds would regulate the Net. Will Janet and her Storm troopers (wearing Nazi-style bucket helmets) smash into the next meeting of the Internet Engineering Task Force and lock everyone up or force them at gunpoint to adopt standards proposed by the government? And if they do, will their code be any good and will it be accepted by enough nodes to make a difference? Unlikely in the extreme. Where are the pressure points where regulation can be applied? To me, it looks like King Canute ordering back the tide. DCF

2 1

Re: 2047 bit keys in PGP
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 19:52 1/3/96 -0500, Rick Busdiecker wrote: >Another point to realize is that PGP uses a combination of ciphers. >When encrypting, the RSA key is only used to encrypt an IDEA key. >That IDEA key is used to encrypt your message. Somewhere between 2048 >and 4096, you're making the RSA key stronger (harder to brute force) >than the IDEA key. At that point, the extra time that you're using >for super-big RSA keys is totally wasted. To nitpick: Getting the RSA key will give you ALL the IDEA keys. That is probably worth 200-10000 times the effort. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: Guerilla Internet Service Providers (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 08:09 PM 1/2/96 -0600, you wrote: >> For the "last mile" to the ISP user, wireless could be a better bet. >> Have antenna, will surf. > >I can easily visualize mobile and portable systems linking to an ISP, >downloading email via encrypted POP/UUCP/whatever, using itinerant 2m or >450 MHz frequencies. A mobile system connects to any ISP, gets a login: >prompt, enters "xyz(a)host.domain", gets thrown into a POP session on >host.domain, uploads/downloads, then disconnects. All it would really >require is implementing "exec rlogin -l xyz host.domain" into getty (a >very simple patch) and suitable crypto protocols... >- -- >Ed Carp, N7EKG Ed.Carp(a)linux.org, ecarp(a)netcom.com As a ham, too (N7IJS) I recognize your implicit selection of 2m or 450 MHz. But I gently object to this, for reasons that I think will be obvious. First, technology has been marching on in the last 10-20 years, and communications frequencies of 2 GHz and more are technically do-able and comparatively empty. (and with modern IC technology, even easy) Secondly, ham gear tends to be used for long-range communication (miles and watts) and generally has little or no ability to frequency hop/time hop or to automatically turn down transmitter power to be able to share frequencies over short distances (low milliwatts or even microwatts). Those high gigahertz frequencies would be ideal for communication over a few blocks distance. (Sure, packet has been done for years but it is a still-born development; they still think 9600 bps is a "fast" modem speed.) I forsee locally-owned boxes that are the equivalent of a wireless phone switch implementing re-used freuqency microcells; the cost SHOULD be far lower than the current copperline phone systems, once the telephones are paid for. And they shouldn't cost much more than current 900 MHz cordless telephones, too.

2 1

Re: Guerilla Internet Service Providers (fwd)
by Steve Gibbons 17 Dec '03

17 Dec '03

In Article: <m0tXAsV-00090IC(a)pacifier.com>, jim bell <jimbell(a)pacifier.com> wrote: # It seems to me that phone line costs are turning into a floor price for # Internet access, when they shouldn't really be. The main asset telephone # companies have, right now, is in RIGHTS OF WAY. Put an ISP in a business # park that allows you to run your own dedicated copper pairs, and you've # bypassed $25/month/line business phone line charges. # At some point, individual urban and suburban blocks could easily be # "guerilla re-wired" for ISP access without serious trenching, etc. The # phoneco would still be involved, but in a far lower-profit mode, as the # supplier of a single T1 to a multi-block area. I had a similar thought about a month ago. In particular, I was thinking that skyrise office buildings would be a great market for ISPs to target. Rent a closet in the basement/top floor close to the telco demarc. Run lots of UTP to the cients through the existing conduit, ceiling acces, air ducts, or whatever and boom, lots of clients, low overhead, telco bills cut to 1/2 of the competitions'. Up-front costs might (or might not be) higher, since the wire installation would now be the burden of the ISP. ObCrypto: Wiring overhead could be reduced if the building network was moved away from a star configuration to something closer to a backbone with multiple physical subnets (say, per floor.) How do you keep your next door neighbor from sniffing your traffic on the same subnet? Encrypt it, silly... For performance reasons, truly local traffic could be in the clear, but traffic between the clients' routers and the ISP's would run through something that could keep up with the ISP's max throughput on the ISP's outside interface. You might read "Firewall with encrypted tunnels" for "router" in the paragraph above. If you do, then you have the infrastructure for supporting "secure" trans-Internet traffic. Of course we're not talking about $25.00/mo. service with a $50.00 setup anymore, but low-ish priced, "secure" 56Kb/s, fractional T1, T1, and even T3 seem to be where corporate America/Earth wants to go. FWIW, (and if anyone winds up doing something like this, I want a "finders fee" ;-) ) -- Steve(a)AZTech.Net

1 0

Re: Guerilla Internet Service Providers (fwd)
by jim bell 17 Dec '03

17 Dec '03

At 01:47 PM 1/2/96 -0600, you wrote: > >Forwarded message: > >> Date: Tue, 2 Jan 1996 18:43:31 +0000 (GMT) >> From: "Mark Grant, M.A. (Oxon)" <mark(a)unicorn.com> >> Subject: Re: Guerilla Internet Service Providers >> >> About ten years ago a group I was involved with were thinking about >> putting something into space as a publicity stunt. One company we talked >> to claimed they could put 1 kg into orbit on one of their sounding rockets >> for about $ 30,000 (that's a 1 kg satellite, not $ 30,000 per kg). How >> small can you build a "data haven" satellite ? >> >> Looking a few years into the future, you could probably stick a >> stripped-down Linux laptop with solar cells and a stripped-down satellite >> telephone as a Net link on top of a slightly larger rocket and charge for >> on-orbit storage using ecash... Using remailers it should be pretty-much >> untraceable. >> > >Actualy, both the Pacific Coast Rocketry group and the Experimental >Spacecraft Association are working on putting the first amateur payload in >LEO. ESA wants to put a telescope with real-time downlink up as their >payload. PCR wants to put some kind of transponder up. > >Under current technology a group of about 30 dedicated amateurs (with >suitable skills) could put a 25kg payload in orbit for under 1/4 million. >It would consist of surplus and amateur built equipment. > >Tripolli puts out a magazine called High Performance Rocketry which you may >be able to find at your local newstand (in Austin you get it at the Central >Market Bookstop). It usually carries at least a couple of adds for material >that PCR and a couple of smaller groups are putting out to help fund their >project. I would say it will be less than 3 years before this dream occurs >unless the DOT (the people who regulate all space shots now) decides not to >give them a permit. As I understand the physics, the whole process could be made FAR FAR FAR more efficient if the rocket was boosted to about 40000 feet with a subsonic airplane, a' la' X-15 and such. It's above 75% of the earth's atmosphere (dramatically reduced drag), is already going 600 mph in the correct direction, and is 8 miles closer to the ultimate goal 250 miles up). This might not sound like much of an advantage, but if you've ever worked out the mathematics of the Saturn V (or space shuttle, etc), the VAST majority of the fuel was used up in the first 20,000 feet, maybe even the first 5000 feet. It would be even better if the first stage could be an air-breathing supersonic ramjet, but that's not my field of expertise. In addition, the existence of relatively low-cost GPS receivers would make achieving an accurate orbit vastly cheaper than with the inertial guidance systems historically used. Sure, cheap accelerometers are being sold by Analog Devices and Murata Erie sells cheap vibrational gyros (not to mention fiber gyros) but it would be hard to beat the accuracy you could get with GPS.

2 1

A weakness in PGP signatures, and a suggested solution (long)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've been engaged in a lively debate with a few members of the cypherpunks mailing list about forgeries that are hard to repudiate even if PGP signatures are used. One of the participants suggested that I post a summary to alt.privacy.pgp and sci.crypt, which is just what I'm doing. (My apologies to the mail.cypherpunks readers who already saw much of this once.) I'll illustrate the problem with several scenarios of forgeries. (It's funny that earlier today I was showing a friend how easy it is to post forgeries. She seemed suitably impressed. :) Scenario 1: Bob once sent Carol an e-mail that looked like this: ----------------------------------------------------------------------- From: Bob@boxb To: Carol@boxc Date: 25 Dec 1965 Subject: Carol, we're history Message-ID: <111@boxb> ----BEGIN PGP SIGNED MESSAGE---- I no longer wish to go out with you. Merry Christmas! ----BEGIN PGP SIGNATURE---- Version 2.6.2 12341234... ----END PGP SIGNATURE---- ----------------------------------------------------------------------- Carol can forge an e-mail to Alice that looks like this: ----------------------------------------------------------------------- From: Bob@boxb To: Alice@boxa Date: 25 Dec 1995 Subject: Alice, we're history Message-ID: <222@bobb> ----BEGIN PGP SIGNED MESSAGE---- I no longer wish to go out with you. Merry Christmas! ----BEGIN PGP SIGNATURE---- Version 2.6.2 12341234... ----END PGP SIGNATURE---- ----------------------------------------------------------------------- We assume that it's easy for Carol to forge the RFC 822 headers to make it look like the e-mail came from Bob. That's why many of us use digital signatures. The signed portion of Bob's original e-mail did not state that the message is addressed to Carol (e.g., "Dear Carol"). Alice will probably verify that the signature matches Bob's private key and assume that the e-mail is authentic and has been sent to her by Bob. To repudiate the e-mail, Bob might have to point out that the "Received:" headers differ from his usual e-mails, without relying on PGP. In fact, the presense of his verifiable signature would create more of a presumption of authenticity of Alice's part. Scenario 2: Bob sends the same e-mail as above to Carol. David, a rogue sysadmin, gets a copy of the e-mail, forges the same e-mail as above to Alice. Scenario 3: Bob sends a signed e-mail to Alice. Alice sees it in her newsfeed, forges a Usenet article, makes it look like it came from Bob, and includes the body of Bob's e-mail as the body of the Usenet forgery. Usenet forgeries are easy. Again, if the signed text happens to be suitable, then Bob will have difficulty repudiating the forgery. He won't not be able to use the PGP signature, which will in fact verify. Hopefully, he'll be able to point out that the RFC 1036 Path: header is different from his usual header (which may not be the case). Many Usenet readers would be unconvinced and Bob's reputation would be damaged. Scenario 4: Bob posts a signed Usenet article to alt.sex. Alice forges a usenet article in Bob's name to misc.kids, recycilng the signed body, which would probably be considered inappropriate for misc.kids. Same result as #3. Scenario 5: Bob posts a signed Usenet article to some innocuous newsgroup. Alice reposts the same body in a forgery in Bob's name. The forgery can be cross-posted to numerous "inappropriate" newsgroups ("velveeta"), or multi-posted ("spam"). Certain rogue self-apponited net.cops forge cancels for all copies of Bob's article, including the original. (They are a bigger menace than the forgers :) (As several people know, I have been a victim of some of the above-described kinds of forgeries.) I think the underlying problem is that the way PGP signatures are used by most people, they validate a text, but allow it to be quoted out of context in an e-mail or Usenet forgery. I suggest to the kind folks working on PGP 3 that there should be a standard protocol to include within the signed portion the information on when and for whom this text is written: i.e. the list of e-mail recipients and/or Usenet newsgroups, which could be easily compared with the RFC 822/1036 headers of an e-mail/Usenet article. Perhaps there could be a new option for PGP to look _outside_ the signed block and match the headers with what's inside the block. For example, suppose the signature block says: this text was written by alice(a)zog.org, posted to alt.sex and alt.sex.banal and e-mailed to bob(a)masons.com. Suppose PGP is asked to check the signature in a file that purports to be a e-mail or a Usenet article and has some headers before the signed portion. If there is a list of To: recipients, and it includes someone other than the recipients listed within the signed block; or if there is a Newsgroups: header, and it includes newsgroups not listed within the signed portion; then the input is bogus. For compatibility with the existing software, if the signed block doesn't include this info, then this checking should't be done, of course. After I posted the above suggestion to cypherpunks, one very respected member of that list informed me that "the security multiparts standard (RFC 1848) includes a provision for signing the headers as well as the body of a message. The security multiparts can be used with PGP, and there is even an Internet Draft for it (draft-elkins-pem-pgp-02.txt), but there is not yet consensus for adopting this as a standard on the pgp-mime mailing list." I hope my examples will convince some that present practice of signing pieces of text which can be quoted out of context in a forgery is just not enough. We need to have an easy way to sign the headers without resorting to mine. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

11 10

Re: Compuserve *hasn't* banned newsgroups
by David R. Rorabaugh 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >>I pointed my copy of Free Agent at CPCNET's open news server >>(198.70.185.5) and grabbed a list of groups sure enough, there were >>the seasoned citizens in all their glory. And I was checking out >>those binaries via CompuServe. I suspect that CompuServe doesn't care much what goes over their network (they will claim "common carrier" status) as much as they care about what they themselves provide. The groups in question ARE gone from CompuServe's news servers. - -- David R. Rorabaugh Systems Operations Specialist Dickstein, Shapiro & Morin, L.L.P. The opinions expressed are my own. - -- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMOlXuioZzwIn1bdtAQGgAgF9GOa8Sl3mu6wDt70k6Ij3ZBAfi0j+9i1f bxC/+g1qecXUCL//wPwiTToTjyLouUaW =vXmL -----END PGP SIGNATURE-----

1 0

Re: Guerilla Internet Service Providers
by James A. Donald 17 Dec '03

17 Dec '03

At 09:07 PM 1/1/96 -0500, David Mandl wrote: >I agree. It's not a good idea to assume that there's going to be some kind >of widespread opposition movement when the big Net Crackdown comes. Most >people will either obey the law, be unaffected by it, or violate it in very >insignificant ways ("net jaywalking"). When printing was introduced in the west, the big print crackdown was successful, but there was great resistance, and the crackdown on the printed word required great and continuing violence over a long period, and was never entirely effective. A net crackdown will be substantially less effective than the print crackdown was, and the level of violence is likely to be greater. There is of course a tradeoff: An highly ineffectual net crackdown will not provoke large scale resistance. They can probably force the stuff on alt.pictures.erotica.children to be published in a more discreet manner. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re:US calls for measures against Internet porn
by Mark Neely 17 Dec '03

17 Dec '03

> WASHINGTON DC (Reuter) - The US called Sunday for improved >management of the Internet to prevent people seeing pornographic >material on the world computer network. Perhaps it is a result of many self-interested parties who have hyped the Internet to the hilt, but it never ceases to amaze me how people think that as soon as you connect a PC to the Internet, suddenly, all this information and computer wizardry _leaps_ down the phone line and _jumps_ out of your screen. It can be clearly demonstrated (even to US politicians) that the Internet is not a passive media - users must go out and find what they are looking for (especially pornography). You cannot "stumble" upon pornography, as you might by, say, channel surfing on cable. You can't tell me that someone who fires up their Web browser and points it to http://www.playboy.com, or clicks yes to a request that they acknowledge that they are over 18/21/majority and agree to access adult material doesn't know what they are getting themselves into... Mark ___ Mark Neely - accessnt(a)ozemail.com.au Lawyer, Professional Cynic Author: Australian Beginner's Guide to the Internet Work-in-Progress: Australian Business Guide to the Internet WWW: http://www.ozemail.com.au/~accessnt

3 2

Re: Why Net Censorship Doesn't Work
by cman＠communities.com 17 Dec '03

17 Dec '03

I think that there is still a substantial possibility that many kinds of expression will be marginalized and hard to access for a great many users. One of my co-workers has pointed out that the need for something as simple as a helper application for Netscape loses about 90% of his audience. By simply making it rather more difficult for people to chat about some things, governments can effectively push such things out of the way of all but the most determined readers. This is actually one of those odd Laffer-curve-like phenomena, where as long as the expression isn't too inherently desirable, government restrictions can be somewhat effective, but the more tightly they try to control things, the more likely the are to lose, as there will be more and more desirable content outside the sanctioned sphere of activity. Consequently, I was much happier to see the "indecency" standard get passed instead of the "harmful" standard, as the former will push far more content into the "gray" area of the net, which will encourage development and adoption of appropriate tools. A quote from Star Wars (which I'm just now incorporating into my .sig) was just echoed back to me in a letter from a chap I spoke with from the Australian Office of Strategic Crime Assessment, as encapsulating what he got out of a rather long chat we had when he was passing through the Bay Area last month. Here it is: ------ , ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

3 2