December 2003 - cypherpunks-legacy

Re: Fair Credit Reporting Act and Privacy Act
by Peter Conrad 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, Duncan Frissell wrote: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> [...] >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. This is not true. Individuals are not required to register anything, the BDSG simply does not apply do them (see. Par. 1 Section (2) ). Businesses are required to register (besides their address and the kind of business they do) a person who is responsible for any personal information they want to keep and a general description of the kind of data they intend to keep (see Par. 32 Sect. (2) ). Computers are hardly mentioned anywhere in the BDSG, in fact, most of it applies to any method of processing personal information. It doesn't matter if a business keeps data printed on paper or stored in a computer. >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Oh well. In the past buyers and sellers have always found each other without keeping large databases. Most buyers are quite capable of finding appropriate sellers (that's what advertisement and commercials are good for). The goal of the BDSG is to give the individual control of information kept about him. An example: The Deutsche Bundesbahn issues so-called 'BahnCards'. If you buy a BahnCard you can use the Bundesbahn-trains for half the normal price. Until a couple of months ago, the Bundesbahn gave all the information they got from their BahnCard customers to the Citybank AG. The Citybank AG sent their junkmail to all Bahncard customers and tried to make them get a credit-card. This was in violation of the BDSG. And I still know where to get a credit-card if I want one. >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. Oh yes it does. The same rules (or even stricter ones) that apply to businesses apply to all government organizations. If any government organization (even the police) violates the BDSG you have the right to file a lawsuit against the organization (or the individual who violated your rights). >If you don't want people to know things about you, don't tell them. You sometimes have no choice. Those of you capable of understanding german might take a look at http://www.fh-ulm.de/bvd/gesetz.html Bye, Peter NB: I subscribe to this list through a digest only. Please CC: me on followups. - -- Peter Conrad | "They say time is the fire in which we burn." Am Heckenberg 1 | Dr. Soran, Star Trek - "Generations" 56727 Mayen Germany Email: p_conrad@informatik.uni-kl.de,conrad@unix-ag.uni-kl.de -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAgUBMRiPe7FFskV8RCVHAQEMwQP7B6/QSo0E8bAiPcusg9+Etzx+WdIi6nuP WVvnJ7RWrwoScnPkRJs7uaBfCpedFu3TZX7RyOm6bVAX4mwFe/dtqhBxcy8U3lQg fqa3WUAhyBNPcr6tF38sVocKs6hWRiw+KckzvnCx9grJpqVHz6kvimAcVOIg027O Zzk8jyopYDw= =PBa7 -----END PGP SIGNATURE-----

1 0

Re: CypherPunks as Teachers; source material [Re: Hey,we are quaint! , (Was: A Sign of the Future)]
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"attila(a)primenet.com" "attila" 6-FEB-1996 02:05:25.34 > Jefferson certainly would role over at the degeneration of "his" party which began in the 30s as liberal news, particularly radio, demagougues discovered they could fan the riff-raff and control the direction of government. --------------- An interesting example of Jefferson's thoughts on the subject of the "Natural Aristocracy" can be found at http://ils.unc.edu/~vreer/aristoi.txt -Allen

1 0

Re: Telecoms Bill
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Deranged Mutant <wlkngowl(a)unix.asb.com> >Encrypted/truly anonymous ftp would be nice (though some folx would understandably have problems with truly anonymous uploads, and crypto export restrictions in the US could be problematic legally). I think there is already work on encrypted telnet (stel) by the CERT/IT people. ---------------- If a completely encrypted http method (ssl) is indeed available, a (clunky) solution to both of the above would be a web proxy on an encrypted server that would act like a ftp or telnet proxy. I'm not sure about the limits of the html language for doing this (updates, et al)- it may have to be graphics to the user and form input back, which would take a while. -Allen

1 0

Re: Assassination Politics--isn't it gambling?
by banelaw＠med.com 17 Dec '03

17 Dec '03

Jim: as to "Assassination Politics." Isn't the structure you describe gambling? Placing money on a prediction, with the correct predictor winning? And if so, isn't it illegal if done over the wires, i.e., federal commerce? I'm not looking for a way to declare your scheme illegal, I'm just pointing out that there are other angles, especially if done over the wires. I guess you could move the structure off shore--pity the poor country hosting such an entity! If you were at all succesfull, the server accepting digital cash would be moving from place to place--remember pirate radio? Philip BaneLaw Suite 210W 1800 112th Ave NE Bellevue, WA 98004 206.455.5537 Fax:206.812.2032

1 0

RE: Why am I wrong?
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

(Was referring to the govs ability to control communications *with them*) >Perhaps I do not understand your point. They can perhaps >control the communication between them and me, but not between me and >everyone else. Ok please view my three points fromn the standpoint that so much of the total traffic would be affected by at least one, that "uncontrolled" communications would be minimal. >>2) communications using someone else's equipment/network (university, >> employer, etc) >Employers nor universities have any jurisdiction over whether you use >encryption in your transmissions while using their networks unless it >specifically does not allow it when you first agree to have an account with >them. I think you had better review the concept of "property rights". Unless you have a contract that says you can, or can establish "expectation", the property owner who allows you to use their equipment may control how it is used. >>3) communications with anyone (Internet merchant, etc) who says "this >> is not what <MasterCard|Visa|AmEx> approves..." >I don't quite understand your meaning. I am a merchant and I encourage my >customers to use PGP when they send information over the internet, whether >to me or to anyone else. That is fine but what if MasterCard refuses to accept this method ? (Not saying they will, just "what if" ? You are free to use digicash if you want but is not "legal tender for all debts public and private". >Comments? Bring 'em on! :-) I dood it. Warmly, Padgett

1 0

Internet Passports, Identity Escrow, and Back Doors
by tcmay＠got.net 17 Dec '03

17 Dec '03

lmccarth(a)cs.umass.edu risks violating the terms of his PC probation by writing: >I just sent this to the remailer operators' list, but it may be of interest >here too. I think Tim or Lucky or someone suggested something like GAI >(Government Access to Identities) here a while back.... > >Forwarded message: >> Lance writes: >> I hypothesize that the Strassmann & Marlow paper is meant to lay the >> groundwork for some sort of eventual Government Access to Identities proposal >> (which would more likely be termed "identity escrow" by the Feds). It's >> about the only way I can reconcile statements like the following >> (juxtaposed by me, not them): Indeed, several of us have written extensively about the rationales for "is-a-person" credentialling by government, what I have quipped is a kind of "identity escrow" (further abusing the term "escrow"). I lack the time to write a concise summary, so will instead mention a bunch of points. Searching the archives for mentioned terms may yield more comprehensive articles. * "Internet Driver's License." This is not just a joke, although the reported systems are not called this. But the idea is the same. A credential, probably a signed key certificate, that is granted after proof of age is presented. (For example, one might show a passport or conventional Driver's License at a Post Office and they'd issue a signed key....something they'd like to get into the business of doing, from various reports.) * An age credential such as this is essentially going to be necessary, in the worst case, for accessing the Net and Web. If the CDA is upheld--which may take several years to decide for sure--then sites will probably have to take positive steps to verify that users are not minors. Unless they carry only G-rated Barney material (but no Barney jokes, as children might be traumatized). * This age credential obviously cannot be just the "I swear that I am old enough to view adult images" sort of click button. (Although it mostly works with ordering adult material through the mail to immunize a provider, except in this case there is the additional "check" of mail delivery, where a postal carrier may may informal inquiries about the age of the recipient. Plus the parents can intercept the subscription to "Hustler" that 14-year-old Johhny ordered.) * The various schemes for signature authorities, which I admit to not following very closely, all the stuff about Verisign and whether Netscape will or will not accept signatures of rogue signers....all this suggests a worrisome situation in which all messages must be signed by the True Name (see above) of the message originator. (For a good fictional treatment of this, see John Brunner's "The Shockwave Rider.") * Remailers and Web proxies obviously represent an end-run around the CDA and key escrow, in various ways, so I think it likely that these will come under attack. The legal means of attacking them may be one or more of the following: - holding the remailer site operator legally responsible for what can be traced back to his system, especially if in plaintext. (This would make the last site in a chain of otherwise-encrypted messages especially vulnerable if the message is delivered in plaintext to the recipient. Of course, with wider use of crypto, the message can be delivered in encrypted form. I see more and more remailers insisting on encrypted (high entropy) messages.) - for sites that charge any kind of fee for remailing, extensions of the business laws to require that logs be maintained ("so that customers can dispute bills"!!). These logs could then be subpoenaed to aid in tracing messages back to origins. (Sure, it gets hard when hops outside the country are involved...I'm not saying this'll be easy or effective, just a possible avenue of attack on remailers.) - finally, outlawing of remailers and proxies. Or extensive registration of them. (We've had this debate a couple of times, about whether mail-forwarding services really have to register, get proof of ID, send records along to the government, etc.) * Identity Escrow obviously fits in closely with key escrow in general. In closing, I think the next couple of years will see increasing pressure to require some kind of "Internet Driver's License," at least within the U.S. Other countries will jump at this (Germany, China, France, the usual suspects). Call it an "Internet Passport." For some interesting insights into the thinking of some in the crypto community, go back to around 1986-8 in the "Crypto" Conference Proceedings and you'll find some papers, by Fiat and Shamir I believe, on the "problem" of "rogue governments" (they cited Libya for their example) issuing "false passports." (I have commented in the past that the U.S. government has a reported 50,000 or more people in the Witness Security (aka Protection) Program, under the U.S. Marshal's Service, and reserves the right to create completely fake "legends" (dossiers) for these people, including false credit records, false education records, and false employment records. Not to mention their various secret agents. Clearly the government would want "back doors" into any Internet Passport system!) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

strong cryptography for Java
by Jyri Kaljundi 17 Dec '03

17 Dec '03

I found today a Java package, implementing some cryptography (MD5, DES, RSA and Diffie-Hellman). Seems quite interesting. It is called JCrypt alpha release 0.1. The information is on: http://www.cs.utexas.edu/users/achou/JCrypt/packages.html Sorry if this has been on this list already. Jüri Kaljundi jk(a)digit.ee Digiturg http://www.digit.ee/

1 0

POTP gets good press
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Sun Observer -- "An Independent Journal Devoted to the Sun and Compatible Markets" -- ran an article in the Feb 96 issue entitled "New technology eliminates need for keys to encrypt e-mail messages". Byline: Bob Harvey. About the author: "Bob Harvey is vice president of the Internet Security Corp., a Lexington, Mass.-based network security solutions provider." Content: includes diagrams entitled "Link Level Encryption" in which sender transmits keys to receiver, and "Packet Level Encryption" in which sender transmits key sto certificate authority which transmits them to multiple receivers, and "Synchronized Random Key Generation (SRKG)" a la "Power One Time Pad" in which no keys are transmitted and multiple recievers magically decipher messages via built-in encryption devices. Am I right in thinking this is utter unmitigated bullsh snake oil? Does anybody have any other dirt on this Bob Harvey guy and his Internet Security Corp? What is his relationship with the POTP folks? An Alta Vista search revealed several Bob Harveys, but none who matched with "Internet Security". I'm Cc'ing this to the editor in chief of The Sun Observer. If he doesn't know about the cypherpunks he might want to request some explanation... Regards, Bryce "Toys, Tools and Technologies" the Niche New Signal Consulting -- C++, Java, HTML, Ecash Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMRkD8/WZSllhfG25AQESBgP8CmmKb0+VMqs14FNQ2YoAllXcaqAtc09Y 99KljeM0gHpm19x14Tj011bngS59EyUCDvoFaY6HtOmOPNqR2SpQxoHp9IBWNJmS dGEGwuqCLEB2gxMwgtjrwCNWyJmXk6Wp8UTRPcoG/woXWBCkyllbc62dV/RbILva OeKJR5FpQ9Y= =YT6V -----END PGP SIGNATURE-----

5 6

Re: Windows PGP mail reader
by Ted Garrett 17 Dec '03

17 Dec '03

At 09:56 PM 2/3/96 GMT, you wrote: >In article <4eaksb$6i9(a)recepsen.aa.msen.com>, jims(a)conch.aa.msen.com says... >>Hi. Can anyone recommend a Windows based email/POP3 reader that can decrypt >>content? Please reply via email: > >Have a look at Pegasus Mail. It handles PGP very nicely with a recent >addition. by John Navas, both are free: >http://users.aimnet.com/~jnavas/winpmail.htm > I recently picked up "PGP Windows Shell". I have found it to be an excellent utility for encrypting and decrypting messages as easily as cutting to and pasting from the clipboard. All operations are automated, you can use whatever mailer you want, and it's freeware. The URL is http://iquest.com/~aegisrc/utils2.shtml Also, if you want something to automate usage of the cypherpunk style remailers, check out Joel McNamara's Private Idaho. It's an excellent tool, also freeware, and is available at URL http://www.eskimo.com/~joelm/pi.html Another utility you might like to look at (of course it's freeware too) is PGP WinFront. While it's a little more cumbersome than PGP Windows Shell, it has all the same functionality. There is also a shareware utility available from the same URL, called PGP QuickFront. The combination of QuickFront and WinFront make using PGP under windows almost pleasant. It can be found at http://netaccess.on.ca/ugali/crypt/ .

1 0

How to prevent a virus infection :-)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Just watched an "expert" on Bay TV (SF Cable). He stressed that websites without firewalls pose the risk of spreading viruses when downloading files from them. A GIF was being downloaded in the background... LOL. I only wonder who the fuck is hiring such idiots. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0