December 2003 - cypherpunks-legacy

RE: Why am I wrong?
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>I am posting this pondering to cypherpunks in hopes that it will be refuted. OK you is rong. > One of the largest problems in the debate over public access to >cryptography is the fact that both sides of the issue hold absolute beliefs. >They are unwilling to compromise, and often seem unwilling >to decide on a solution which is anything but a total win for their side. This is normal when no parent is around. > On one side of the debate we find the law enforcement community. >This group is totally opposed to the concept of public access to >cryptography. No, most in law enforcement at the working level have no opinion one way or the other. Many I talk to know what it is but few have ever seen any more complicated than Lotto tickets. The prevailing attitute (which I happen to share so am biased) is that >most< criminals are not very intelligent else they would not be criminals. >Although they claim this to be false, the reality is that >these people think its ok for anyone to keep a secret, as long as no one >is keeping secrets from them. Secrets rarely enter into law enforcement. Determining what the truth is in the face of conflicting data is more often the case >As Jim Kallstrom, assistant FBI director, put it, "unless >you're a criminal, you have nothing to fear from the government." At the same time, we have a massive division in this country (do not know about others) in which the aim of most citizens is to avoid any contact with the government if at all possible since invariably the citizen loses in the exchange. >The law is often very wrong, and even our lofty constitutional values >do not prevent bad laws. When the law is wrong, the law's enforcer is >the criminal. Dangerous attitude to take. The law is never wrong because it is the law. The fact that a law exists may be wrong but that has nothing to do with the law itself, it merely is. The law's enforcer would be derelect in his/her duty if she/he did *not* enforce the law. (Now sometimes the *enforcement* is over zealous but that is a human matter. That is the definition of natural law, >People MUST have the right to dissent. Is the great strength of the US. >People must have the right to oppose bad laws No must, they do. >and in many cases people must have the capability to violate bad >laws with impunity. Disagree. There may be times when laws are violated with just csause but the violator must do so with the expectation of retribution else the law is meaningless. >As Socrates would say, if people know the what is good and what >is bad, they will always choose the good, because the good is what is >most desirable. However Pavlov proved that perceptions may be distorted. What is good today may be evil tomorrow and a lack of stability leads to insanity. To me "selective enforcement" is a cop-out. >That is why law enforcement is very restricted in the Constitution. Law enforcement is not restricted by the constitution, law *enactment* is ("Congress shall make no law..."). >The "compromise" the law enforcement community has >suggested, key-escrow, is not a compromise at all, because it makes it >impossible for people to keep secrets from the government. No one needs to agree to the compromise. However I believe that good crypto with key escrow (provided the escrow holder is trusted) is compelling for a number of reasons, mainly because it provides a means to protect information that has no protection today. Everyone screams about porn on the net. Personally I find the *concept* of pornography to be an indication of a social problem that no one is willing to admit to. Crypto provides a means to shield children from the "adult conspiracy". Haven't seen any mention of that. Crypto will provide the essential mechanism for Internet Electronic Commerce as MasterCard/Visa have announced. If I send my 1040 to the IRS on the net, I *want* the gov to be able to read it. Public crypto is necessary for the US government to comply with its own regulations. It will exist. Now there are three basic elements that must be understood as a foundation for discussion. a) we are guarenteed free speech b) there is no requirement that anyone must be able to understand it c) we have no right to tell anyone not to listen. Look at these three items. Anything that denies one or more of these elements is wrong. May take a while to realize why but will happen. One corollary: every citizen is responsible for the effect of exercising his/her right to free speech. You have the right to shout "fire" in a theater or to threaten the sax man but may be arrested for it. This is not a restriction on free speech since each is narrowly defined specification. "Libel" also carries very specific specifications that must be met. Does anyone here think that a libel suit is a restriction on free speech ? At the same time nothing compels speech - "You have the right to remain silent". Moving right along, the next question would be "could the government restrict crypto ?" The answer is essentially no since the government would have to first define what crypto was e.g. prove that Navajo was in fact crypto. The compelling problem is that given any random string of bits, I could come up with an algorithm/book code/OTP from which *anything* could be extracted. Want a pedophile .GIF to extract from the Gettysburg Address - no problem. Want to extract the Communist Manifesto from ITAR - hokay. The fact is that anything could be shown to be an encryption of almost anything else since good crypto is indestinguishable from random noise. The corrolry being that it would be impossible to prove that something *wasn't* crypto. In fact it would be possible that given an encrypted message, using one key, a first message would appear, given another, a second. Which is the real message ? (see the fifth amendment) Thus it would seem to me to be (not a lawyer or a politician so what do I know - we used to have an ordinamce near here requiring alligators to be leashed) very difficult to legislate anything concerning crypro since first crypto would have to be defined and second it would have to be able to be detected - a requirement for all text to be in third-grade flat ASCII won't fly. "A bear's natural habitat is a Studebaker". Warmly, Padgett

2 1

Re: attila sez
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 12:19 PM 2/5/96 -0800, paralax(a)alpha.c2.org wrote: >I seek to censor no one. I prefer to confront racisim whenever and wherever >I see (read) it. Mr. May embarassed himself with his denigrating application >of the word "Jap" to describe the Japanese people after demonstrating a gross >lack of knowledge and sensitivity about Jews. For the terminally clue deprived: Once again: Tim's remarks concerning the holocaust were *irony*, get it *irony*. And calling japanese japs seems reasonably appropriate when also calling them mass murdering terrorists. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

[NOISE] Paranormally Good Privacy
by Dave Del Torto 17 Dec '03

17 Dec '03

[ Sorry, but I couldn't resist these excerpts from The mini-Annals of ] [ Improbable Research ("mini-AIR" Issue #1996-02, Feb, 1996) --dave ] ................................. cut here ................................. ----------------------------------------------------------- 1996-02-05 Paranormal Spoon Incident In the last issue of mini-AIR, we offered, free of charge, to test any reader who wished to know if he or she has paranormal powers. Testees were instructed to sit in a quiet corner and mentally send us their names and addresses. Alas, we had to terminate the testing program after readers in England and Israel reported a rash of bent spoons and then mentally lodged police complaints against us. We are now engaged in extra-cognitively presenting evidence to demonstrate that, whatever is bent or twisted, it is not the spoons. ----------------------------------------------------------- 1996-02-06 PGP-Y Our paranormal testing program has already had one commercial spin-off. Our engineers have developed a truly foolproof data security protocol. It is called PGP-Y -- "Pretty Good Parasychology." The mechanism is simple. You imagine that you have transmitted data to someone; that person then imagines that he has received it. Using PGP-Y, any type of information can be transmitted over the Internet with complete security. The key is that the data is transmitted high over the net -- so high that the data actually travels above the net rather than within it. The data is transmitted telepathically (and for those who distrust electronic funds, we also have a scheme for transmitting cash and gold plate telekinetically.) ................................. cut here ................................. -- dave _______________________________________________________________ "OK, now everybody who believes in Telekinesis, raise my hand."

1 0

re Telecoms Bill
by Michael Peponis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >Well, if "cypherpunks write code", is there any code we should be >writing in response to this? :I'm not familiar with SSL protocols, but something that would anonymize :web page access and keep it entirely encrypted (not just credit card or :forms transactions) would be good. I think the first problem would be how to hide a sites true location. For example, if I have a domain called xxx.offensivestuff.org, how would I hide the sight so that while it is freely accessable to those who are looking for it, yet not allow a goverment agency to home in on the geographical locations via trace route. I remember reading a number of articles about floating sites, the only problem is with the way Internet routing tables are structured, given that the site would constantly spoof different ip's to make it harder to track, or maybe even hacking some of the routing tables on the larger gateways, it could cause all sorts of problems with traffic. ie domain xxx.offensivesutt.org has the routing information for www.fluffybunnies.com, but if xxx.offensivestuff.com moves, then that routining information is invalid. resulting in numerous broadbad broadcasts trying to determine the correct route to www.fluffybunnies.com. Additonally, a number of bogus proxie servers could be set up to confuse traffic analysis in attempting to determine what the true endpoint of a transfer is. At some point, the data could be encrypted by a proxie server, and sent to the final destination. Thus just like e-mail is reordered by remailers, HTTP/FTP/Telnet connections can be shuffled around to foil analysis. Of course, this approch would result in a slower connection and more packet hops. :Encrypted/truly anonymous ftp would be nice (though some folx would :understandably have problems with truly anonymous uploads, and crypto :export restrictions in the US could be problematic legally). Under the forementioned technique, it would not be problematic technically. :I think there is already work on encrypted telnet (stel) by the CERT/IT :people. I have seen an SSL telnet client source code on hactic I think. :On the non-net side of things, implementing encrypted BBS/communications :and file-transfers is useful. I'm told PGP-Phone is supposed to support :encrypted communications/file-transfers... so a host-script language that :enables a simple BBS would be nice. I like this idea, but I am not sure how the laws work. For example if a BBS had subscribers sign a voucher stating that they were not agent of a goverment agency, would it hold up? would lying constitue entapment? If not, then yes, encrypting the data would provide protection becasue no one would be able to detect what was being passed. under this approch information gained by wiretapping would not be usefull. -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMRau2EUffSIjnthhAQHnhgP/SgH4SA6yKRlkgnJ198jw2SBaZ5SqsNRF YYtyHWeWcGqf30ghoe20Bvfug7oaJrB5jO+fqJ6DiL5Wp2onmWL6MTrReEpt7q1t 8ESRgyO/ndVDBhiQHWxLY1tynVBJxUbCrxvMHyPtpTIRXQtZsFlM6Iw8lndbnUbK RofiuhFzDlU= =n9n+ -----END PGP SIGNATURE----- Regards, Michael Peponis PGP Key Avalible form MIT Key Server,or via finger

1 0

Re: attila sez
by Rich Salz 17 Dec '03

17 Dec '03

>of the word "Jap" to describe the Japanese people after demonstrating a gross You know what is on the sign of Honda dealerships in Paris? JapAuto Go figure.

1 0

[noise] the individual and the tribe
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Rob said: > ... in the sense that >tribal societies are individualist. I absolutely don't agree. The subordination of the individual to the tribe is fundamental of their vision of the world. Individualism is not about the personnal opinions, it is about the vision of Man as an entity in itself, not a type of cattle that owe his service to the collectivity of the tribe. Crypto makes the tribe (and it's sorcerers) loose their grip... :) JFA

1 0

Re: FV's blatant double standards
by John Pettitt 17 Dec '03

17 Dec '03

At 06:34 AM 2/6/96 -0500, Nathaniel Borenstein wrote: >1. He doesn't explain how he's going to spot the VirtualPIN in the >outgoing stream. Given the non-structured nature of the VirtualPIN, >this alone probably requires more sophistication than our entire attack >program. > >2. He acknowledges that this approach will miss anyone who isn't buying >things from the machine that actually composes his mail messages. What >he doesn't seem to realize, however, is that this means that any >automated attack will cause "fraud" to be called as soon as it hits a >user of AOL, Compuserve, etc. Jeff's approach would last a bit longer, >but is also vulnerable to heterogeneous mail environments. The real >point is that an automated attack like this one is undermined by email >heterogeneity, which will cause FV's fraud department to be alerted >quite quickly & trace things down. In contrast, the attack we've >outlined on credit card numbers is simple, single-step, and has no >obvious "misfiring path" that would lead to quick detection. It could >do its dirty work for a long time. > > You missed my point. 1) hook into the winsock and look for an FV message in the web data stream, save the ID. 2) now look for an approve/deny/fraud, when you see one you know that the user uses an IP connection for mail and web. 3) only now does the attack begin. The attack does not trigger until it *knows* that both FV orders and confirms are moving via winsock - I.E. it does not report back the FV ID of the victim until it sees the victim use FV and *knows* it can intercept the reply. The key here is not breaking all cases just a significant number and not setting off too many alarms. This significantly lowers the fraud detection risk, now the fraud does not get noticed until the card statement shows up, the same as with a card number snooping attack. Yes it will miss a large group of FV customers who use AOL, CI$ etc (although a similar hook in the common serial port code on Win95 could catch most of them). The basic point is if the achine is not secure then no data on it is either. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

1 0

Re: Why am I wrong?
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

I think there is a middle ground that you may have missed. Let's see... The cypherpunk view seems to be that eveyone *should* use forms of encryption for passing packets along on the internet. It works best when the majority of people are using, but no one is forced to encrypt their email. People still send postcards, right? No matter what percentage of users on the net use encryption, there will always be those who will exercise their right to send open, plain text messages. It is our right to choose *to* encrypt that we are fighting for, not a general mandate that all use crypt. As for the law's take on this matter, under the constitution, they have no right to tell us that we cannot use encryption in sending our messages. They also have no right to tell us that we cannot teach others how to use it, develop easier ways to implement it so that eventually it will be a no-brainer to use, say that we are criminals because we opt for our right to privacy, or ask us to give up that right to privacy because we are using a new medium. One issue that may come up is that the law cannot make us give our passwords so that they may use our keys to open our documents because it would be self-incrimination, however, they can serve warrants to search our software and documents. In their search, they will be able to try and break our passwords to gain access to the files. If they cannot, it is their tough luck. I don't think that I am stating a position of cypher-anarchy, but advocating a position of personal privacy guaranteed by the Fourth Amendment. I don't think that wide-spread use of cyptography would cause anarchy. Would foreign govt. be able to slpi stuff by our govt. because they can use encryption? Sure, like they aren't already doing that right now. The US govt. seems to be saying "Hey, no fair! I can't see your stuff anymore. You can't do that!" when all along, no one has been able to see their packets because they are encrypting it. There are still ways for them to gain access too. Don't tell me they can't set up peeping toms to record keystrokes. Certainly they can do this on ppl's machines. It would be more difficult, but that is the whole point. It should be sufficiently difficult for them to tap so that to tap freely would be infeasable for them to do, just like steaming open every envelope that comes through would be infeasable. They can only go after the real suspects because it is feasable to do only that. In essence, what I am saying about the govt. is that thy are crying wolf. They can still be efficient in their duties without wholesale access to all the data streams. They want the power to monitor far more traffic than they could ever get warrants for and they know it. I likewise invite you to chip at the cracks in my reasoning as it will improve our arguments in general. Freedom is power. God save the Citizen! Jeff Conn lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Likely application for high-bandwidth proxies (fwd)
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>It would appear that a potentially very popular application for high- >bandwidth anonymizing proxies has arrived: > >Forwarded message from list-managers-digest: >> From: Project Genesis <genesis(a)j51.com> >> Date: Mon, 05 Feb 1996 02:42:13 -0500 >> Subject: Speaking of spams... >> >> Did I mention that Project Genesis is an organization specializing in >> religious education? The message below explains why all of our public lists >> are moderated. I value privacy and have grave doubts about things like the >> Exon amendment (which may make Internet providers liable), but I also think >> that we need to ensure that the Internet not become one big red-light >> district. Spams like this are a step in the wrong direction. It hit several >> of our religion-oriented lists. >> >> Ken I don't think that you understand one thing. If we (the users of the internet) say that X-THING is unacceptable on the internet, we open up the floodgates for everything else that ppl what to censor. There are better ways to keep children from looking at sites and spams like the one you posted. Parents. It's their responsibility to keep their children from getting into this stuff on the net. If we allow the govt. to take care of our issues and do not take responsibility for them ourselves, we deserve to have a big brother who can take care of us (see what I mean?) No control can be given to the govt. If it comes down to it, we can have a rating system like the movies and music. Our lists are moderated, BTW, so that we don't have to wade through a bunch of irrelevant data while trying to read about the lists/newsgroups topic. Some of my favorite groups are alt groups, and as much as I hate having to read about Grubor all the time (please ship him off to a dessert isle), the moderation would limit the scope of the groups and interesting, sometimes relevant pseudotopics would be gone. I want the psudotopics! That's where some of the best threads get started! But moderated groups have their place too. Who wants to read a bunch of trolls while trying to read a science group. And soc.support groups would not be of much use if flamers and lusers kept posting disruptive and disturbing articles. But in all the cases here, it is we, the users, who decide what stays and what goes. Peace to all. Jeff Conn lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

1 0

OCAF White Paper on porn on the net
by printing＠explicit.com 17 Dec '03

17 Dec '03

Hello all, With the passing of the CDA recently, The first wounding of the rights of free speech online, The Oklahomans for Children and Families are going in for the kill. A WWW site has been set up with a HTML version of what the autoresponder sends out. http://www.bway.net/~dfenton/noporn.html This is a scary document, and was originally written as a prosecution primer for law enforcement. -William Knowles .. //!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\ Graphically Explicit Printing - Advertising - Graphic Design 1555 Sherman Avenue - Suite 203 Evanston IL., 60201-4421 800.570.0471 - printing(a)explicit.com Accept, Embrace, Adapt, Create \\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//!\\!//

2 1