December 2003 - cypherpunks-legacy

Re: Jamming and privacy problem
by Phil Agre 18 Dec '03

18 Dec '03

The emissions tracking proposal might have another sort of relevance to cryptography. Assuming (it's a big assumption, but entertain it for a moment) that we agree that some type of automatic enforcement mechanism for emissions-based repairs were a good thing, how could it be built without identifying any individuals to the authorities? What I find so utterly over-the-top about the ARB proposal is that it is capable of maintaining records on everybody everywhere, whether they are violating any laws or not. Of course they'll promise to protect privacy, and they may even promise not to capture any records for people whose emissions fault codes come up clean (though they say nothing about this in the RFP). But such assurances would be nonsense, since once the system is in place a simple software change would cause the system to revert back to the total-surveillance functionality described in the RFP. The key, then, is designing systems so that simple software changes under the control of the authorities can turn them into instruments of oppression. This design consideration is hard to even formulate accurately in the context of traditional system design methodologies, which assume that everything in sight comes with identifiers and that *the* way for a system to relate to something is to represent it in terms of those identifiers. Digital cash and other such schemes are so profound precisely because they break with this underlying assumption, forcing systems to think thoughts like "this person (whoever s/he may be) has paid $1 to travel on this road", "this person (whoever s/he may be) is eligible for an upgrade to first class", "this person (whoever s/he may be) is obeying emissions laws", and so on. Philosophers and linguists call these "indexical" (or, more precisely, "deictic") because they identify an individual contextually without appealing to a name or other universal identifier. Phil

1 0

Fair Credit Reporting Act and Privacy Act
by Frank Willoughby 18 Dec '03

18 Dec '03

FWIW, while the goal of the cypherpunks in helping to promote secure private communications by making encryption publicly available on a worldwide scale, definitely helps socially backward countries which have dictators (communist or otherwise), it misses its mark somewhat in the USA. Personally, I think that in the USA, this is treating the symptom, but not the disease. Probably the easiest way of ensuring that personal information isn't wantonly distributed by credit agencies or (anyone else) is to update our Privacy Act - which is ridiculously out-of-date and badly in need of being re-written. It is also hampered by its apparent lack of teeth. My personal recommendation would be a law like Germany's BDSG. The BDSG (BundesDatenSchutzGesetz which translates to: Federal Information/Data Protection Law (aka Privacy Act). Even better would be a law like the one in Austria (which I understand has the world's strictest privacy act. (Hooray for the Austrians). 8^) If the Privacy Act were rewritten to be as strict as the BDSG, businesses would have a (mandatory) legal requirement to: o Ensure that personal data is stored properly (by encrypting it, etc) o Ensure that personal data is not distributed o Ensure that databases are *not* being maintained which describe the characteristics of individuals (buying habits, income, property ownership, etc) wantonly propagated by marketing (direct mail, telemarketing, etc) companies. (Note that credit bureaus still have a function, but they would be (forced to be) responsible for ensuring that compliance with the Privacy Act would be maintained. This could result in better safeguards being implemented by the credit bureaus.) resulting in the following by-products: o the promotion of the use & implementation of encryption - including the possibility of ITAR being reduced or eliminated for the export of encryption products o reduced propagation of personal information o reduced amount of junk mail that winds its way to our mailboxes each day 8^) o reduced amounts of tele-marketing 8^) If pressure were brought to bear on the law-makers to rewrite the Privacy Act to give it qualities like the BDSG, etc, then this would significantly help achieve the cypherpunks' goal of promoting secure private communications. (I realize this isn't the only goal of the c'punks, but its a start). As the changes would be made within "the system" as opposed to outside of it, there would be virtually no hassle from the government. IOW, changing the Privacy Act will probably solve a variety of problems while achieving the c'punks goal of secure personal communications. Food for thought. Best Regards, Frank <standard disclaimer> The opinions expressed above are of the author and may not necessarily be representative of Fortified Networks Inc. Fortified Networks Inc. - Management & Information Security Consulting Phone: (317) 573-0800 - http://www.fortified.com/fortified Home of the Free Internet Firewall Evaluation Checklist

1 0

RE: Protecting the innocent on the nets
by A. Padgett Peterson, P.E. Information Security 18 Dec '03

18 Dec '03

David rote: >If so, then using the dictionary as the key seems bad---the >compression dictionary is not designed to obscure the data, but to aid >in compression. The dictionary might well be easy to guess. For >example, some compression schemes use a Huffman coding on their >dictionary. If so, one can guess that short pointers into the >dictionary correspond to common plaintext strings. Using such a >dictionary as an encryption system is security through obscurity. Oh Heavens to Betsy, I was not trying to describe *crypto*, that might be regulated. Was describing a mechanism to comply with the new Scudderite laws concerning protecting the innocent from nasty sights. Figure it this way: can duplicate CD-Roms for a quarter. If a subscription costs $19.95/yr then who is going to bother with cloning it ? "controlled circulation" magazines would save postage. Web pages could be posted with nothing but pointers (don't tell me you have never sat waiting for a little red bar to reach the end) and assurance that only a specified audience could look at the pretty pictures (which compress the best of all 8*). Further, if the intent is to satisfy a law then would this not be a "good faith" attempt to do so ? Zippy's friends have decided what is not safe to be on the net in the clear but they have not said what it takes to protect the innocent while allowing consenting adults their freedom to communicate. If I want good crypto I just use PGP (and the Enclyptor makes it real easy). This is something completely different. Warmly, Padgett

1 0

Re: free speech and the government
by Alan Olsen 18 Dec '03

18 Dec '03

At 09:25 PM 2/4/96 +0000, Stephan Mohr wrote: >Actually, I am glad that the whole story started over some neo-nazi stuff >and not a recipe to easily make a very potent poison. For some strange reason, people believe it is difficult to find information on such things. I picked up my copy of _Poisons and Poisoners_ by C. J. S. Thompson at Barnes and Noble in the discount section for $9.98. Books on the topic can also be picked up in bookstores catering to Murder Mystery fans. (Some excelent descriptions of esoteric poisons can be derived from these books.) "Forbidden" information is hard to forbid with the existance of the printing press. Electronic networks make the information even more available. Are you suggesting that we burn all the books with "dangerous" information? And who's definition of "danger" do we take? Yours? Mine? The National Council of Churches? Crypto relevence: Some people regard the ability to hide "dangerous" information to be as "dangerous" as the information hidden. Freedom of Speech includes the right to choose who can listen to that speech. Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

No Subject
by karl.ike＠sihope.com 18 Dec '03

18 Dec '03

Attila: I'm not in the business of running or hiding. I'm just an average, everyday working guy that doesn't like credit reporting agencies, what they stand for or what they do for money. I didn't say that I was going to do this. I just had the idea! I don't have the knowledge or the money to spend. That doesn't mean that there is someone out there that would jump at the idea. I just don't like the idea that these assholes know more about me than my mother and sell my private and personal information to anyone for big bucks. My credit is fine, just ask my banker or better yet, my mom. I am assumming that you know far more people on the internet since I have only been on for a month and have done three e-mail. I'm just suggesting to get the idea out and someone will take the ball and run. Yes, they will be a hunted man, but not a US citizen. Someone out there with a laptop and a cellular, living on a cruise ship, just may enjoy the idea. Just me, Karl

1 0

Re: Encryption and Backups
by Robert A. Rosenberg 18 Dec '03

18 Dec '03

At 20:33 2/4/96, John Pettitt wrote: >On Sun, 4 Feb 1996, Alan Olsen wrote: > >> Something that I have not seen addressed is the need for strong encryption >> in backup software. >> >> Most backup software has an "encryption" option, but I have seen few that >> have anything resembling strong encryption. Furthermore, I have seen no >> real push for strong encryption for backups at all. >> ... >> Might be an idea for a product there... (And you can bet law enforcement >> would throw a hissy fit about its existence.) >> >CP Backup (part of PC Tools for Central Point aka Symantec) has DES. As to >how good the implementation is: I have no idea. Retrospect (a Mac Tape/Floppy Backup Utility) also has an Encryption Option I think.

1 0

RE: [NOISE] Futplex makes the news!
by A. Padgett Peterson, P.E. Information Security 18 Dec '03

18 Dec '03

OK, I give up. Took off the head phones connected to the TO, went downstairs, set the V-15 Type II on the Dual 1019 to 7/8 gm. Patched to the Pioneer 1500TD amp feeding front AR-5's and rear AR-2ax's, cranked to "pain" and spun some vinyl. "Freedom's just anotha' word foa nothin' left to lose." - Janis Joplin & Full Tilt Boogie Band, Columbia PC 32168 (first one I found in the pile - believe the original was on a album with her standing spraddlelegged with the big grin - is here *somewhere*. Credit on th record was K. Kristofferson and F. Foster. (Had to go downstairs, contrary to popular belief, everything is not in my den 8*). warmly, Padgett

1 0

Songs, Janis, Left to Lose, and Salinas
by tcmay＠got.net 18 Dec '03

18 Dec '03

At 12:57 AM 2/5/96, "A. Padgett Peterson, P.E. Information Security" <PADGETT@hobbe wrote: >OK, I give up. Took off the head phones connected to the TO, went downstairs, >set the V-15 Type II on the Dual 1019 to 7/8 gm. Patched to the Pioneer 1500TD >amp feeding front AR-5's and rear AR-2ax's, cranked to "pain" and spun some >vinyl. You might want to explain to the GenXers what "vinyl" is. >"Freedom's just anotha' word foa nothin' left to lose." - Janis Joplin & >Full Tilt Boogie Band, Columbia PC 32168 (first one I found in the pile - >believe the original was on a album with her standing spraddlelegged with >the big grin - is here *somewhere*. Credit on th record was K. Kristofferson >and F. Foster. (Had to go downstairs, contrary to popular belief, everything >is not in my den 8*). Speaking of this song, I live "near Salinas." --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Indecent Trash
by nobody＠REPLAY.COM 18 Dec '03

18 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On 10 Jan 96 at 10:42, t byfield wrote: > At 10:26 PM 1/9/96, Alexander 'Sasha' Chislenko wrote: > > >- Landfills: They are probably the richest source of detailed > > historical information that is not obtainable from any > > other source and can be used to reconstruct the detailed > > history of society, economy, technology and any single > > person with incredible detail. > I ain't holding my breath until someone develops a search > engine for Fresh Kills. I can see it now... about the time that Grandson of Altavista finally yields a URL for Jimmy Hoffa's body in some dump somewhere the government will have figured out that it's so much simpler to catalog the stuff on the way IN, when all the artifacts are fresh and unmixed. While we're all watching what the government does to intercept packets, they will be routing *trash* packets through mysterious "garbage routers." As the stink grows stronger, someone will conceive of anonymous trash forwarders. They will accept unidentified trash, no questions asked, anonymize it with random DNA and fingerprint whorls, and sneak it into public trash receptacles. DNA generators will enable the mischievous to plant fabricated indications that Hillary did indeed have something going with Vince, the late Khomeini (hey, hard is hard, right?) as well as legions of four-footed friends, confirming the suspicions of multitudes. As the piles of trash-based data grow, some Senator from Nebraska will sound the alarm that kids are too easily exposed to the indecent signs of private behavior retrievable on the Net and will propose draconian measures to hold everyone responsible for their contributions to the city landfill. Public receptacles will be closed. Trash will only be collected from registered Identifed Surplus Providers (ISP's). $250,000 fine for disposing of a condom in a dump accessible from the Internet... 10 years in prison for carelessly tossing those nasty Polaroids in the kitchen compactor. The trash of the world will have to be made safe for kids to view. Everything will be a lot easier to trace and control if the garbage input is fully identified. Barcodes on trash bags might do for starters. Access to the garbage system might have to be restricted to those 18 and over. Trash collectors could be made responsible for content, drafting them without pay into the ranks of the trash police. People could be encouraged to report suspicious trash, and trash-related activities like neighbors sneaking out at night to place an innocent-looking compactor bag down the block with someone else's trash. For their own protection, youngsters might be required to retain all their garbage until age 18 and then, in a solemn ceremony worthy of the true significance of coming of age, pitch it all (duly anonymized to prevent abuse of minor indiscretions) from their new position as lawful participants in the world garbage system, friends and well-wishers trying to applaud and hold their noses at the same time (try it -- if you're not careful you can break your own nose, but hey, that'll work, too!). Who knows? Maybe Heinlein's advocacy of keeping kids in a barrel and feeding them through a hole until age 18 will enjoy resurgence among the compulsively protective while the Web meanwhile will provide real time underground data on Heinlein's rpm rate. Protecting the trash of youth will, however, give rise to the hiding of adult trash among that of the underaged. The government will have to root out offenders and "impute" suspicious trash to the parents. Those with no visible source of trash will of course be suspect, and will have to emit innocent trash to cover themselves. This will give rise to the practice of "trash laundering," in which agents convert nasty trash to innocuous trash that may then be tossed into any monitored, controlled channels with no repercussions. Trash laundering will become a grave offense to the accompaniment of government and Ad Council PSA's and free brochures from Pueblo, Colorado. Blatant offenders who have fled to foreign climes will be kidnapped, some will be tortured, because the War Against Filth will be a moral commitment of the national body. Foreign governments headed by suspected trash traffickers will be toppled in quickie invasions, their leaders brought back in chains to disappear into federal dungeons. Public debate will center on the legalities and rationalizations of using the military in policing domestic trash, while agencies such as the FBI cry for more budget to fight the scourge that threatens the decency of the nation's repositories. Control of trash will spread inevitably to control of liquid wastes, whereupon a terrible discovery will be made: Everyone, but everyone, emits unspeakable bodily products. At that point the government will have no choice but to reluctantly declare everyone an outlaw and execute the populace. It's all as logical as what happens when you introduce division by zero way down at the bottom of the complex equation where it isn't so noticeable. We Jurgar Din (that will have to suffice: I do not yet live in a free country) +"The battle, Sir, is not to the strong alone. It is to the+ +vigilant, the active, the brave. Besides, Sir, we have no + +election. If we were base enough to desire it, it is now + +too late to retire from the contest." -Patrick Henry 1775 + -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMPS/PEjw99YhtpnhAQH1UQH5AdXBd7AvG6xT7x/cTXf5W1cAUXzoJ+GB N0/SPrdoJnbUSN5LkJDwoVwA/eiL6/LVN9CjtmQwmydyBysM7M/7Xw== =q+CF -----END PGP SIGNATURE-----

1 0

Re: verification of randomness
by jim bell 18 Dec '03

18 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 03:57 AM 2/5/96 +0100, Andreas Bogk wrote: >I've built a random number generator based on the noise of a Zener >diode. Now I'd like to verify it's correct operation. I'd be very >grateful if someone could point me to existing software for randomness >tests or additional tests not mentioned in Knuth. >I'll make the design of the generator available as soon as I've >verified it's operation. >Andreas Excellent! Sounds like a worthwhile project. If you have an email mailing list, put me on it please. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRWRnvqHVDBboB2dAQFgWwQAlgxpZ1Bx21HRU39ikFUKBFoewtfjVzcD zwOjkf5IXyITNV1IZmwmbIyzVmu1ndWr4NHhZZhxD9jCyzC6qFqvED/7Zye4vUdV XkcTDIBqqa334Awm7dsDMwvC2GKhHbCLIcZSI7gXBf/5C3V42EKdvi18Bqn9cs5M vJ0OnN93iBY= =MmWv -----END PGP SIGNATURE-----

1 0