December 2003 - cypherpunks-legacy

XON_rot
by John Young 17 Dec '03

17 Dec '03

Computerworld, February 19, 1996: Internet Privacy: How far should federal regulation go? "Only The Force of Law Can Deter Pornographers." by Sen. Jim Exon Don't let opponents of CDA fool you: Nothing in it applies to constitutionally protected speech between consenting adults. Opponents forsake reason when they say they want to protect children from indecency, seduction and harassment but maintain that the overriding issue is freedom of access to anything by anybody. There is too much of the self-serving philosophy of the hands-off elite. "The 'Net Doesn't Need Thought Police." by Marc Rotenberg The U.S. is getting drawn into this craziness because religious zealots and their allies in Congress have decided they know what is good for us and our children. CDA gives federal investigators the right to comb through Web sites, newsgroup posts and even private electronic mail to find evidence of indecent speech. The bill even threatens the right to use privacy technologies, such as encryption, because the government now will have the right to open private E-mail if it suspects the message contains offensive language. XON_rot [Thanks to BC for these]

2 1

Schneier Attacks
by John Young 17 Dec '03

17 Dec '03

Schneier says in a March SciAm brief on Kocher's timing attack: "In theory there are other attacks. You can measure power consumption or heat dissipation of a chip; timing is just one way."

4 3

"This is not Coderpunks--we don't need no steenking cryptography!"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:51 PM 2/21/96, Peter Monta wrote: >Cypherpunks used to be a place where I could fairly reliably see >high-SNR commentary from real cryptographers/number theorists. >Now we have the blind replying to the blind's obfuscatory >nonsense, and the useful posts take some effort to find. I believe this is why the "real cryptographers/number theorists" are now supposed to post to "Coderpunks." While I agree with your points, it now appears that this is the way things are dividing up: * Coderpunks -- number theory, DES, Haval, C/C++/Java, IETF and TCP/IP stuff, digital signatures, crypto libraries and APIs, Diffie-Hellman, BSAFE, RSAREF, etc. * Cypherpunks -- nuclear bomb triggers, why women are more free under the will of Allah than in Western decadent societies, movie reviews, SS Obergruppenfuhrer Zimmermann, Zambian newspapers, alien bases in Antarctica, Himalayan treks, etc. Coderpunks is a membership-only list, with a list.cop who approves membership and who expels those who post inappropriate material. Cypherpunks is an open list, with no one ever having been expelled. So, if anyone asks "What does this have to do with cryptography?!?!," point out to him that this is Cypherpunks, not Coderpunks! "Cryptography? You want _crytography_? This is not _Coderpunks_! We don't have to show you no steenking cryptography!" --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

"consent of the governed"
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

I was musing over this phrase, "a government rules by consent of the governed" which popped up in an earlier essay on digital cash (microcurrency) I wrote here and deserves further elaboration. it seems like a basic and obvious truth on some levels, a concept held sacred by our founding fathers, but on the other hand its exact meaning has escaped precise analysis for many centuries, and in various sense our government seems to have strayed far from this promise. what does it mean? does it mean, "majority of the governed?" how exactly is consent expressed? Barlow brings up this topic in his recent "cyberspace declaration of independence" (which can clearly be criticized as out of touch with physical reality but is nevertheless compelling). the essay comes close to the major point I want to make: I believe that the phrase "a government rules with the consent of the governed" is one of those magic statements that is going to become increasingly defined by new technology. often, the clear intent of a law is not obvious until new technology is introduced that tests its meaning. for example, the "right to bear arms"-- does that mean submachinegun, handguns? what about armor-piercing bullets? new technology is always constantly forcing a new interpretation of laws. or how about "the right to free speech" -- is cyberspace a place for "speech", or is it something where things are published? which laws apply? does it mean I am free to encrypt anything I want in any way I choose? interestingly, does the "freedom from illegal search and seizure" apply to cryptographic encoding? in other words, is there such a thing as search and seizure of bits (plaintext) in encoded messages? these are all questions that have various answers (and I'm not really too interested in debating them), but which in one sense anything besides what a court decides is not relevant. and most of these above questions could take decades to sort out in courts, if ever. === anyway, my main point here: I believe that "a government rules with the consent of the governed" is a phrase that is going to be tested in the next few years, and more closely defined, because the emergence of new cyberspatial technology. it seems to me that libertarians would tend to say, "oh yeah, wouldn't it be great if that were true. no one ever asked ME if I wanted to be in this system". well, what if there was an actual overt choice of government that when on with the citizen? what if we really could choose our government? would be tend to believe that all governments are corrupt inherently, or could new systems based on voluntary cooperation from the start work? in a sense, any government that uses force on its populace is violating a charter rule, (if it was one), that a government rules by the consent of the governed. if some segment of the populace is resisting this government, then obviously there is no consent among that sliver. all this raises the question of how much a government can be split up over a population. what is the "granularity" of government? to date, governments are based on geographic region. they are often circumscribed by various geographic features such as oceans or continents. but would it be possible to construct a governing system in which geographic location is irrelevant? such that anyone, anywhere, can pick whatever government they want? surely if such a thing is possible, cyberspace comes the closest to facilitating it. but it would not really be a government in the current sense of the word. === in my digital cash essay, I introduced a radical new interpretation of the phrase "consent of the governed" that went largely unnoticed but deserves further thought. in it, I proposed that "consent of the governed" is measured by whether people pay their taxes to a government. in other words, not paying taxes is a basic test of whether an individual does not subscribe to a particular government system. there are other obvious tests such as civil disobedience, but I believe this one is going to serve as the basic operative test of the future. this is radical for the following reason: today supposedly a government has the authority to coerce "inhabitants" to pay their taxes and punish them if they don't. interestingly, our whole country was started as a sort of tax revolt, and yet today our taxes are arguably just as onerous and oppressive as any other country's. it is a heresy within government circles to propose that citizens should have a choice in paying taxes. "we could never permit it. it would never work". "nobody would pay them". but is that to say, admittedly, "we do not have the consent of the governed"? I believe that digital cash will give rise to the ability to have completely "black" economic systems on scales far larger than ever before practical. what this means is that anyone who wants to can simply "opt out" of being seen by the existing government in their economic transactions. I think this may actually lead to "underground governments" in which people voluntarily subscribe to certain communities and their "laws" while at the same time opting out of participation in the "overt" system they are geographically constrained to. hence "we could never permit it" said by bureacrats may be true, but not relevant-- their permission has nothing to do with what technology permits. "it would never work" may actually be tested outright by new technology and systems of mass cooperation (in a sense, the basic point of government) developed in cyberspace. in any case, I do believe Barlow has some very important points and that we are on the verge of new forms of government that remove many of the nagging difficulties of earlier human models. much of this innovation will center around new definitions/explorations of the basic concept that "a government rules by the consent of the governed", and the approach to collection of dues, or taxes, and the way that they are allocated based on group decision processes, will be a chief area of experimentation and new approaches.

2 2

CPU_nks
by John Young 17 Dec '03

17 Dec '03

SciAm, March, 1996 "Privacy and Data Collection on the Net." There are still a few eccentric souls who gamely try to hold on to what lingering shreds of anonymity they possess. They never fill out questionnaires; they give their Social Security numbers only to their bank and to their broker. They encrypt their e-mail; they bypass the supermarket discount card that links identity to purchases; they pay cash for medical procedures they do not want known; and they wait patiently for e-cash to become a reality. Joining these hardy individualists are privacy advocates such as EPIC and Net groups like cypherpunks which believe in untraceable communications and in the technology needed to achieve it. CPU_nks

1 0

Re: IPG hoax?
by Wink Junior 17 Dec '03

17 Dec '03

Arley Carter sez: >Fess up guys. You are either: >1. A team of undergrads or graduate students conducting an "exploit". >2. A Detweiller tentacle. Dr. FC ? >3. The return of Alice D'nonymous ? >4. The reason the coderpunks lists was started. I must admit that after the first day I've been wondering if this whole IPG thing isn't some kind of deep troll or early April Fool's joke. Has anyone actually spoken on the phone with IPG or confirmed their existence in any way? For the record, I'd like to state that I saw their ad posted in comp.security.firewalls and forwarded an edited copy (technical details only) to the list, but if this turns out to be a hoax of some sort, I was and am not a willing participant. Would IPG Sales please post an address and phone number so we can confirm the company exists? Wink

1 0

Re: NOT CRYPTO (Sort of): Fwd: OPPOSITION: AFA seeks to expand CDA
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

One wonders if anyone at the American Family Association is selling ISP stock short? If so, and it could be found out, it would be kind of embarrasing to them. -Allen

1 0

Edupage, 20 Feb 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 21-FEB-1996 11:56:31.71 >***************************************************************** >Edupage, 20 February 1996. Edupage, a summary of news items on information >technology, is provided three times each week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >***************************************************************** As I recall, this is incorrect. Without a signature/physical presence, it's the _merchant_ who is liable. Thus, a lack of (sufficient) encryption is a problem for the merchant, who thus may decide to not sell products via the Net - a loss for the consumer. >CREDIT CARD SCARE TACTICS >Sending your credit card information over the Internet is really no big >deal, says Simson Garfinkel, author of a book on Pretty Good Privacy >encryption software. "The whole thing about encryption over the Internet is >that it's not to protect the customer -- it's to protect the credit-card >companies. By law, if there is no signature, the customer is liable for >nothing. If there's a signature, they're liable for $50. The reason the >credit-card companies want cryptography is to limit their own liability. It >has nothing to do with protecting the consumer." And although Netscape >Navigator sends a stern message each time a user attempts to send >information over the Web, Garfinkel labels the warning just another scare >tactic: "Netscape Navigator is printing those messages because they're >trying to sell encrypted servers. It's an ad. It doesn't look like an ad, >but it is." (Tampa Tribune 19 Feb 96 B&F3) Friendly policy: >BANYAN SPONSORS E-MAIL SWITCHBOARD >Banyan Systems is offering a new service on the Web -- a directory of e-mail >addresses and other information for 93 million people and 11 million >businesses worldwide. Switchboard includes a feature similar to Caller ID, >that alerts a listed person whenever someone asks for that person's address, >and allows them to decide whether to allow that information to be given out. >The service also features public key certificates for secure communications >between users. < http://www.switchboard.com > (Information Week 12 Feb 96 >p24) Sigh... why am I not surprised? >EUROPE BACKS V-CHIP >The European Parliament has followed the lead of the United States in >supporting the use of Canadian-developed V-chip technology that allows >parents to screen violent or adult content from their televisions. >(Montreal Gazette 20 Feb 96 C7) >Edupage is written by John Gehl (gehl(a)educom.edu) & Suzanne Douglas >(douglas(a)educom.edu) Voice: 404-371-1853, Fax: 404-371-8057. >*************************************************************** >EDUPAGE is what you've just finished reading. To subscribe to Edupage: >send a message to: listproc(a)educom.unc.edu and in the body of the >message type: subscribe edupage Abraham Lincoln (assuming that your >name is Abraham Lincoln; if it's not, substitute your own name). ... >To cancel, send a message to: listproc(a)educom.unc.edu and in the body of >the message type: unsubscribe edupage. (Subscription problems? Send mail >to educom(a)educom.unc.edu.)

1 0

Re: Internet Privacy Guaranteed ad (POTP Jr.)
by IPG Sales 17 Dec '03

17 Dec '03

I find less and less disagreeement with your comments - with one major exception - for a given message length - say 10 to the 500th power, a OTP seeded algorithm, a better term would be to call it an OTP driven algorithm, can produce the exact same effect as an OTP of that length - that is, the encrypted text can be any possible message of that length, and it is not possible to predict in way what the RNG generated stream is - We can prove that to your or anyone eleses satisfaction - It obviously fails to do that somewhat short of infinity, but not short of what is needed to prove system integrity for practical limits. If all the paricles in the Universe, 10 to the 80th, were Cray T3Es, and they had been calculating since the big bang, according to my rough calculations, it would still take over 10 to the 370th power years to just generate the message possibilities -for a 10 to the 500th power message length possibilities - we assert that if it can do that, and it can, it functions like a OTP of that length - and is unbreakable We also have a light, but only a slight disagreement, about whether the the key is truly symmetrical - we assert that because of the aprticlaur data feedback system employed it is not symmetrical, but that is entirely beside the point, we believe 10 to the 500th, or whatever should be sufficient Appreciatively, Ralph

6 5

re: Public access: Welcome to Juno! (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

Okay, I took the bait and signed up. Looks like these guys aren't yet ready just yet, but it doesn't look too bad. It is an automated setup. Which means that since you upload and download mail and work OFFLINE, there is the possibility of hacking something together so that you can run some automators on your mailbox... i.e. ftp by mail, pass to pgp, remailer, etc... ---------- Forwarded message ---------- Date: Wed, 21 Feb 1996 16:30:29 -0500 From: signup(a)juno.com Subject: Welcome to Juno! Thank you for your interest in Juno, our free Internet e-mail service. We are currently preparing for our launch, which we expect to take place before the end of the first quarter of 1996. <SNIPPAGE> President Juno Online Services, L.P. __________________________________________________________________________ FREQUENTLY ASKED QUESTIONS: 1) WHEN WILL JUNO BE AVAILABLE? We plan to release Juno in the first quarter of this year. 2) IS JUNO REALLY FREE? Yes. There are no monthly charges to use the service, no set-up fees, no per-message fees, and no hourly charges. You will be able to download the software off the Internet (or get it in a variety of other ways). 3) WHAT ABOUT PHONE CHARGES? It won't be necessary to dial a long-distance telephone number to reach us. We expect that ultimately the bulk of our users will dial into local access numbers we provide; we may also use toll-free numbers to supplement our coverage in some areas where local access numbers are not available. Also, note that when you use Juno, you are only connected by telephone to our central computers while you are in the process of uploading and downloading your new mail. When you're reading and writing your mail, you are offline. This means that the phone calls you do make are likely to be very short -- under one minute, in most cases. [*** All we need to do is figgure out their data structures for storing email and we're set to write something to process it. ***] <SNIPPAGE ABOUT HARDWARE SPEX> 7) WILL JUNO GIVE ME ACCESS TO THE INTERNET? Yes. Your messages will go out over the Internet, meaning that you will be able to send mail to and receive mail from anyone on the Internet or any of the commercial online services (such as America Online, CompuServe, and Prodigy). However, your computer will not be connected *directly* to the Internet. Your computer will be connected to our central computers, and our computers will be connected to the Internet. 8) DO I NEED TO HAVE INTERNET ACCESS FROM ANOTHER SOURCE TO USE JUNO? No. Juno gives you everything you need to send and receive e-mail over the Internet. <*** Here's the strings ****> 9) WHAT WILL THE ADVERTISING BE LIKE? One of the major reasons that we are able to provide you with e-mail for free is that Juno will carry advertising. (It's the same model that's used by radio and television.) However, it is our hope (and plan) to make the advertising we carry be of greater interest and value to you, and less of a nuisance, than the advertising you are so often bombarded with over other media. Each Juno user will fill out a "member profile" that will help us determine which advertisements to send to that user, what new services he or she might be most interested in hearing about, and what other sorts of information he or she might find useful. Our goal is to provide users with information that interests them and is relevant to their needs. The advertisements on Juno may take several forms; we don't know yet what all of them will be. Some ads will appear as interactive banners in the horizontal "Sponsor's Panel" at the upper right-hand corner of the screen. If you are interested in a product you see featured in this space, you will be able to click on the advertisement to request additional information. Other ads might appear while you are in the process of uploading and downloading your mail; still others might take the form of e-mail messages that arrive in your Inbox. (Never more than one or two of the latter in a given session, though, since getting a mailbox full of commercial e-mail messages would be very annoying. In most sessions you'll probably get none.) We plan to experiment with a variety of different approaches and figure out, by looking at people's responses, what works best. <More snippage>

1 0