December 2003 - cypherpunks-legacy

Re: Assassination Politics(tm) was V-chips, CC, and Motorcycle Helmets
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jimbell(a)pacifier.com" "jim bell" 16-FEB-1996 03:25:12.58 >At 02:18 PM 2/15/96 -0800, Bill Frantz wrote: >BTW, for the record, just a couple of days ago Clinton probably passed >within a mile of my house, "Slant range", in a helicopter, with a day's >warning. (The term, "slant range", is a "term of art," for those not in the >know.) Yes; one could also take out a great deal of Washington DC via toxic gas. (If it weren't flammable, hydrogen cyanide would work nicely; just mix potassium cyanide and hydrochloric acid). Unfortunately, this would also kill a lot of innocent people (including, under my system of ethics at least, some governmental types. Look at Governor John P. Altgeld if you don't believe that any can exist; he pardoned the Haymarket riot scapegoats, and ruined his political career by doing so). >Now, imagine you were a government employee in this line of work, and a >fellow employee was bumped off due to a well-publicized incident. Next time >you're asked to engage in a Waco-like operation, what do you think you'll >say to your manager? "Is this trip necessary?" >This is called, "deterrence." You have a point. Of course, this gets back to the ever-present debate over whether the death penalty causes deterrence or not. I suspect it doesn't for most gang members; whether the actual (as opposed to rhetorical) psychology of governmental employees would predict the same is an interesting question. >Now, I think statistics show that each year, about 800 billion dollars in >individual income taxes are collected. If we assume that the equivalent of >only 1% of that value was donated to solve the "IRS problem," that's 8 >BILLION dollars, which at $10,000 per person would buy 800,000 deaths. >THat's 7 times the current employment of the IRS. >You tell me: What would the average person pay THIS YEAR to avoid paying, >say, a $100,000 tax bill NEXT YEAR? (Hint: How much do rich people pay >their accountants, TODAY, to avoid taxes?) You've got a "tragedy of the commons" problem. Everyone would assume that everyone else would do it. (Admittedly, that libertarians have among the highest charitable donation rates of any group may argue otherwise). Now, targeting whoever audited you is a quite likely possibility. >Another Hint: Consider Bill Gates. His wealth is variously estimated at >over 10 BILLION dollars, probably almost all of which is in long-term >capital gains (Microsoft stock), for which he will have to pay somewhere >around 30% in Federal income taxes if he should choose to cash out. He >would be 1.5 Billion dollars ahead if he donated $1.5 billion dollars to an >organization which would eliminate his requirement to pay the total 3 >billion dollar tax bill to the IRS. That alone is the equivalent of about >$14,000 for each IRS employee. You have an interesting point here. -Allen

1 0

Re: SurfWatch
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 3:27 PM 3/8/96 -0800, Timothy C. May wrote: >(By the way, adult magazines voluntary label themselves as "adult": my >understanding from several comments by lawyers and adult industry >spokesmen, is that they are under no obligation to "voluntarily label" >their stuff. And some libraries have an _explicit_ policy that says any >card-holder, of any age, may check out or look at _any_ item the library >carries.) IMHO Adult magazines label themselves "adult" as a form of advertising. In the same way, a site with a sufficiently hard core self-rating may attract customers specifically because of the rating. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 2

Internet Commerce
by Goldberg＠eit.com 17 Dec '03

17 Dec '03

EIT/VERIFONE IS A RECOGNIZED PIONEER IN THE DEVELOPMENT OF SOFTWARE AND SERVICES FOR ELECTRONIC COMMERCE ON THE INTERNET. EIT IS A WHOLLY OWNED SUBSIDIARY OF VERIFONE, A LEADING GLOBAL PROVIDER OF TRANSACTION AUTOMATION. EIT/VERIFONE RECENTLY ANNOUNCED AN AGREEMENT WITH NETSCAPE COMMUNICATIONS TO CREATE COMPREHENSIVE INTERNET PAYMENT SOLUTIONS AND AN AGREEMENT WITH ORACLE TO COMBINE ORACLE'S POWERFUL WEBSERVER SOFTWARE WITH VERIFONE'S HIGHLY REGARDED AND SECURE PAYMENT SOFTWARE, TO PRODUCT THE FIRST PAYMENT-ENABLED WEBSERVER ON THE MARKET. LEARN MORE ABOUT EIT AT WWW.EIT.COM 1) Internet Engineer, SET Implementation Be a member of a team that will implement the SET protocol module (used for secure credit transactions over the Internet.) This candidate must have at least five years experience as a developer writing commercial grade software using C++. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Experience writing software using ASN encoding rules * TCP/IP network programming * Significant cryptographic experience * Cross platform development experience using both Unix and NT. We will be pre-disposed to candidates who have significant experience in: * Internet protocols * Java * Financial networks * Site security work * Systems programming 2) Internet Engineer - SET Development Be a member of the SET development team. This candidate must have at least three years experience as a developer writing commercial grade software using C++. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Cross platform development experience using both Unix and NT. and meets at least two of the three following requirements: * Experience writing software using ASN encoding rules * TCP/IP network programming * Significant cryptographic experience We will be pre-disposed to candidates who have significant experience in: * Internet protocols * Java * Financial networks * Site security work * Systems programming 3) QA Internet Engineer - SET Development Be a member of the SET development team. The candidate must have solid experience as a QA professional with at least five years of experience in commercial software development and testing. This position will entail test design, test writing, and code coverage analysis of the SET protocol modules. The minimum requirements are: * Knowledge of (and enthusiasm for) the World Wide Web * Cross platform development experience using both Unix and NT. * Working knowledge of C++ * Previous experience in White Box testing * Detailed understanding of modern QA processes We will be pre-disposed to candidates who have significant experience in: * Java * Financial networks * Systems programming * Communications Security and Data Security EIT offers a stimulating work environment along with competitive salaries and benefits. We are interested in full-time, contractors, and new graduates Please send your resume to Carole Goldberg via email, fax, or mail Fax: (415) 617-8019 e-mail: Goldberg(a)eit.com EIT, 800 El Camino Real, Menlo Park, CA 94025

1 0

Reasons for codes
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>Totally untrue. The use of encryption for business purposes goes back >centuries, In fact there are lots of reasons for codes. One not mentioned that has a long and glorious history involve CHARLESTON, TABLEDRUGS, or BLACKHORSE and can be seen in commercial use today. Warmly, Padgett

1 0

Welcome to Switchboard
by registrar＠switchboard.com 17 Dec '03

17 Dec '03

Thank you for registering in the Switchboard database. Your Switchboard login is: Email: cypherpunks(a)toad.com Password: JimArts This password is case sensitive. Once you log in (set your browser to http://www.switchboard.com) your entry appears in the directory with your email address attached. You may then update your listing to show exactly the information you want and correct errors. Note that Switchboard waits until you log in to change the directory, because this step verifies that your email address is correct. Logging in also allows you to create an additional listing, change your password, list your home page URL, unlist your main listing, and access other features. Once you are logged in, please change your password to make it easier to remember. If you did not register in Switchboard and received this message erroneously, please Reply to Registrar(a)switchboard.com.

2 1

POTP Jr.
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 03/04/96 07:59 pm ## Subject: POTP Jr. ] >Date: Sun, 18 Feb 1996 19:20:55 -0800 (PST) >From: Wink Junior <winkjr(a)teleport.com> >Subject: Internet Privacy Guaranteed ad (POTP Jr.) > If an individual, or any group of individuals, break the IPG > Privacy System, IPG will sell them the company for $1.00, and > even give them the dollar to buy it with. If you think you > can, just try and you find out that it is impossible. There > may be rumors that someone has broken the system, but that is > not possible, it will never happen. Surely I can't be the only person who's noticed the obvious--that if you break their system, their company is worth nothing, since this is their only shipping product. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTujK0Hx57Ag8goBAQHxBQQAkUKL0h0eqxJ5rNGg7dDF6Beskem/RUWA IZYNoHBG/WZYv86dDrFSVXOllqyumlo5enH0xwXBfDf0TN+kasjIaH/UYHncXYiL yw/31wBDt4H1PzmF7Yg5zfSBaN18l9dFT+rLGRJKRjWFgzGIAJZ6Jmga7RJ0P+/k TWCgt4AdIIc= =eI1Q -----END PGP SIGNATURE-----

1 0

Re: Bombings, Surveillance, and Free Societies
by Rich Graves 17 Dec '03

17 Dec '03

I believe this is where I came in... At 12:51 PM 3/4/96 -0800, tcmay wrote: > >Revolutionary theory says of course that this increased clampdown is a >desired effect of terrorist bombings and attacks. Fear and doubt. >Revolutionary ends rarely happen by slow, incremental movement. Hundreds of >examples, from the original "bomb-throwing anarchists" to the modern mix of >terrorist bands. The Red Brigade in Italy sought a fascist crackdown, and >the "strategy of tension" is common. (And even revolutionists of crypto >anarchist persuasion often think laws like the CDA are good in the long >run, by undermining respect for authority and triggering more extreme >reactions....) Well, I think they're wrong. Revolutionary theorists are right about the *beginning* of the dialectic. Action breeds reaction breeds counterreaction, and so on. Repression opens up all sorts of new opportunities. Ezekiel, St. John, Marx, Hitler, Winnie (not Nelson) Mandela, and so on were right about that. However, the dialectic eventually stabilizes; not every revolution is Armageddon. People get tired of revolution and counterrevolution, and yearn for stability, under *any* regime. That's why otherwise reasonable people let the Bolsheviks, Nazis, Napoleons, Democrats, and Republicans take power. Revolution is like a box of chocolates... you never know what you're going to get. I don't like extremists. But then, I'm a fucking statist. In South Africa, most of Latin America, and (until a few weeks ago) Palestine and Northern Ireland, tolerance has taken a few halting steps. You drop your gun, I'll drop mine. You open up the political process to let me participate, and I'll open up my processes so that you can trust me too. You purge the right-wing death squads on your side, I'll purge the left-wing terrorists on my side. I'm a firm believer in privacy for individuals, but for groups, of any kind, popular or unpopular, public or private, I'm not so sure. -rich http://www-leland.stanford.edu/~llurch/

1 0

PET - The Path to Anonymity
by jya＠pipeline.com 17 Dec '03

17 Dec '03

Tracing the lead from the Canberra/OECD paper to the excellent Ontario Privacy Commission site: http://www.ipc.on.ca/web_site.eng/matters/sum_pap/ summary.html This summary of privacy papers includes: Privacy-Enhancing Technologies: The Path to Anonymity (Volume 1): A Joint Project of the Office of the Information and Privacy Commissioner/Ontario and the Registratierkamer, The Netherlands discusses concerns associated with the trail of identifying information created by electronic transactions, and a number of techniques for introducing an identity protector into information systems. The paper provides background information, the details of the joint survey, and the conclusions and recommendations. (August 1995, 107 KB, 26 pages). Available through: ftp://ftp.ipc.on.ca/ftp/ftp_site.eng/matters/sum_pap/ papers ---------- In the Netherlands, two volumes are listed (along with other choice crypto books) at the most informative site: http://infolabwww.kub.nl:2080/infolab/netwerken/ scripties95/groep8/literatuurlijst.html Registratiekamer. Privacy-enhancing technologies: the path to annonimity, volume I, augustus 1995. ISBN 90 346 320 24. Registratiekamer. Privacy-enhancing technologies: the path to annonimity, volume II, augustus 1995. ISBN 90 346 320 24. _________________________________________________________ Links are provided to such privacy tools as the admirable "Identity Protector" at: http://infolabwww.kub.nl:2080/infolab/netwerken/ scripties95/groep8/ip.html DE IDENTITY PROTECTOR [Snip] De identity protector heeft de volgende functies: * rapporteert en controleert verzoeken wanneer de werkelijke identiteit bekend wordt; * genereert pseudo-identiteiten; * vertaalt pseudo-identiteiten naar werkelijke identiteiten; * converteert pseudo-identiteiten naar andere pseudo-identiteiten; * voorkomt verkeerd gebruik. De gebruiker kan, met behulp van de identity protector, zelf bepalen bij welke aanbieders van diensten zijn werkelijke identiteit mag worden onthuld. Het gebruik van een identity protector verdeeld het informatiesysteem in twee domeinen. Eèn waarin de werkelijke identiteit van de gebruiker bekend of toegankelijk is, en èèn waarin deze door de identity protector is afgeschermd. Het domein waarin de werkelijke identiteit bekend is noemen we het identiteits-domein, het domein waarin deze is vervangen door een pseudo-identiteit noemen we het pseudo-domein. ... _________________________________________________________ The Australians, Canadians and Dutch seem far ahead of the US in promoting technologies for protecting privacy. It makes one wonder if it is the intrusive practices and technologies of the super-surveillance US that they fear even as most Americans ostrich the sand.

1 0

Re: numbers don't lie
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 03/04/96 07:59 pm ## Subject: Re: Numbers don't lie... ] >Date: Sun, 18 Feb 1996 11:18:57 -0500 (EST) >From: "A. Padgett Peterson P.E. Information Security" >Subject: Numbers don't lie... >In their figures, they do seem to gloss over a couple of minor points: >The most compelling to me is "how do you know when you broke it ?". >Bruce has always used the "known plaintext" approach, however using >modern techniques for messaging, *every* message has a different >session key, negotiated using assymetric keying so the only message >that will be broken is one that you already have - not terribly >helpful. Coming up with a short length of known plaintext isn't usually a big problem. For example, attacking DES, you need to know one 64-bit block. In many cases, this is easy to do. While it is possible (and a good idea) to build communications software so that it's relatively hard to get known plaintext, this shouldn't be necessary to use a cipher securely. And in any case, if you're encrypting ASCII text, the bit distributions give you a big clue about whether this is a reasonable key guess or not, after just a few decrypted plaintexts. This increases the cost of the search machines, but I'm not convinced that this will be an enormous increase in all cases. >This means that the strength of cryptography should be appropriate >to the value of the information protected. If less than U$10,000, >the message is individually encrypted, and has value only today, >then DES is probably "good enough". True, DES is probably good enough for the very lowest-value messages. But why use something that's barely acceptable, when it costs you almost nothing at all to make it really secure against keysearch attacks. Blowfish, SAFER-SK128, GOST, and 3DES are all apparently quite hard to break, and they are all far more resistant to keysearch attacks than DES. >Strategic information of higher value arguably needs "more" but how >much ? 64 bits is 256 times stronger than DES. This would indicate >effective security up to say U$2.5 million. More is better but I >would not be quite so alarmist nor would I dismiss the cost of >engineering. Non-trivial. The problem here is that it's not really reasonable to expect the users of a secure e-mail package to know what the state of the art is in terms of keysearch machines, and it's not always reasonable to expect the person that's sending some piece of information to know whether this is "you-bet-your-company" material. There's no excuse for leaving yourself vulnerable to keysearch attacks, when there are so many good, unpatented ciphers with key lengths of more than 100 bits. It's like building a car with an engine that you know will catch fire if it's ever run at more than 80 MPH, but justifying it by saying "well, most trips don't require more than 80 MPH to get where they're going anyway. In those special cases where greater speed is necessary, they'll just have to take a bullet train." >Still, at what point is it simply easier/cheaper to buy someone who >knows the secret ? Limiting your key to 56 bits means that an attacker has more options--if he can't bribe, blackmail, or threaten his way into your private communications, he can spend some money, and still get in. (Escrowing your key adds to the list, because he now has more people to bribe/threaten/blackmail, and he may also be able to carry out protocol attacks against the key escrow mechanism.) > Warmly, > Padgett --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTujGkHx57Ag8goBAQElEwP/ZpzwCpwGUhbHJvEl+EiuseNEgy9To5yl RyX3VkdX+Xx6jksZeuLlSuRoMlahxyMHdH7uDY/8GFW2uxh8dFAJfwNdBCf3k0W8 aYml2Z/CCVadeuiSrKgZEMvE3F/LlDSCXQwuIde1Su7ICxQz9pd8ZbAqvOdQQWyZ ZQPr9TPCo/s= =zM5N -----END PGP SIGNATURE-----

1 0

NYT on Crypto Bills
by jya＠pipeline.com 17 Dec '03

17 Dec '03

The New York Times, March 4, 1996, p. D4. Compromise Bills Due on Data Encryption Industry Opponents and Civil Libertarians Are Lukewarm, at Best By John Markoff Legislation will be introduced in the House and the Senate tomorrow in an effort to break the deadlock between the computer industry and the Clinton Administration over the control and export of software and hardware used to scramble electronic data. So far, though, the proposed measures have received only cautious endorsement from industry executives, while civil-liberties and privacy groups say they are worried that the bills would enable the Government to decode scrambled transmissions. Senator Patrick J. Leahy, Democrat of Vermont, and Representative Bob Goodlatte, Republican of Virginia, plan to introduce similar bills that affirm the right of Americans to use any type of data-coding equipment without restriction and prohibit the mandatory use of special keys that would allow law-enforcement agencies to read scrambled data. Their bills would also make it a crime to use encryption technology in committing a crime and would permit the export of data-coding software and hardware if similar technology was available from a foreign supplier. Data-coding, or encryption, technology is based on mathematical formulas that rely on the immense computing challenge inherent in factoring large numbers. Until recently, such technology was largely used by military and intelligence organizations and by some corporations like banks. As electronic mail and commerce have become increasingly accessible, however, the technology has become more controversial. In April 1993, the Clinton Administration proposed a national data-encryption standard known as Clipper, based on a system that would have made it possible for law-enforcement agencies, if authorized by a court, to decode private voice and data communications. The Clipper initiative has been strongly opposed by industry executives and privacy advocates. They argue that reliable coding technology is essential for commerce and privacy protection on the Internet. They also say that strict export rules are increasingly hindering the ability of United States corporations to compete with foreign suppliers. The proposed legislation would ease some current restrictions on the exporting of data-coding systems, but civil libertarians still see areas of concern. "The bills relax export controls, which is clearly a step in the right direction," conceded Marc Rotenberg, director of the Electronic Privacy Information Center, a Washington research and policy organization. But the negatives, he said, were that the bills opened the door to Government access to private transactions "and criminalize the use of cryptography when it is used to perpetrate a crime." Industry officials said they expected the legislation to stir little enthusiasm from corporate users. "Corporate America is absolutely unwilling to give a third party control of their data," said Jim Bidzos, chief executive of RSA Data Security, a maker of encryption software based in Redwood City, Calif. [End]

3 4