December 2003 - cypherpunks-legacy

Re: PGP backdoor? (No, I'm not paranoid.)
by David Weiss 17 Dec '03

17 Dec '03

jf_avon(a)citenet.net wrote: >perry(a)piermont.com wrote: >> [...] >>Your informant is taking extremely good drugs. You should find out who >>his connection is should you want to get any. >> >>Perry > >Dear Perry, > [interesting statement of why nothing one hears should ever be discounted] > >So, why waste bandwith with a post that apparently mainly seems to be aimed >at dismissing somebody but brings *absolutely no* new knowledge to >the discussion? Please, next time, post privately. Sure it does; Perry's opinion. And what that is worth, depends on the reader's opinion of Perry. >Funny jokes are, IMHO, welcome because they have some life-enhancing value. > >So please, at least be funny... I thought it was pretty funny (more so than your post, anyway). David (I feel another really silly and pointless thread starting...)

1 0

No Subject
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

This came from Associated Press (27th Feb) : ============================================================================ Europe pushes Asian weapons sales KUALA LUMPUR, Malaysia - Russia is doing it. So are Britain, France, Germany and Spain. Even neutral Sweden has joined the race to sell warplanes, missiles, tanks and warships for Asia's rapidly expanding arsenals. The Europeans, fighting an uphill battle against dominant U.S. competitors, are offering what the Americans sometimes won't - the newest, deadliest technology with no political strings attached. While post-Cold War budget cutting devastated the arms trade in the rest of the world, military spending in Asia is still rising. >From 1991 to 1994, Asian sales by Britain, France, Germany and Italy totaled $3.4 billion - a 30% increase over their sales in the 1987-1990 period, according to figures compiled by economist Digby Waller of the International Institute of Strategic Studies in London. By contrast, American weapons sales in the region were $5.4 billion in 1991-1994, a 7% decline from the previous three-year period. Despite widespread agreement that U.S. weapons makers are technologically superior, European producers have signed a flurry of deals with nearly every Asian country. According to military analysts, buyers were attracted by Europe's lower prices, equipment - like submarines - that the United States doesn't sell and - perhaps most important - the chance to avoid becoming dependent on American suppliers in case the United States cuts back future arms exports. In one of the most powerful signs of the Asian market's allure, Russia tossed out ideological considerations in favor of cash, selling its former Chinese rivals high-performance Sukhoi 27 jet fighters and the technology to make more. Thailand bought an aircraft carrier from Spain. Taiwan bought six frigates and 50 fighter jets from France. South Korea bought three German cruisers and Malaysia bought two British frigates. Sweden sold diesel-electric submarines to Thailand and Singapore. The United States no longer manufactures such vessels, partly in an attempt to halt their proliferation. Such submarines are very quiet and almost impossible to detect, even with sophisticated equipment. Some military analysts argue the unprecedented weapons buildup will ignite an arms race in a region crisscrossed by territorial disputes. They point to the growing military might of Japan, China and India and a series of smoldering regional disputes, including those between Taiwan and China and between North and South Korea. Asian governments counter that they're entitled to defend their territory. "It is wrong to see the purchase of defense equipment by countries in the region as an arms race,'' Singapore's defense minister, Tony Tan, said in a TV interview in January. "We and our ... neighbors are proceeding with plans to modernize our armed forces, now that our economies have grown and we have the resources to pay for better weapons and equipment.'' The biggest potential source of conflict in the region is China's feud with its Southeast Asian neighbors over oil and gas riches in the South China Sea. China has declared the entire region its territory, and sent warships to enforce the claim. While European governments try not to fuel arms races, they may sell to buyers who are refused American weapons for political reasons, said Paul Beaver, a military analyst for Jane's Information Group. Beaver pointed to the example of Britain's $35 billion deal to supply Tornado fighters and other weapons to Saudi Arabia after the United States balked at selling warplanes that could be used to attack Israel. "That has been seen by the Muslim countries in Southeast Asia as a strong sign that Britain doesn't attach the same political conditions to its sales as the United States does,'' he said in a telephone interview from London. Thailand wants to buy advanced American AMRAAM missiles to arm its new F-18 fighters. But because no other country in the region has a missile that sophisticated, the Clinton administration is hesitating for fear of sparking competition among Thailand's neighbors to match it. "If the United States did not want to sell AMRAAM missiles to Thailand, I wouldn't be surprised if France would be willing to sell a similar missile,'' said Pieter Wezeman, a researcher for the Stockholm International Peace Research Institute. Asian governments also appear to be buying European weapons to diversify their arsenals in case Washington shuts off their supply. "The United States has shown several times that they don't want to sell weapons to everyone, and so at any moment they might start an embargo,'' Wezeman said. In one of the region's biggest recent sales, Taiwan bought 210 fighter jets, splitting the order between French Mirage-2000s and U.S.-made F-16s after Washington first refused to sell and then approved fewer planes than Taiwan wanted. Pakistan, blocked by U.S. law from buying F-16s because of evidence it has built nuclear weapons, is reported to be shopping for French or Russian warplanes to fill the gap. By The Associated Press ============================================================================= no_one@unimportant.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)homeport.org> mentioned: > The big problem with this is that net phones can be subject to > delay & drop out, and I don't want to deal with that when I'm talking > on the phone. Adam, Yes, and that's good news. We can claim, while we are building up our infrastructure, that we have a low-quality service that cannot compete with the current LD carriers. Meanwhile, several companies and committed enthusiasts are solving IPhone's technological problems. Also, ATM and other high-bandwidth technologies that the LD carriers are deploying can bring them profits when IPhone users request the _fast_ Internet. But the real money is in the billing system. And an efficient, decentralized ecash infrastructure will change the world. A cheap telephone-to-telephone long distance and international voice service, which people do want to buy, could provide the cash flow to jump start it. CW

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On the mailing list for the "Electronic Frontier Canada" (similar to, but not a part of EFF), David Jones (djones(a)insight.dcss.McMaster.CA) writes: > > Feds want encryption; Police opposition ignored. > >The federal government wants its employees, and Canadians in general, >to use strong, public-key encryption. Yes, the same encryption methods >that American law enforcement is so uptight about. The same encryption >that Canadian cops want to avoid, so they can continue to eavesdrop. > >It's summarized in a recent Ottawa Citizen article: > > gopher://insight.mcmaster.ca/00/org/efc/media/citizen.13feb96 > >You may recall the Canadian Association of Chiefs of Police (CACP) >have voiced their opposition to any encryption of communications unless >police had access to a "backdoor" last summer. > > gopher://insight.mcmaster.ca/00/org/efc/law/cacp.24aug95 > >In Canada, it looks like the right to privacy of telecommunications >might take precedence over the police interest in snooping to catch >criminals. I won't repost the entire article here, but here are some highlights: - The system is initially intended to secure email between federal government employees. Deployment is expected to begin next year. - Key management is decentralized; each department hands out its own keys. - Top-secret messages will be encoded using "palm-sized computer cards" (presumably some kind of PCMCIA device). - The Communications Security Establishment (~= NSA) helped to design the system, and claims that it's "more sophisticated than existing public versions". (This is the part that still worries me a bit, even though EFC's David Jones is quoted as saying that he has no concerns. Will the algorithms be published? Also, why develop a new, untested system -- why not just buy the thing from RSA, Viacrypt, etc.? Stay tuned...) - There's a great quote from Bob Little, deputy secretary of financial and information management for the Treasury Board: "[The CSE] don't have access to the keys . . . and never will. We did it to avoid the American experience with the Clipper Chip." - The RCMP (~= FBI) is not amused. All in all, it sounds like a positive development for once. -- Martin Janzen janzen(a)idacom.hp.com

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:06 PM 3/7/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >Do not agree with you. Do support your right to disagree though. > P.fla That's all this guy said. Here's my more verbose response. >Do not agree with you. You are _entitled_ to not "agree" with me. What you are NOT entitled to, however, is to have a government that violates my rights by attempting to restrict crypto and other freedoms, even if it is with the support of 51% of the Congress or 51% of the voters or 51% of the population. (or even substantially more.) If you actively support such a government, or even encourage such a government, you are doing what is analogous to "inciting a riot": You are guilty of inciting the government to take improper, illegal, unconstitutional, or simply immoral actions against me and others, and in my opinion if such actions are taken you enter into that conspiracy. You may be alarmed that I might consider you a criminal for just exercising your "free speech." (If you're not alarmed, you SHOULD be!) I myself would greatly prefer to live in a society where speech was totally free: There would be no laws against libel and slander, and you could "yell 'fire' in a crowded theatre" without the possibility of prosecution. (All the other potential customers will be home watching on tape rental, which will make what you can do in a theatre less significant.) But until we live in such a world, I consider that yelling "child porn!" or "terrorism!" or "drug smuggling" in "a crowded Congress" or _to_ "a crowded Congress" that's anxious to restrict our rights ever further, is an incitement to violate my rights. > Do support your right to disagree though. No, I don't think you do. You've done NOTHING to actually _support_ my right to disagree, except possibly waste a few bytes of information space on a message that you did not see fit to publicize. (I did, however.) Clearly, your "support" for my "right to disagree" is essentially non-existent. Jim Bell Klaatu Burada Nikto! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT866/qHVDBboB2dAQHqfAP9F1vYWiHVT67QXNXwuDWpR9n6THRL4S2W vJq256khHXs4pMawUiGitkovVEDSBM8Tc6t6NpgNbwEojZ40dF147gqq7iTLOrf0 TU4RrUvBKiRJbTXnJM6YdHL7gOHQtU5TqHRft3R9JAHR5zEpetUSIo7+uVbklqqd Du1cZlTbu68= =M+dV -----END PGP SIGNATURE-----

1 0

Jump Start ecash With IPhone
by clarissa_wong＠alpha.c2.org 17 Dec '03

17 Dec '03

Proposal: Augment computer-to-computer Internet phone with local telephone-to-Internet-phone gateways to create a new telephone-to-telephone long distance network via the Internet. Result 1: No computer is needed for cheap long distance or international voice phone calls. Result 2: ecash gets its "Killer Ap", a service that (a) people want to buy and (b) requires micropayments for economic feasibility. (Details below.) Result 3: Creates a large, decentralized market that is difficult for anyone to regulate and that provides many opportunities to make money. Obvious Nonresult: Achieving privacy in long distance or international voice requires further development. Hardware and software beyond that in an ordinary telephone is needed at each end. Who Can Do It: ISPs (Internet Service Providers) are in the best position to operate nodes of this decentralized network. They have the Internet connection, the phone banks, the technical expertise, and some business experience. Telephone <---> ISP <---------> ISP <---> Telephone Scenario (Result 1): Granny Smith in Paducah wants to chat with her grandson Adam Smith, who is studying economics in Hong Kong. From her ordinary touch-tone phone she makes a local _voice_ call to Cheap Speech, Inc. and at the prompt enters the phone number for Adam. Cheap Speech finds that TalkToMe Ltd is a network node in Hong Kong within a local phone call of Adam and, through the Internet, establishes a connection. Then it patches in the voice call from Granny as TalkToMe dials out and reaches Adam. Granny Smith <--> Cheap Speech <-----> TalkToMe <--> Adam Smith Payments (Result 2): More than half the cost of running a traditional long distance voice business is for handling the billing. The cost of the technology to provide the service is thus less than the cost of the billing! Cheap Speech and TalkToMe cannot provide cheap voice service, as in the example above, unless they use a much more efficient payment system. That is why the low transaction cost of ecash is so important and that is why this message is being sent to cypherpunks rather than a telecom list or news group. So who uses the ecash? Surely Granny and Adam Smith can't shove it through ordinary telephones. They just want to get ordinary voice connections with ordinary telephones as they have for many years, only cheaper. Here is how I think ecash fits in: Granny Smith --> Cheap Speech Granny pays Cheap Speech through ordinary means, probably by monthly credit card charge, which is common for ISPs. The overhead for this probably is only around 5% (plus staff for account setup and support) because the ISP already is set up for that kind of payment system and Granny Smith is a local person providing repeat business, not a bad apple on a spending spree with a stolen credit card number. Cheap Speech --> TalkToMe Cheap Speech and TalkToMe do not have any previous business arrangement with each other and probably never have done business with each other before. They also are on opposite sides of the world. But Cheap Speech consults a Rating Service that says TalkToMe is reliable, so Cheap Speech sends a small amount of ecash to TalkToMe to open a connection and dial out to Adam. Since ecash clears instantly, TalkToMe does not need to know anything about Cheap Speech. No international billing network is needed. Little overhead is incurred. TalkToMe --> Adam Smith TalkToMe provides this service in exchange for the ecash from Cheap Speech. The main problem I see with this scheme is that Cheap Speech may have a cash flow problem. Payment to TalkToMe must be made immediately whereas payment from Granny Smith may take a couple of months to arrive. If, however, the volume of incoming calls (ecash coming in) matches the volume of outgoing calls (ecash going out), then the cash flow will balance out. Also, Cheap Speech could offer Granny a discount for prepayment. Regulation and Profit Opportunities (Result 3): Big, centralized organizations are big targets for lawsuits and regulation. They are the "deep pockets" lawyers love to pick. They are the leverage points for power-hungry politicians. But the Internet was designed to survive nuclear war. It was designed to route around outages, no matter their cause. A decentralized, Internet-based, international network of small, independent voice service providers could enjoy similar advantages. Many companies are creating _computer-to-computer_ Internet phone software. See the NetWatch Top Ten - Voice / Video On The Net at URL: http://www.pulver.com/netwatch/topten/tt24.htm We can depend on that technology to improve. I do not know of any companies who also are providing interfaces to ordinary telephones and designing a decentralized network with an ecash-powered payment system. That is our advantage. But the network described above has many limitations. These are opportunities to make money by selling your solutions to customers. Examples: It needs a directory and rating service for voice providers such as Cheap Speech and TalkToMe. (Perhaps Raph Levien will expand his rating services to a new domain?) The network will not be useful until it has many nodes. That is partly why this proposal is being sent to a large audience. Cypherpunks who cut their teeth building a remailer network perhaps can build a voice network, too? Think of it as a challenge. People who travel a lot will want cheap long distance telephone service while on the road. How do they arrange that if their only contract is with a service provider near their home? We need a more flexible payment protocol than the one described above. Enhanced services - fax, teleconferencing, time-delay and retry, phone mail, and collect calls. Multiple brands of ecash will require conversion services. Currently Mark Twain Bank's offering looks best, but when ecash succeeds, expect many more. Eventually, the network may work best with ecash denominated in currencies other than government-sponsored fiat currencies. Conclusion: If this idea is so good, then why am I telling you about it? (A) I cannot do it all myself. (B) Feedback on the idea from knowledgeable people is valuable. (C) If it succeeds, it will create a market with opportunity for plenty of people to make money, including me. (D) We have a limited window of opportunity to get this done. My guess is that we have roughly one year before other people embed their solutions into the Internet and financial system so deeply that this network will be locked out from commercial success. According to the theory of increasing returns, whoever gets to market first usually gets the market. (E) Even though the decentralized structure should help reduce exposure of the network-as-a-whole to harmful lawsuits and regulations, individual local providers may face sanctions from regulators of the FCC, state PUCs, national Telekom monopolies, etc. once they realize what's happening. (Operators of cypherpunk remailers endure similar risks.) The faster the system can be developed and deployed, with a large number of satisfied customers, the more widespread support it will have, the harder it will be to stamp out, and the safer life will be for everyone involved. It would be nice to be able to say "The Genie is out of the bottle." CW

1 0

Re: Bidzos on CNBC, discussing Leahy's Bill
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 3/5/96 PST, Jim Bidzos wrote: > >I'm in favor of the Bill because it specifically prevents, by law, the >US Govt from mandating key escrow. Justa sec! I thought it was the 1st amendment to the Constitution which was supposed to prevent mandatory key escrow. Why should you be happy about a law: A law which is made by Congress can be UNmade by Congress. >Also because it would, by law, >force export control of crypto out of the Dept. of State and into the >Dept. of Commerce, effectively allowing any crypto used in the US and >"widely available" to be exported. While I agree this segment of the bill may be an excellent result, there is no reason that we should have to tolerate the bad portions of this bill to get the good portions. >(The bill does a few other things. >One, it provides for criminal penalties for key holders who abuse >their role as an escrow agent, assuming anyone *chose* to use key >escrow. Which may, inadvertently, give the average individual the ILLUSION of protection. Remember, prosecutions occur because the GOVERNMENT wants them to occur; there is no such thing as a "private prosecution," unfortunately. I'm not particularly afraid of abuse by key escrow agents, because I have no intent of using one. >Second, it makes the use of encryption -any encryption- a >crime if used in the commission of or support of any criminal >activity. Having not read the bill, I can't know for sure, but I'd imagine that if the term "support" is in the bill, they define that term as broadly as they want to. Sorry, but I'm not satisfied. If an act is criminal, let's prosecute the act itself. Any attempt to prosecute USE of encryption must, essentially by definition, impute an INTENT to the user, an intent that the government will fabricate after-the-fact. The government will also use this law to keep themselves in business, as you probably understand I believe. >I think the bill would be better off without these >provisions, but I suspect this is an attempt to give the >administration something.) Let's give them NOTHING. The government is already hamstrung in their attempt to restrict encryption. I expect that nothing in this bill helps us out in any way. >I anticipate that the Administration, led by the intelligence and law >enforcement interests, will vigorously lobby against this bill... As surprising as this may sound, I hope THEY "win." Because that won't really be a win for them, and it won't really be a loss for "us."

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Thu, 7 Mar 1996, Duncan Frissell wrote: > However, a CA operating outside the licensing structure of current CA's > would have very low costs and hence no investment to lose in litigation. > Costs would be almost entirely marketing related and as long as you stayed > out of jurisdictions with some of the new CA law, no regulatory costs or > barriers. > I don't think this is definitional. If nothing else they can take the equipment. If you don't incorporate, your personal assets are at risk; if you do, you have to keep a real separation between the corporation and yourself, pay the taxes, etc. Ok, make it a non-profit labor of love; low risks, no returns, then maybe you are right. Just hope that there ar no punitive or large consequential damages, and no one pierces the corporate veil (unlikely, I admit, but not impossible). What law applies to a certificate used in a multi-jurisdictional transaction is less obvious to me than I would like. I think I have talked a student in my seminar into writing a paper to educate me. [The above may have been dictated with Dragon Dictate/Win 2.0 voice recognition. Be alert for unintentional strange word substitutions.] A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Well, it turns out that (according to a nice person at SurfWatch who put up with the rant I mailed in and send back a denial rather quickly) io.com isn't actually blocked. At least, so they say. No comment on whether there's anything like the "25 complaints" policy. I don't own SurfWatch, but if anybody does and finds www.io.com blocked, I'll send in another rant. I wonder whether they've actually considered the liability situation in re: blocking sites that shouldn't be blocked? I mean, sure, they seem nice enough about setting things right (like with the Nynex sites whose url's had "xxx" in the paths), but it seems to this non-lawyer that a case could be made for damages inflicted by being known as a purveyor of filthy indecency for even a short while. ______c_____________________________________________________________________ Mike M Nally * Tiv^H^H^H IBM * Austin TX * pain is inevitable m5(a)tivoli.com * m101(a)io.com * <URL:http://www.io.com/~m101> * suffering is optional

1 0

crypto ++ where?
by Oscar Boykin 17 Dec '03

17 Dec '03

How can I obtain crypto++, I seem to have deleted the email I had reguarding it. any info would be appreciated. thanks. oscar boykin mailto:boykin@pobox.com http://pobox.com/~boykin home: 404-206-0477

2 1