December 2003 - cypherpunks-legacy

New essay
by Michael Froomkin 17 Dec '03

17 Dec '03

Not that it will say much you haven't heard before, but I have an essay on "The Internet as a Source of Regulatory Arbitrage" available at http://www.law.miami.edu/~froomkin/arbitr.htm It's an attempt to be less "legal". Only 93 footnotes! [The above may have been dictated with Dragon Dictate/Win 2.0 voice recognition. Be alert for unintentional strange word substitutions.] A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

pgp keys
by jpps＠voicenet.com 17 Dec '03

17 Dec '03

Is there a reliable method for obtaining the pgp public key for an arbitrary email address? elm-2.4pl24pgp3 does a logical join on my local alias and keyring files; what I'm looking for is a way for my mua/mta to obtain keys I do not have. I've caught some of the discussion on key servers, and noted some people's use of their signature, plan, or home page to distribute their keys. Are some combination of these suitable today? Is there a parseable convention in use for extracting keys from mail/finger/html? Is there a "get_keyd" floating about? My goal is to make encryption the default behavior on outgoing mail. I am not concerned about local security. Thanks in advance. jps -- Jack P. Starrantino jpps(a)voicenet.com http://www.voicenet.com/~jpps

2 1

Using crypt()
by Eric Eden 17 Dec '03

17 Dec '03

I'm testing a encryption program that includes use of crypt(). (I know its not the strongest scheme.) Here's the problem: We ask users to e-mail us an encrypted password derived form the crypt() utility when they set up an account. When they want to change information related to the account, we ask them to e-mail the cleartext of the encrypted password. The program then checks to see if the cleartext matches the original encrypted password. If so, their information is automatically updated. The only problem is when users mistakenly supply cleartext initially, they can never update their information because the program isn't smart enough to realize that the user was submitting cleartext instead of an encrypted password when setting up their account. Is there any way to check and see if the text the user supplies initially has been encrypted or is cleartext? Or is there a better way to do this? The account does not contain financial information, otherwise a stronger scheme would be required. Right now the program allows the user to choose from the auth schemes MAIL-FROM, CYPT-PW or PGP. Any hints would be appreciated. Eric

3 2

Re: So, what crypto legislation (if any) is necessary?
by jim bell 17 Dec '03

17 Dec '03

At 11:34 PM 4/3/96 -0800, Bill Stewart wrote: >>As usual, Unicorn is FOS. Not entirely in his facts, but in his >>conclusions. To "forbit third parties to reveal prosecution inquiries" is >>an obvious violation of freedom of speech, and in fact is PRIOR RESTRAINT. >>Maybe Unicorn can't see what's wrong with that, but I can. It is unclear >>whether this has ever been tested in court, or whether that test occurred >>recently. > >Black Unicorn is absolutely correct that this is generally the law. >Jim Bell is absolutely correct that laws like this are offensive and outrageous. >Unfortunately, Jim then rants at Unicorn for suggesting that this >would be the case; you'd think he'd be the first to realize that >there are laws out there that are offensive and outrageous and enforced. I really don't think you're giving me enough credit. I am fully aware that in the past, the organizations on which wire-tap-type subpoenas were served (primarily AT+T, "The phone company") were very cooperative with the police and probably "never" challenged the subpoena. There is the law, and there is the usual reaction to that law, and I expect that much of Unicorn's position is based on a (false) assumption that this reaction will necessarily continue unchanged. Besides, that phone company had a monopoly, so it wasn't possible for citizens to shop around for a phoneco that was known to make it hard for police. But that's changing, and that's my point. Now and in the future, it's going to be harder and harder for the police to get a bend-over-backwards level of cooperation, and in fact phonecos (and especially ISP's) might reasonably want to build up a reputation that they will defend a customer's security in court long before a wiretap is installed. Imaginative phonecos will find ways to inform the target legally, including naming the target as a non-hostile defendant in a court challenge to that wiretap, and noticing that target since he's now a party to a court action that must be noticed under civil procedure rules. In short, there is a drastic difference between blind obeisance and enthusiastic hostility, even if you exclude actions by the ISP or phoneco that would rise to the level of some crime. It is this difference which will change the previous ability of the police to get wiretaps done secretly. My point in the first paragraph that I am quoted in above is that many of the challenges that have never been made against wiretap subpoenas, due to a closer-than-arms-length relationship between the phoneco and the government, _will_ be challenged. Precedent, to the extent precedent exists, will be challenged on (among other things) the basis of the fact that this precedent was formulated during an era when essentially all telecommunications was monopolized and regulated, and there is no reason to believe that a previous telecom monopoly would have been diligent at protecting the rights of their captive customers against the interest of the government at that time. >>For example, if I ask my ISP to send me an anonymous, encrypted message with >>the word, "Rosebud" in it to me if he receives any requests to tap my >>connection, he can do so with no fear of being discovered, because no third >>party can decrypt the message, know who is is from, or know the real meaning >>of the word, "Rosebud" in the context of an encrypted, anonymized message. >>Further, since the whole thing is by pre-arrangement, even I cannot prove >>(to the satisfaction of a third party) that the message really meant what I >>would interpret it to mean. The message is useful to me, as a warning, but >>it could never turn around and "bite" the ISP. > >Now that's an interesting wrinkle to the problem. I suspect that, >as you suggest, there will be ISPs, especially in non-US jurisdictions, >that are willing to send out "Rosebud" messages to anonymous remailers, >or to fail to send "Remarque" messages, or to debit anonymous accounts >for data retrieval services rendered while also supporting billing-status >checking by anonymous remailers. From a crypto-anarchist dogmatic perspective, >it'll definitely happen, though there may be a rough transition until >there's enough critical mass to make it undetectable (and note that >"undetectable" is a tougher standard than "untraceable"...) I think we need to start challenging all the previously-assumed issues that have been interpretated to benefit the government. If my ISP has agreed, for instance, to send me daily certifications that he hasn't received any "official" inquiries about my account, and one day he receives such an inquiry and is forced to install some sort of a tap, it is hard for me to imagine what kind of legal precedent would allow (and, even, REQUIRE) him to continue to send false certifications when the alternative, simply failing to send any certifications whatever, is also "legal." (and, in fact, may be required under my contract with him, should he be obligated to do a tap or know one exists.) The fact that I'd likely interpret his failure to send those messages as meaning that my access is tapped is not within his control, and if he's unwilling to screw me I find it hard to believe that he can't act on this fact even if those actions have an indirect effect of alerting me. These are the kinds of issues that have either rarely or never been challenged in court, simply because the organization(s) that would normally do those challenges was in the hip pocket of government. It's going to be a brave new world very soon. Jim Bell jimbell(a)pacifier.com

3 4

Re: e$ Signorage
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 9:35 AM 4/4/96, James Gleick (!) wrote: > Seigniorage is actually the Government's interest income on all the >currency in circulation. It's not obvious, but it's true, that the Fed >collects the "float" on dollar bills you carry in your pocket, exactly as >American Express collects the float on traveler's checks. Ah. That makes much more sense. I've always wanted to know what to call the interest an ecash issuer made on the e$ he had out on the net. "None Dare Call it Seigniorage." Sounds like a 50's movie title... > And, I don't know, call me crazy, but $20 billion sounds like a lot of >money to me. I bet that's a real number. In terms of its scale in the overall Federal Universe, to paraphrase Dirksen, "a billion here, a billion there..." Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

.sig followup
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 2:52 PM 4/4/96 +0200, Ulf Moeller quotes: >"In some ways the online environment in 1996 feels like Hong Kong in the >last days of British rule: a very free community wondering what's going to >happen as the forces of law and order start moving in." -- Charles Platt A better analogy would be free, peaceful, self governing Denmark waiting for the jack booted Nazi thugs to arrive and start hauling people off to jail. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

3 2

Re: [mis]FWD: On digital cash and geodesic economies
by Alexander 'Sasha' Chislenko 17 Dec '03

17 Dec '03

Sorry - sent previous post to cp instead of bionomics.

1 0

Fwd: Anonymous code name allocated.
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

[The following has been censored to protect the guilty.] >Subj: Anonymous code name allocated. >Date: 96-04-02 23:37:10 EST >From: daemon(a)anon.penet.fi (System Daemon) >To: jonwienke(a)aol.com > >You have sent a message using the anon.penet.fi anonymous forwarding service. >You have been allocated the code name anXXXXXX. >You can be reached anonymously using the address >anXXXXXX(a)anon.penet.fi. > >If you want to use a nickname, please send a message to >nick(a)anon.penet.fi, with a Subject: field containing your nickname. > >For instructions, send a message to help(a)anon.penet.fi. I tried sending a test message to the address indicated, and received it back a day later, so sending email to this address does reach me. The funny part is that I have never (to my knowledge) had any communication with anon.penet.fi prior to receiving this email. Questions: 1. How do I use this to SEND messages anonymously? Having an email address with no obvious link to my identity is cool, but I would like to be able to send as well as receive. I sent email to help(a)anon.penet.fi, but have received no response yet. 2. Why was I chosen for this? How did anon.penet.fi find out my email address? Is the NSA trying to lull me into a false sense of security in the hope that I will use this account to violate ITAR? 3. Has anyone else on this list received unsolicited remailer accounts? Jonathan Wienke --------------------- Forwarded message: From: daemon(a)anon.penet.fi (System Daemon) To: jonwienke(a)aol.com Date: 96-04-02 23:37:10 EST You have sent a message using the anon.penet.fi anonymous forwarding service. You have been allocated the code name an573530. You can be reached anonymously using the address an573530(a)anon.penet.fi. If you want to use a nickname, please send a message to nick(a)anon.penet.fi, with a Subject: field containing your nickname. For instructions, send a message to help(a)anon.penet.fi.

1 0

Why pay???
by kreidl＠newrock.com 17 Dec '03

17 Dec '03

> >Thanks for your interest in Cypherpunks Lite. > >I provide a moderated version of the Cypherpunks list called >"Cypherpunks Lite". A one year subscription costs US$20 and is >payable by check or money order to "Communication Security Corp". >Cypherpunks Lite is available in either individual messages or a >more-or-less daily message digest. The content of both are the same. >In either case, I forward approximately 5 - 10% of the total >Cypherpunks feed. This works out to about 5 - 10 messages / day. > >To take a look at what you can expect there is an archive of the previous >selections organized by month at ftp://ftp.crl.com/users/co/comsec/cp-lite. >The files with the extension .gz are compressed using gzip. > >If you would like to subscribe, please send payment to: > > Communication Security Corp. > 1275 Fourth Street, Suite 194 > Santa Rosa, CA 95404 USA > >Be sure to provide the email address you want us to use, as well as >indicating your preference for individual messages or the digest. > Why would I pay if I can get it for free this way?????? ÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑ Chris (or Richard) Kreidl Ñ kreidl(a)newrock.com Ñ ÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑÑ

2 1

No Subject
by agil.home＠mail.telepac.pt 17 Dec '03

17 Dec '03

unsubscrive * agil.home(a)mail.telepac.pt unsubscrive * agil.home(a)mail.telepac.pt unsubscrive * agil.home(a)mail.telepac.pt

1 0