December 2003 - cypherpunks-legacy

Kid Gloves or Megaphones
by eric＠remailer.net 17 Dec '03

17 Dec '03

I've been engaged in a background discussion with some folks about how to treat a new protocol, when to speak, etc. Elements of that discussion have become relevant to the list widely. The situation is thus. Ian Goldberg et al. have developed a protocol for simultaneous payer and payee anonymity. It appears to be novel, albeit not entirely unanticipated. The protocol works with the existing bank signing oracle and could interoperate with Mark Twain's current system. The suggestion was made, paraphrasing -- couldn't we just not talk about this too loudly yet? ... NO! Perhaps the single most important lesson I've learned from cypherpunks is that code alone doesn't cut it. Not code alone, not code widely distributed, not even code widely used. Some measure of toleration in society for activities conducted in private is _necessary_ for long term success. Not convenient, not easier, but necessary. The whole Clipper situation testifies to this. Unless there is a public concensus that people generally should be able to use their own cryptography, then such use will become marginalized. Legislatures will outlaw, the public will disapprove, and vigilantes will hunt down improper use. That, in my book, means we've lost. Code is clearly still necessary. Code demonstrates what actually happens. To write code is to invoke and evoke the latent and insufficiently articulated desires for privacy in the world at large. Similarly with anonymous transactions. Unless a similar concensus exists, we will have another marginal activity. Again, I count this a loss. Backlash will result from later disclosure that the payment systems we generally as cypherpunks have undisclosed properties, that we as a loose group have dissimulated and even lied outright about the capabilities of the systems we advocate. This backlash will wipe away many gains we might have made and eliminate the possibility of future ones. The backlash will be justified, because it will be the natural result of a demonstration of bad faith. One such demonstration now, and who would know when the next was coming, or that we had not hoarded encrypted agendas all along in our hearts? And then, since we would not be believed, all the propaganda of our opponents will triumph. The Four Horsepersons will come trotting out in grand inquisitional spectacle, and there will be no counterpoint, because the devil's advocate will have been discovered to have been guilty himself. It is foolishness itself to deceive a public which is substantially in favor of the program of complete privacy. We must appeal to the public that finally will decide, not to some officials today who have power and tomorrow who will not. Clipper itself was not defeated by constructive engagement with the Clinton wiretap administration. Clipper was defeated by a general call to arms. Therefore, shout out to the world that payee anonymity is possible with ecash(TM)! Eric

1 0

The Path to Anonymity
by John Young 17 Dec '03

17 Dec '03

Thanks to anonymous and AJ the exemplary report: Privacy-enhancing Technolgies: The Path to Anonymity Registratiekamer, The Netherlands Information and Privacy Commissioner/Ontario, Canada August 1995 Volume I Volume II is available at: http://www.replay.com/mirror/privacy/ _________________________________________________________ Introduction [Excerpts] The Dutch Data Protection Authority (the Registratiekamer) and the Information and Privacy Commissioner for the Province of Ontario, Canada (IPC) are both privacy protection agencies that oversee compliance with their respective juridiction's privacy laws. The Registratiekamer and IPC decided to pool their resources and collaborate in the production of a report exploring privacy technologies that permit transactions to be conducted anonymously. The first international paper of this type includes a survey of companies that might be expected to offer such technologies, and organizations that might use them. In addition to anonymous transactions, the range of security features commercially available for use and the types of services actually being used by various organizations were also examined (see 2.1 Survey methodology). The Registratiekamer and IPC felt that a joint report outlining the practices followed in their respective jurisdictions would shed some light on this little-studied but extremely important area where the future of privacy-protection in an electronic world may lie. Consumer polls have repeatedly shown that individuals value their privacy and are concerned with its potential loss when so much of their personal information is routinely stored in computer databases, over which they have no control. Protecting one's identity goes hand in hand with preserving one's ability to remain *anonymous* -- a key component of privacy. While advances in information and communications technology have fuelled the ability of organizations to keep massive amounts of personal data, this has increasingly jeopardized the privacy of those whose information is being collected. Minimizing identifying data would restore privacy considerably, but would still permit the collection of needed information. When assessing the need for identifiable data during the course of a transaction, the key question one must start with is: how much personal information/data is truly required for the proper functioning of the information system involving this transaction? This question must also be asked at the outset -- prior to the design and development of any new system. But this is not the case today. This question is rarely asked at all since there is such a clear preference in favour of collection identifiable data, 'the more the better'. However, with the growth of networked communications and the ability to link a wide number of diverse databases electronically, people will become more and more reluctant to leave behind a trail of identifiable data. What is needed is a paradigm shift away from a 'more is better' mindset to a minimalist one. Is it possible to minimize the amount of identifiable data presently collected and stored in information systems, but still meet the needs of those collecting the information? We believe that it is. The technology needed to achieve this goal exists today. We will describe some of the privacy technologies that permit one to engage in transactions without revealing one's identity by introducing the concept of an *identity protector*. The notion of *pseudonymity* will also be introduced as an integral part of protecting one's identity. These technologies are available now and within our reach; what is needed is the will to implement privacy technologies over the tracking technologies that are in use today. When organizations are asked what measures they have in place to protect privacy, they usually point to their efforts at keeping information secure. While the use of security measures to prevent unauthorized access to personal data is a very important component of privacy, it does not equal privacy protection. The latter is a much broader concept which starts with the questioning of the initial collection of the information to ensure there is a good reason for doing so and that its uses will be restricted to legitimate ones that the data subject has been advised of. Once the data has been collected, security and confidentiality become paramount. Effective security and confidentiality will depend on the implementation of measures to create a secure environment. Alternatively, instead of restricting the focus to security alone, a more comprehensive approach would be to seek out ways in which technology may be used to enhance the protection of informational privacy or data protection. We use the term *privacy technologies* to refer to a variety of technologies that safeguard personal privacy by minimizing or eliminating the collection of identifiable data. Not only are measures that safeguard privacy becoming an important mark of quality, but increasingly, consumers are demanding that organizations pay attention to their privacy concerns. Social acceptance of demands for one's personal information, without adequate assurances of protection, appears to be on the decline. Not only do consumers wish to maintain control over their personal data and be informed of its uses, but insufficient protection will be reason enough for consumers to take their business elsewhere -- to companies that follow privacy-protective practices. -----

1 0

Re: entropy masking (was Re: Multiple spinners as sources of entropy?)
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-13 18:35:51 EST, Matt Blaze writes: >I would go even further than this. I wouldn't trust ANY >environmentally-based random source (cycle spinner, keyboard >timer, disk noise, whatever) against adversaries on the >same system. In DOS, the keyboard, mouse, and disk drives run on interrupts, not timers. If you use a timer as a spinner, such as the Windows GetCurrentTime() function, (I MSec. resolution) and check its value each time a key is pressed and released, It would appear that the results should be quite random, because the keystroke is not processed in conjunction with the timer, but rather whenever the interrupt occurs. My tests in this area indicate that any 8 bit value can be achieved with this method, with a fairly uniform distribution. My tests are not thorough (I haven't sat down and typed for 2 hours to test the distribution of the output), but results look reasonably good so far. Jonathan Wienke

2 1

Anon email accounts available
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Just letting folks know that shellback.com is offering anon email accounts. Price is $5/month, prepaid via cash or money order. Weekly notices starting 30 days before account expires. See our page at http://www.shellback.com/anonmail.htm (yes, we're really leaving the last 'l' off :-) Also want to let folks know that the remailer is not _yet_ functioning (saw a couple messages try to fly through while setting up the mail server). Real Soon Now. Honest. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUbmAMVrTvyYOzAZAQEE0QP/Tg5wqn49bFVx8hwYbGP9UK3SsU7bgh+U yt6rZRrxTfIpJk01emWY6SXPL1XjCSSV8YXnukaScJdpmIJ9vRZkG1wpznNFWeER GtLP8YTdcyQxOzC7qY9UWwebweVTNjwH998x09jiUhp2wY1qkTjHqk2qMxSStZrZ 2U1IQc/BDt0= =uH+x -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re:LACC: PC Phones Home?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:41 AM 3/14/96, Jim McCoy wrote: >A few questions: > >1- How does the PC know where it is? >2- How does the PC know it has been stolen? The Web reveals all: 1. If the PC has been _reported_ stolen by the owner, any call from that PC triggers a phone trace, says the company. 2. See #1 (the key is that owner must call and report a particular PC stolen). >Since this is a software product I am assuming that the answer to #1 >is the use of CallerID on the line when the software calls, which is >defeated by the use of line blocking by the thief. The obvious answer >to #2 seems to me to have the system call the CompuTrace office at >odd intervals to see if it has been reported stolen yet... > >Obvious solution for potential thieves: wipe the disks and reinstall >an OS once you steal a PC. This should be done anyway to remove any >bits of data which might identify the original owner. These points assume the thief is relatively sophisticated and that the thief is aware that the CompuTrace system is installed. I suspect that neither is likely, at least not until the system gets sufficient publicity so that the first thing thieves and purchasers of suspected-to-be-hot PCs do is to make plans to avoid this (reformat disks, etc.). I think the scenario I described in my earlier post on this topic covers about 97% of all PC thefts: relatively unsophisticated thieves who warehouse the merchandise until buyers are found. The buyers, in turn, are also relatively unsophisticated. They may be immigrant businesses looking for a really good deal on PCs, they may be school systems strapped for cash, they may be your mother buying her first PC at a flea market. And they may be any of us, buying a surplus PC. In none of these cases is the user likely to take steps to disable Caller ID (and the company may actually do old-fashioned tracing). >Conclusion: Yet another useless piece of software riding the >computer security bandwagon. I'm not convinced it's software I would want to buy, but it fills a niche, I think. And it's definitely not the snake oil we've seen recently, as it makes no outrageous technical claims and seems to be going after a limited market. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

House Votes to Weaken Anti Terror Bill
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

House Votes to Weaken Anti Terror Bill Washington, March 13 (Reuter) -- The House of Representatives Wednesday removed major provisions of an anti-terrorism bill in a vote that sponsors of the legislation said would gut the measure. An amendment, adopted 246-171 by conservative Republicans and some liberal Democrats, removed language that would give the government authority to label groups as terrorist so foreign members can be deported more easily. It also prohibits use of wiretap evidence obtained without a warrant. "We do not need to give our government vast new powers," Georgia Republican Bob Barr, the amendment's author, said before the vote. He said current laws were strong enough. "With the Barr amendment this is not a real anti-terrorism bill," said Republican Henry Hyde of Illinois, the bill's main sponsor and chairman of the House Judiciary Committee. Hyde said an unusual coalition of groups including the conservative National Rifle Association and the liberal American Civil Liberties Union were opposing the bill because they thought it gave the federal government too much power. Hyde said one Republican colleague told him privately, " 'I trust Hamas (the militant Islamic group) more than my own government.' "

1 0

Re:LACC: PC Phones Home?
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Dennis Hilliard writes: > >"Software to the rescue: >If somoeone steals your PC, you may be able to get it back because of >software that acts as a kind of tracking device. Home Office Computing >magazine reports that the software CompuTrace TRS will automatically dial >the office of its creator, Absolute Software, if a thief hooks up a stolen >PC's modem to a phone line. The software reveals the location of the PC and >Absolute Software will call the police" - Providence Journal-Bulletin - >March 12, 1996. > >Any Comments? A few questions: 1- How does the PC know where it is? 2- How does the PC know it has been stolen? Since this is a software product I am assuming that the answer to #1 is the use of CallerID on the line when the software calls, which is defeated by the use of line blocking by the thief. The obvious answer to #2 seems to me to have the system call the CompuTrace office at odd intervals to see if it has been reported stolen yet... Obvious solution for potential thieves: wipe the disks and reinstall an OS once you steal a PC. This should be done anyway to remove any bits of data which might identify the original owner. Conclusion: Yet another useless piece of software riding the computer security bandwagon. jim

2 1

Re: Remailer passphrases
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-14 01:52:14 EST, you write: >It is probably possible. Put a clip across the CPU chip, and take over >from it by raising it's chip disable will work with some microprocessors. >However, the proper application of various kinds of rubber hose to the >operator should make that kind of attack unnecessary. In general, this is an excellent way to make smoke and big sparks, which (since shorts tend to overtax the power supply and drop voltage levels) is a good way to clear system RAM, thus defeating the purpose of the exercise. Software hacks can do the job just as well, and don't require special breathing apparatus. Jonathan Wienke

1 0

e$ and markets and meta-markets. quote with little comment
by bryce＠digicash.com 17 Dec '03

17 Dec '03

I just thought I would re-print this extract from the recent press release regarding the EUNet/Merita ecash roll-out. Favorite phrase: "interesting new possibilities." Follow-ups directed toward e$. If you post to cpunks without Cc'ing me I probably won't see it. Bryce ******* begin quote from the "companies that accept ecash" section SOM -- SOM, the Finnish Securities and Derivatives Exchange and Clearing House, established in 1987, serves as a neutral integrated securities and derivatives exchange and clearing house. SOM offers real-time financial market information on stocks, options and futures via the Internet, with invoices payable in ecash. Somtel for Windows -the application that offers real-time feed, as well as simulation and position-analysis functions-, is already available via leased line. "The use of money makes stock trading less complicated, with money acting as a practical intermediary between the transactions." states Asko Schrey, President of SOM. "However, since stock trades, as well as the shares themselves, are electronic nowadays, this conventional transmission of money has actually become a bottleneck and a threat to the development of the financial world. Therefore, SOM actively participates in projects to promote and improve the efficiency of payment traffic. We believe that electronic money will offer interesting new possibilities."

1 0

New paper on crypto regulation and the right to privacy available
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

A paper exploring various aspects of cryptography and cryptography regulation has just been published in the Journal of Universal Computer Science (J.UCS). J.UCS is a Springer-Verlag electronic publication available at <A HREF="http://hyperg.iicm.tu-graz.ac.at/0x811b9908_0x0008eaac;sk=74BEC6EF"> J.UCS</A>. It's coming off a non-HTTP server so I can't give a direct URL, you need to follow the links to Volume 2, No.3 to find: Government, Cryptography, and the Right to Privacy J.Shearer, P.Gutmann The notion of a right to privacy of citizens in their communications is discussed in the context of an international movement by governments towards regulation of cryptography, and consideration of key forfeiture systems in national cryptography use. The authors argue that the right to privacy in communications networks is an issue of major importance, assuring freedom of the individual in national and global communications. Regulation and control of cryptography use on the Internet by national governments may lead to an imbalance in the citizen/government power relationship, with sequelae including unprecedented surveillance of citizens, disruption of international commerce due to lack of powerful cryptography (and lack of standardisation), human rights abuses by less democratic or non-democratic governments, and limiting of the political potential of an Internet global political system. Peter.

1 0