December 2003 - cypherpunks-legacy

new release (v.1.3.3) of CFS encrypting filesystem
by Matt Blaze 17 Dec '03

17 Dec '03

Source code for the latest version (release 1.3.3) of CFS, the Cryptographic File System, is now available upon request for research and experimental use in the US and Canada. This version works under most BSD-derived Unix systems and should now run without modification under most current Linux releases as well. CFS pushes encryption services into the Unix(tm) file system. It supports secure storage at the system level through a standard Unix file system interface to encrypted files. Users associate a cryptographic key with the directories they wish to protect. Files in these directories (as well as their pathname components) are transparently encrypted and decrypted with the specified key without further user intervention; cleartext is never stored on a disk or sent to a remote file server. CFS employs a novel combination of DES stream and codebook cipher modes to provide high security with good performance on a modern workstation. CFS can use any available file system for its underlying storage without modification, including remote file servers such as NFS. System management functions, such as file backup, work in a normal manner and without knowledge of the key. CFS runs under SunOS and several other BSD-derived systems with NFS. It is implemented entirely at user level, as a local NFS server running on the client machine's "loopback" interface. It consists of about 5000 lines of code and supporting documentation. You must have "root" access to install CFS. CFS was first mentioned at the work-in-progress session at the Winter '93 USENIX Conference and was more fully detailed in: Matt Blaze. "A Cryptographic File System for Unix", Proc. 1st ACM Conference on Computer and Communications Security, Fairfax, VA, November 1993. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfs.ps.) and in Matt Blaze. "Key Management in an Encrypting File System", Proc. Summer '94 USENIX Tech. Conference, Boston, MA, June 1994. (PostScript available by anonymous ftp from research.att.com in the file dist/mab/cfskey.ps.) Version 1.3 of CFS also includes ESM, the Encrypting Session Manager. ESM provides shell-to-shell encrypted sessions across insecure links and requires no OS or network support. It is useful for typing cfs passphrases when logged in over the network. ESM needs RSAREF 2.0 to compile and is tested only on SunOS and BSDI. ESM is the first released part of a suite of session encryption tools that are described in Matt Blaze and Steve Bellovin. "Session-layer Encryption." Proc. 1995 USENIX Security Workshop, Salt Lake City, June 1995. (PostScript is available from ftp://research.att.com/dist/mab/sesscrypt.ps) The new version of CFS differs from the version described in the papers in a few ways: * The DES-based encryption scheme has been strengthened, and now provides greater security but with the online latency of only single-DES. * Support for the smartcard-based key management system is not included and a few of the tools are not included. * An impoved key management scheme now allows chaning the passphrase associated with a directory. * The performance has been improved. * The security of the system against certain non-cryptanalytic attacks has been improved somewhat. * User-contributed ports to a number of additional platforms. * Hooks for adding new ciphers. * 3-DES, MacGuffin, and SAFER-SK128 encryption options. * Timeout options allow automatic detach of encrypted directories after a set time or period of inactivity. CFS is distributed as a research prototype; it is COMPLETELY UNSUPPORTED software. No warranty of any kind is provided. We will not be responsible if the system deletes all your files and emails the cleartext directly to the NSA or your mother. Also, we do not have the resources to port the software to other platforms, although you are welcome to do this yourself. The software was developed under SunOS and BSDI, and there are also unsupported user-contributed ports available for AIX, HP/UX, Irix, Linux, Solaris and Ultrix. We really can't promise to provide any technical support at all, beyond the source code itself. We also maintain a mailing list for CFS users and developers; subscription information is included with the source code. Because of export restrictions on cryptographic software, we are only able to make the software available within the US and Canada to US and Canadian citizens and permanent residents. Unfortunately, we cannot make it available for general anonymous ftp or other uncontrolled access, nor can we allow others to do so. Sorry. Legal stuff from the README file: * Copyright (c) 1992, 1993, 1994, 1995 by AT&T. * Permission to use, copy, and modify this software without fee * is hereby granted, provided that this entire notice is included in * all copies of any software which is or includes a copy or * modification of this software and in all copies of the supporting * documentation for such software. * * This software is subject to United States export controls. * * THIS SOFTWARE IS BEING PROVIDED "AS IS", WITHOUT ANY EXPRESS OR IMPLIED * WARRANTY. IN PARTICULAR, NEITHER THE AUTHORS NOR AT&T MAKE ANY * REPRESENTATION OR WARRANTY OF ANY KIND CONCERNING THE MERCHANTABILITY * OF THIS SOFTWARE OR ITS FITNESS FOR ANY PARTICULAR PURPOSE. If you would like a copy of the CFS source code, please read to the end of this message and then send email to: cfs(a)research.att.com DO NOT REPLY DIRECTLY TO THIS MESSAGE. You must include a statement that you are in the US or Canada, are a citizen or legal permanent resident of the US or Canada, and have read and understand the license conditions stated above. Be sure to include an email address in a US- or Canada-registered domain. The code will be sent to you via email in a "shar" shell archive (a little over 300K bytes long).

1 0

Win95 Remailer beta
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I've finally managed to get my hack at a Win95-based remailer done. I've settled on RemailerBot for a name, an this will be version .9b(eta). It isn't pretty, and there isn't a whole lot of functionality to it yet (remailing, reorder, automagically kills subject lines, handles both anon-to and request-remailing-to). But at least it's *something*; I'll start adding to it ASAP. I'll have the (_heavily_ commented) source (written in VB4 Pro, heh) available on my web page in a day or two (probably need to figure on Monday :-). Anyone wants it before then, email me and I'll zip it up and email it to you (state your preference for MIME or uuencoding). Many thanks to the kind folks who sent 'anonymous mail' to me via my webmaster identity so that I'd have some 'real' remailer messages to play with. Brief description of it is that it reads what Seattle Labs software (purveyors of SLMail95) assures me is a 'standard unix' .mbx file, separates it into component messages, processes them, and dumps the results into an outbox directory. It deletes (not wipes [yet]) any intermediate files. Wiping isn't a big priority (I think) because of Win95's System Agent which can run a defrag utility periodically. My feature priorities are PGP first, followed by latency, then the rest. If there's anyone out there that can read VB source _and_ knows what a .mbx file really looks like, I'd appreciate having a cross-check on my parsing. Right now, it's SLMail-specific, and I'd like to be able to make sure it can handle a little more variety. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUtALsVrTvyYOzAZAQF9+gP+NBtz30BYmPhFBo2P6hPp5yD7nc2bP4ot 5J+HN8K6no3ESguAw2vyhjgY64xIFpD3OUsQsSyz67d7p2nuplKPdTCAKsywE3TF xRcAnb62HH2XOb3QrlnVP17xUqyp8QNlu+fX4WWYqMCoxiyc0KEaFaC+7R7apAuA KfPD7voioDI= =lhjn -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

Re: PolicyMaker paper available
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 2:12 PM 3/16/96, ECafe Anonymous Remailer wrote: >Mab(a)Research.Att.Com posted: >>A number of people have been asking me about some work I've been doing >> >>A PostScript pre-print is available in ^^^^^^^^^^ >> ftp://research.att.com/dist/mab/policymaker.ps > >I D/Led this file last night & printed it out. I was a little suspicious >at first because you'd think if AT&T really wanted people to read (instead >of just wanting to say they published it) they'd put it on the web in http >and not use obscure printer codes. ^^^^^^^^^^^^^^^^^^^^^ Yeah, not only that, but you need one of them fancy modem contraptions to get it. --Dave. -- Dave Mandl dmandl(a)panix.com http://www.wfmu.org/~davem

1 0

Re: InfoWarCon V 1996: Call For Papers
by jim bell 17 Dec '03

17 Dec '03

At 10:10 AM 3/17/96 -0500, winn(a)Infowar.Com wrote: >PLEASE! >It sounds fascinating. Submit. I will NOT SUBMIT! NEVER! Oh, you meant my essay? Sorry! Here it is, parts 1-6. Parts 7-8, and 9-10 in the next message: Assassination Politics by Jim Bell, jimbell(a)pacifier.com Part 1 [rest deleted for CP]

1 0

FYI - Article in Sun. 3/18 LI Newsday
by Deranged Mutant 17 Dec '03

17 Dec '03

There's an article in Sunday's (March 18) Long Island Newsday called "When is online out of line" with the subtitle "Should we censor the internet?". Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Win95 Remailer
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I neglected to mention in my previous message that the source will also come with an executable. Dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUukpsVrTvyYOzAZAQF7bQP+NtuSDNKUnNk3P7l11rnHCmouZrclhbT3 o2ayOhYiOnpAkV4UQJLm/SN4KT5OL9tZdy8uc5dI+jzywVkPUlP79HSbfj9SNvgF AcjaDWvwjB4b0+iNam+avl/uMSR4xGRmCKi42pJZIN0klEvAvT6OadBYsPFat19W 1RiwthHvN9Y= =yLK+ -----END PGP SIGNATURE----- ------------------------------------------------------------- "Giving money and power to government is like giving whiskey and car keys to teenage boys." P. J. O'Rourke (b. 1947), U.S. journalist. <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> http://www.shellback.com/personal/merriman/index.htm

1 0

[NOISE] The all.net controversy continues
by Mark Aldrich 17 Dec '03

17 Dec '03

Here's some info from all.net and a host of players IRT the "telnet" fiasco and assorted activities related to it. Crypto relevance is oblique, but some people on this list have implied "knob twidling" intentions. It would appear any number of sites are trying more than twidling. One interesting notion that surfaces in this is what's a "normal" automated inquiry for information versus an "attack." Do I commit computer trespass when I finger someone? Or do I have to try to telnet? Is attempting a telnet into a "guest" account OK if I just want to see if the machine's policy is to welcome visitors? Do they have to post "do not trespass" signs? If all.net's policy is really "nobody's allowed to telnet in," they why don't they just shutdown the damn telnetd, and be done with it? Or, if they want only "authorized" personnel, why not add sufficient crypto to secure the channel? Anyway, it makes for an interesting read.... **BEGIN FORWARDED MATERIAL** --------------------------------------------- Date: Wed, 13 Mar 1996 21:25:03 -0500 (EST) >From: Sick Puppy <sikpuppy(a)maestro.com> Subject: Re: IW Mailing List iw/960313 > [Moderator's Note: I believe that the federal computer abuse statutes > don't require a warning banner. If they did, than any denial of service > attack that ignored responses would be legal.] In our discussions with the FBI about how we could meet the legal requirements for a successful prosecution that would not be thrown out on technicalities, the need for a warning statement or warning banner was stressed by the FBI. I don't remember the specifics but the need to have a warning banner is related to the freedoms guaranteed by the US Constitution and its Amendments. The FBI mentioned a couple of prosecutions by the Secret Service where part of the case was thrown out and the whole case was significantly weakened, because there was no warning banner. I believe that CERT also covers this point in its annual conference/seminar for incident response teams. They usually get a FBI agent with experience in the rules of evidence to speak during the lunch breaks. Maybe there is someone on the list whose recollection on this point is more precise than mine. --------------------------------------------- Date: Wed, 13 Mar 1996 18:46:52 -0600 >From: Walt Auch <waltauch(a)hiwaay.net> Subject: Re: IW Mailing List iw/960313 Quote: [Moderator's Note: I believe that the federal computer abuse statutes don't require a warning banner. If they did, than any denial of service attack that ignored responses would be legal.] Unquote Banners are not REQUIRED, but DOJ has indicated in many conversations that they are "looked upon favorably" by the Court. You do NOT have to prove that they were read - much like you don't have to prove a speed limit sign was read in order to prove speeding - you should just be able to show it was posted. (Scott Charney is the DOJ person - not sure that should be posted.) --------------------------------------------- >From: fc (Fred Cohen) Subject: More progress Date: Wed, 13 Mar 1996 23:59:56 -0500 (EST) So far, we have traced down: A breakin at a community college in Pennsylnavia where the attacker rigged the University computer to automatically telnet to our site every 5 minutes. A port scan followed by a series of scores of attempts to telnet into our site for over an hour from a University site in Arizona. The attacker has been caught. Several IP spoofing attempts that we are tracing down to the specific dial-in accounts used to launch the attack. An intentional insider corruption of a Web page designed to turn innocent browsers into launchpads for their attack. This one was tracked down yesterday and has been stopped after recurrences by contacting this ISPs ISP and the FBI. A web site which is misleading people into telnetting into our site under the auspices of getting a letter from a self-proclaimed computer security expert. What appeared to be a systems administrator at a prominant university who did a port scan followed by numerous telnets. It now looks like this person may not have been authorized by the university to do any of this and it has been raised to another level in the University. Several other individuals have been tracked down as well. 19:52 > From: "Matthew G. Devost" <mdevost(a)chelsea.ios.com> ... > I am concerned over the all.net statement that it will pursue criminal > conspiracy charges against all those that telnet to their site. I asked > what sort of warning banner was in place and hadn't gotten a reply yet > so I checked to see. Well, there is NO warning banner. You simply get > a connection refused by foreign host (and I imagine, a email to root at > my ISP saying I am an evil hacker!). The message changed as incidents occured. Contrary to what previous postings indicated, we haven't historically claimed these events as attacks. We simply state that (current form): A user at your site has just attempted to telnet into our site. No users from your site are authorized to telnet into this site. We thought you would like to know so you could investigate further. If more telnets come from your site, this may indicate a more substantial attempted entry originating from your site, and should be followed up in more depth and more quickly. > Here is my point. It is obvious that someone (an individual) has a > gripe with you or just wants to target your machine, but I would not > call the other attempts a conspiracy. I could post the following > message to a cancer survivor newsgroup or list: At this point in time [see above] several different individuals have been identified as having intentionally attacked this site during the incident. About 5 individuals are responsible for over 90% of all of the attempted entries. > "Hello all! Just wanted you to know that I have set up a Cancer > Survivors network on my host machine. It requires telnet access > for now, but we are hoping to find an easier way to access the > computer in the near future. Please give it a try by telneting > to all.net." Excellent example. This would not be a criminal conspiracy unless some of the participants became accomplices after the fact by lying about the source of the message and actively creating their own similar messages. Then they would become co-conspirators. That's what appears to have happened here. ... > My point, and I realize I am taking a long time getting there, is that > at the very least you should provide a warning banner when folks telnet > to you site telling them that an unauthorized telnet attempt will be > considered an intrusion. We express this in our finger daemon: No users are allowed on this system In the case of telnet, we don't want people getting that far into our system because we believe that such mechanisms may be breakable by high volume attacks. We prefer to stop things at the earliest possible phase and to have layered defenses after that. --------------------------------------------- Subject: Re: IW Mailing List iw/960313 Date: Thu, 14 Mar 1996 10:02:56 -0500 >From: "Michael G. Reed" <reed(a)itd.nrl.navy.mil> |> Well congrats for sparking the list back to life! I think it is |> definitely an IW attack at the Class I level, but I would agree with |> most of the comments from the list that perhaps [all.net is] overreacting. Over reacting, no, inflaming the situation, yes. It is well within the rights of all.net to treat attempted telnets to their machine as attempted break-ins if the proper notification has been given; but personally, I think their handling of the situation is quite silly. One does not get up on a soap box and scream and shout to the world like this -- it just invites (no, begs) more attacks. Instead, you deal with it in the professional manner that system administrators have used for years -- contact other admins and deal with the problem directly. The big problem is *ARE YOU SURE* you have the right people? IP spoofing is trivial these days (a problem that won't be solved until IPv6, if even then) and it would be very easy to mount a concerted attack that *NO ONE* would be able to track down unless you start looking at backbone router logs (which I seriously doubt are being generated or kept) or placing sniffers all over the Internet. [Moderator's Note: Apparently all.net has this well covered because of their previous efforts in automated vulnerability testing.] ... Actually, there are both CERT and DoD bulletins on appropriate warning banners. These banners should (ideally) be displayed *PRIOR* to login (ie, before the login prompt), but most OS's today don't allow for this and as such the banners are normally displayed in the motd. For us (DoD/USN), the message is as follows (at least this is what is showing up on all of our machines): * * * WARNING! * * * This is a U.S. Government/Department of the Navy Automated Information System. This system may be used only for unclassified official business. Unauthorized use of this system is prohibited by Title 18, Section 1030, United States Code. Department of the Navy Automated Information Systems and related equipment are intended for the communication, processing and storage of U.S. Government information, and are subject to monitoring to ensure proper functioning, to protect against improper or unauthorized use or access, to verify the presence or performance of applicable security features or procedures, and for other like purposes. Such monitoring may result in the acquisition, recording, and analysis of all data being communicated, transmitted, processed or stored in this system by a user. If monitoring reveals evidence of possible criminal activity, such evidence may be provided to law enforcement personnel. * * * USE OF THIS SYSTEM CONSTITUTES CONSENT TO SUCH MONITORING. * * * Send questions and/or problem reports to root(a)foobar.mil |> Let me first start by saying that a telnet attempt is the first and most |> obvious step in any electronic intrusion. ... |> Telnet's only purpose is to establish access. I think this is stretching the law a bit. Let me give you an analogy: Suppose I walk up to a military installation. At the gate they will ask me for my pass, but I don't have one on me. Now, as long as I do not attempt to enter, and leave the grounds at that point, have I done anything wrong? Is my attempt to "break in" illegal? I would contend no. Now, if I had been trying to scale the fence at the time I was detected, that is a COMPLETELY different story, but by following normal protocol I am within my rights. This doesn't preclude handling denial-of-service attacks either. If I continually walk up to the military installation and ask for entry without the proper pass, then I am *POSSIBLY* breaking the law (disturbing the peace or harassment at the minimum) or if there are big signs (which I ignore) stating that unauthorized attempts to enter will result in prosecution, then I *AM* breaking the law. |> As for alerting an administrator, it is extremely likely that a person |> trying to get into one system also tries to get into dozens of others. ... Yes, this is what all system administrators should do. I am not saying that systems should hide the fact that they are (or have been) attacked, but that they should handle it professionally and not throw a tantrum (I'm sorry, but that's what all.net's message looks like to me -- a tantrum -- my personal take on reading it). Security on the Internet is a *MAJOR* problem today, the problem is that few people realize this (or to what extent it is a problem). The one good thing coming out of all of all.net's attention to this "attack" is the quality discussions about security, the handling of threats, and what should be done in the future. [Moderator's Note: The all.net banner is shown above.] --------------------------------------------- Date: Thu, 14 Mar 1996 10:24:03 -0800 (PST) >From: watson(a)tds.com Subject: Re: hackers and the law >[Moderator's Note: I believe that the federal computer abuse statutes >don't require a warning banner. If they did, than any denial of service >attack that ignored responses would be legal.] There was a CERT or CIAC about late 1992, and a sidebar in Cheswick and Bellovin that summarizes the fuzzy state of this assertion. Apparently, the attackee has some risk of prosecution under wiretap laws if actions are taken against an attacker without proper notice. The warning banner is considered necessary defense against the attacker's lawyers when he claims he was "just knocking on the door." I haven't heard of a clear precedent on this. Probably varies by jurisdiction, phase of the moon, etc. I would encourage those who post on this topic to state their legal credentials. [Moderator's Note: I'll bite - what are your legal credentials?] --------------------------------------------- **END FORWARDED MATERIAL** ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

2 1

http://anarchy-online.dementia.org/book/
by Declan McCullagh 17 Dec '03

17 Dec '03

[I'm not associated with this book except that I helped HTMLize it. -Declan] For Immediate Release ------------------------------------------------------------- A New Book Investigating Sex on the Internet is Pre-Published, Free, via the World Wide Web ------------------------------------------------------------- While the fate of online freedoms is being determined by federal judges in Philadelphia, a contributing writer to Wired magazine has decided to give away his investigative book on the subject. Charles Platt spent six months gathering data about netporn for a book to be published later this year by HarperCollins. According to Platt, "My publishers hoped to rush the book into print. When their plans changed as a result of factors outside my control, I decided the material was so topical and so important, it should be placed freely on web sites." Titled ANARCHY ONLINE, the book is divided into two parts. The first deals with net crimes such as hacking, viruses, and data piracy. Platt includes first-hand descriptions of hackers and pirates and debunks myths created by melodramatic press coverage. Part Two of the book explores free speech online and examines netporn more frankly and in greater depth than has been achieved elsewhere. Platt concludes that although a genuine problem does exist, a "war on porn" will be as unwinnable, expensive, and divisive as the "war on drugs." Part Two of the book contains about 65,000 words and is being placed online in its entirety. It includes transcripts from pornographic IRC chat sessions and sexually oriented Usenet news groups; a look at pedophilia on America Online; a new, damning investigation of Martin Rimm (whose porn study was immortalized in Time magazine); and a reassessment of issues raised by Jake Baker (who faced years in jail after he placed sadistic stories on Usenet). Platt also examines federal attempts to control encryption; the Guardian Angels; anonymous remailers; repressive laws at the state level; content-filtering software; and content rating schemes. There are exclusive interviews with Scott Charney at the Department of Justice, Ann Beeson of ACLU, Louis Rossetto and Kevin Kelly of Wired magazine, anti-child-porn crusader Barry Crimmins, David Chaum of DigiCash, and Phil Zimmermann, creator of PGP. Many other industry figures and commentators make cameo appearances. Platt concludes that net fears have been exaggerated and demands for censorship are unwarranted. "Most people who want to censor the net don't use it and are willfully ignorant of it. They tend to be religious extremists and opportunistic legislators looking for a hot-button issue. I question their right to inflict laws on a community that they don't live in and know nothing about." Platt feels that if widely available methods are used to control access by children, the net can be safer than a day- care center. "My daughter started net surfing when she was 15. Even if children have totally unrestricted access, the net is still more benign than most real-world environments. I believe this is thoroughly substantiated by my book." ANARCHY ONLINE is freely available at http://anarchy-online.dementia.org/book/ Charles Platt is the author of 40 books, ranging from computer guides to science fiction. His novel PROTEKTOR was published this year by Avon Books. He is a contributing writer to Wired magazine and has an article on net censorship in the current issue, dated April. Platt can be contacted at (212) 929 3983 or via email at cp(a)panix.com. -------------------------------------------------------------

2 1

Re: Kid Gloves or Megaphones
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"stewarts(a)ix.netcom.com" "Bill Stewart" 16-MAR-1996 01:55:32.07 >Depending on the details of Ian's method, I don't think the debate >needs to be taken to the public, or even done - it may simply be a >done deal once the technology's out there. If Mark Twain Bank or >Merita Bank or the Federal <Exonive-Deleted> Reserve wants to offer Digicash(tm) with Payee-Non-Anonymity, they can always make it a contractual >requirement that their payees not use anonymity techniques in return for >being paid. Wouldn't the viability of such a clause depend on the anonymizing scheme in question? If the bank's cooperation isn't needed (i.e., going through a proxy), then such a limit would be empty. -Allen

1 0

Re: [NOISE] Re: Dorothy Denning attacks Leahy's crypto bill
by jim bell 17 Dec '03

17 Dec '03

At 03:35 PM 3/20/96 -0500, Perry E. Metzger wrote: > >Alan Bostick writes: >> Declan McCullagh <declan(a)well.com> wrote: >> >> > I may have to adjust my position on Leahy's bill. Any legislation that >> > Dorothy Denning attacks so virulently must be worth passing. >> >> That could be exactly what They want you to think! > >Oh, God. This is really a bit too much, don't you think? > >I mean, its obvious that, whatever its flaws, passage of the Leahy >bill would be very bad for the export control droids. I disagree, strongly. "Export controls" are worthless against the major characters they CLAIM they are intended to be directed at: "Terrorists, drug dealers, pornographers, etc." They'll get good crypto regardless, either from foreign sources or "illegal" export that happens anyway. The main attraction of export controls (to the govt) is that if they had been played "well," the government might have been able to foist some sort of Clipper-system on us indirectly, by building up a domestic market for crypto that is designed to be incompatible with the rest of the world, because nobody would buy the exports anyway. It didn't work, of course, but the Feds are still flailing away, trying to control the situation. In addition, the government really has no choice but to relax export controls, because of industry pressure. The result, I think, is that the Leahy bill does little or nothing for us that wouldn't otherwise happen in the next year. If that's the case, we win nothing and we compromise away our rights. > Has it occurred to you that the whole thing might not be a conspiracy and that the >flaws in the bill might just be that -- flaws? >Perry This theory is easily testable. As I suggested a LONG time ago (gee, it must be at least a week now!) let's have a go at re-writing the bill to delete all the bad parts, modify it to be good, add appropriate extras to nail down everything, and present it to Leahy as the minimum acceptable bill. If those are just "flaws" then Leahy should have no trouble with any of this. If, on the other hand, it's all a fraud, we'll encounter fierce resistance. What do you think will happen? Jim Bell jimbell(a)pacifier.com

2 1