December 2003 - cypherpunks-legacy

Chaff in the Channel (Stealth PGP work)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:32 PM 2/29/96, Bruce Zambini wrote: >Well, that's what I want to avoid; I think the issue is that as long as >stego is predictable, there's a problem, ie a message to a certain party >can be shown to exist, even if it's not readable. This might prove more >than ample evidence in certain circumstances. > >You shouldn't be able to recover the stego'd message without special >knowledge. This isn't addressed by current software, to my knowledge. Sorry if I haven't been following the latest "stego" messages too closely. If it is desired that an image, say, carry a steganographic message that is "undetectable" to adversaries, then much more than just stripping off the PGP markers (headers, identifying bits, whatever) must be done: the LSB bit plane, if this is the stego channel, must have statistics which are indistinguishable from "normal" LSB bit planes of images. (Not an easy thing to define or to implement, but there you go.) So, when the Khmer Rouge People's Enforcement Division looks at the image they have confiscated from your computer and examines the LSB bit plane for evidence of human rights files encrypted steganographically, that bit plane had better not have unusual statistics...it had better not look "too" random, as real life LSB randomness may not have nearly the entropy of PGP randomness, say. What can be done? One emergent standard could be to the following: - when images are sent, or stored, replace the true LSB bit plane (I say "true" to distinguish the actual "grey levels" of one or more of the color bit planes from RGB encodings in which the nominal LSB is not at all the minimum brightness changes) with a "PGP chaff image." - this PGP chaff image could be randomly generated, or chosen from a library, or (surprise, surprise) actually be an encoded message. - the point is that some percentage of all images would have this chaff present, so that mere possession of an image with the offending statistics would not ipso facto be proof of possession of an encrypted/stegoized message. (Of course, the Khmer Rouge People's Enforcement Division might simply kill you anyway, but then they might kill you for merely having a computer. One would hope that Reno's Raiders would not do likewise, and that the existence of multiple images with "chaff" image planes would be sufficient to confuse things.) - the adversary may know you have an image with a chaff plane, but he doesn't know that you actually know how to decode that chaff, that that chaff is not chaff to you. [How is this any different from simply sending chaff messages conventionally, without using steganography? Why not use the full bandwidth? Answer: Stego provides some plausible deniability, more important in court cases in the U.S. than to the Khmer Rouge, of course. Having random messages filling up one's hard disk is suspicious, but having images of the Mona Lisa which _may_ contain stego bits and which _may_ be readable by the owner is considerably less suspicion-arousing.] This is my take on fixing the stego situation. Instead of worrying about a "stealth PGP version," which is likely to be only a slight speed bump (because of the statistics), think about flooding the detection channels. Longterm, however, I certainly think that cryptographic messages can be made virtually indistinguishable from low-order bit noise. (I have argued this since the late 1980s, so I'm not changing my views now.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: rhetorical trickery
by jim bell 17 Dec '03

17 Dec '03

At 09:15 PM 3/9/96 +0000, Deranged Mutant wrote: >"Vladimir Z. Nuri" <vznuri(a)netcom.com> wrote: > >> >> but I have a question: how did they know it was his diary? >> > >> >If I remember some earlier discussion about that case from a few years >> >ago, the file was called "diary.pgp". >> >> how did they know it was *his* diary? > >Well, nobody *knows*. But if you've got a file called diary.pgp on >your hard drive, chances are it's a diary of some sort. It's a >reasonable guess. Or it's the list of local dairies, and the guy can't spel.... Jim Bell jimbell(a)pacifier.com

1 0

Re: Vexatious Litigants (was: SurfWatch)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"janzen(a)idacom.hp.com" "Martin Janzen" 9-MAR-1996 09:48:42.59 >ObCrypto, sort of: What if the page were retrieved through an HTTP >proxy which, unbeknownst to the author (and the filtering service/SW), >deliberately removes or alters the PICS-Label or other rating >information? The author did, after all, _provide_ the "undesirable" >material.... To what extent does the author's intent matter? Must Web >authors now add a digital signature to each page (including its rating >info), to prevent tampering? Good idea, and one that I should have remembered thinking of before with my comments on a "rating-searching" search engine. If it's providing web proxying on such links, including removal of potentially-exclusive ratings would be a good idea. (Running the system on a secure server would also be a good idea). -Allen

1 0

Re: Leslie Fish address?
by Simon Spero 17 Dec '03

17 Dec '03

On Sun, 3 Mar 1996, Marianne Mueller wrote: > That's a wonderful notion - I think a Zappa tune would fit - > > (Pretty Good Music, the CD...) .. "RSA can you see, By the DN's early light" .. "People try to put us down Modular Exponentiation" .. "Well we squared the accum And halved the exponent And people could see I was a proponent of Big Nums Big Bad Nums" ... --- They say in online country So which side are you on boys There is no middle way Which side are you on You'll either be a Usenet man Which side are you on boys Or a thug for the CDA Which side are you on? National Union of Computer Operatives; Hackers, local 37 APL-CPIO

1 0

No Subject
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Date: Fri, 1 Mar 1996 10:26:14 -0800 (PST) Errors-To: gklein(a)willamette.edu Reply-To: cda96-l(a)willamette.edu Originator: cda96-l(a)willamette.edu Sender: cda96-l(a)willamette.edu Precedence: bulk From: Peter Saint James <peterstj(a)ix.netcom.com> To: Multiple recipients of list <cda96-l(a)willamette.edu> Subject: Fwd: Freedom to Read Week (CA) and "Black Thursday" WWW page X-Listprocessor-Version: 6.0c -- ListProcessor by Anastasios Kotsikonas This appeared on another list I'm on. Besides giving you a view of a (bad) future, it is an example of an HTTP proxy which could also be used for anonymous browsing. - Bill > ELECTRONIC FRONTIER CANADA (EFC) --- PRESS RELEASE > >(For immediate release --- February 27, 1996) > > > "Freedom to Read" in Cyberspace > > A few members of Electronic Frontier Canada have > developed an amusing and interactive Web page > to celebrate 'Freedom to Read Week'. > >The Internet, some people say, is out of control and in need >of strict government regulation. But just what might a censored >Internet look like? > >One possible answer to that question is given by the "Black Thursday Machine", >an interactive Web page that was the brainchild of three multimedia designers: >Brian Hall, Andrew Chak, and Rob Stanley. Stanley is also a member of the >online civil-liberties organization Electronic Frontier Canada. > >"Black Thursday Machine" Web pages: http://www.vex.net/~brian/Censored > http://www.hyperactive.net/censored > >The "Black Thursday Machine" invites Internet surfers who visit the site >to type in the address of their favourite Web page, to see what it might >look like if a Canadian version of the new and controversial American >"Communications Decency Act" were put into effect. > >The "Black Thursday Machine" will fetch any page you request, but it >presents you with a censored version. The algorithm it uses is simple >and unsophisticated -- but these are the same kinds of rules recently >used by America Online and CompuServe when they blocked access to >discussions including the words "gay", "sex", or "breasts". > >"Any naughty word is replaced by the word 'CENSORED' in bright red," >says Rob Stanley, who was the chief programmer. Which words are on >the forbidden list? "It works just like government censorship," >says Stanley, "you don't get to choose. It's an arbitrary process." > >The Web site has links to a few representative examples, including pages >about "Breast Feeding", "Safe Sex", "Planned Parenthood", and help for >troubled "Gay Youth", that are rendered almost unintelligible by the >crude censorship. > >"Despite well-intentioned desires to protect children," >says Jeffrey Shallit, vice-president of Electronic Frontier Canada, >"adults need to be able to communicate freely about controversial issues. >Otherwise, we'll reduce the level of discussion on the Net to >Winnie-the-Pooh." Paraphrasing a U.S. Supreme Court Justice, >Shallit said that censoring the net to protect children is >like "burning down your house in order to roast a pig". > >"The 'Black Thursday Machine' demonstrates the ravages of censorship >in an amusing and provocative manner", says David Jones, president of EFC. >"I hope people will take a moment during 'Freedom to Read Week' to visit >the web site because it illustrates what the wired world might look like >if artistic expression, vigourous debate, and all the subtley of human >communication and interaction were subjected to the cold, calculating, >and heartless scrutiny of a machine that filters out what the government >might deem as controversial, offensive, or just plain inappropriate for >the eyes of its citizens." > > > * Why "Black Thursday" ? > >New and harsh restrictions on what can be communicated through American >computer networks were signed into law on Thursday, February 8th, 1996 >-- "Black Thursday". "This sent a shock wave through the Internet, >where concerned individuals around the world "Painted the Web Black" >for 48 hours as a sign of protest," says David Jones, EFC president. > > > * About "Freedom to Read Week" in Canada (February 26 to March 3) > >"The purpose of 'Freedom to Read Week'," says Sandra Bernstein, >"is to encourage Canadians to think about and reaffirm their commitment >to intellectual freedom, as guaranteed under the Charter of Rights and >Freedoms." Sandra Bernstein, also a member of Electronic Frontier Canada, >represents the Periodical Writers Association of Canada on the >Book and Periodical Council's Freedom of Expression Committee, >which sponsors 'Freedom to Read Week' each year. > >Bernstein also maintains an online "Chronicle" which documents challenges >to Freedom of Expression in Canada: > > http://www.efc.ca/pages/chronicle > >-30- > >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >EFC Contact Information: > > >Electronic Frontier Canada > > Dr. David Jones phone: (905) 525-9140 x24689 fax: (905) 546-9995 > email: djones(a)efc.ca > > Dr. Jeff Shallit phone: (519) 888-4804 fax: (519) 885-1208 > email: shallit(a)efc.ca > > Dr. Richard Rosenberg phone: (604) 822-4142 fax: (604) 822-5485 > email: rosen(a)efc.ca > > >Electronic Frontier Canada, online archives: > > URL: http://www.efc.ca/ > > >- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - >Other Contact Information: > >- - - - - > >Multimedia designers who dreamed up the "Black Thursday Machine": > > -- programming, engine development. >Rob Stanley, phone: (416) 928-9503 (home), (416) 960-8400 (work) > email: themaxx(a)io.org > > -- graphical look, interface, design, and copy >Andrew Chak, phone: (416) 469-4154 (home), (416) 448-2403 (work) > email: chak(a)magic.ca fax: (416) 469-0914 > > -- concept development, design >Brian Hall, phone: (416) 504-0908 (home), (416) 351-1040 (work) > email: brian(a)hyperactive.net, pager: (416) 337-3377 > >These fellows also dreamed up the award-winning "Canadianizer" >at the following URL: http://www.io.org/~themaxx/canada/can.html > >- - - - - > >Additional sponsors of the "Black Thursday Machine: > > >HyperActive NetMedia http://www.hyperactive.net >Vex.Net http://www.vex.net >Passport Online http://www.passport.ca > >- - - - - > >Further Contact Information for 'Freedom to Read Week' in general > > >Freedom to Read Week -- Web page URL: http://www.cycor.ca/pwac/freeweek.htm > >Freedom to Read Week -- Publicist, Sarah Thring >phone: (416) 480-2533, fax: (416) 480-2434. > >Sandra Bernstein, phone: (416) 465-0798 >email: sandrab(a)inforamp.net, URL: http://www.inforamp.net/~sandrab/home.htm > >Book and Periodical Council, 35 Spadina Road Toronto, ON Canada M5R 2S9 >email: bkper(a)interlog.com >phone: (416) 975 9366, fax: (416) 975 1839 > >Periodical Writers Assoc. of Canada, 54 Wolseley St, 2nd Floor, Toronto M5T 1A5 >email: pwac(a)cycor.ca URL: http://www.cycor.ca/PWAC/Words.htm >phone: (416) 504-1645, fax: (416) 703-0059

1 0

Re: If yer a fan of Matt Meow Meow Bruce, Pee Pee Herman, Rush Limbaugh, Grillo, Mark Staloff, Charles Nelson Reilly, Meg Tilly, Naomi Judd, Larry Storch, O. J. Simpson, Liberace, Judy Garland, or George Kirby, you won't want to miss this!
by uunet!in1.uu.net!gwu.edu!dazed＠warwick.com 17 Dec '03

17 Dec '03

: If it is some college prank, I think that the people responsible should : make an apology to Dr. Alan Keyes, who is a candidate for the presidency : of the United states and a rare vioce of sanity in a world of braying : jackasses like Slick Willie Clinton and his boss. I say impeach them both : and kick wiesenheimers like the idiot who started this thread into jail : where they belong and let them work for a living. Uh...this seems to be x-posted to my group as well...but I couldn't let this slip by... Alan Keyes associated with sanity?!?!?? Bwahahahahahahahahahahhahahahahahahahahahaahhahahahahahahahaha Please, a theocratic moron who thinks we should all live in accordance with his little monotone view of the world? You may now return to your normal lives. ------------------------------------------------------------------------- John Nowicki (dazed(a)gwis2.circ.gwu) : "There's one way to find out if a 1818 Kalorama N.W. #23 : man is honest- ask him. If he says Washington D.C. 20009 : yes, you know he is crooked"- GM ----------------------------------(7x1)----------------------------------

1 0

Re: Another Motivation for the CDA (Federal Sentencing Guid
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:33 PM 3/8/96 -0800, jamesd wrote: >Also he did not steal the pizza. He destroyed it in the course of >intimidating some kids who were eating pizza. > >In theory one would expect the law to have this unjust effect, >but in practice most of the poster boys that people give as >examples of the injustice of this law are folk that one would >like to see taken behind a barn and shot out of hand. The pizza guy was a thug, but twice as many third-strikers got their third strike for marijuana as for all violent crimes combined. I assume most of these had large quantities, possibly intended for sale, and a number of them had real crimes as their previous felonies rather than Prohibition-related offenses. But you can get legally serious quantities of marijuana by just growing a couple of plants. >Perhaps the prosecutors are exercising prosecutorial discretion? Not much - Government Radio said tonight that they're not allowed to plea-bargain third strike felonies down to misdemeanors. The LA public defender's office is absolutely swamped, partly because third-strike cases are supposed to get diligent support, and partly because they have to go to trial rather than plea-bargaining a guilty, which is less work. The county jails are also having serious crowding problems, because prospective third-strikers are being kept in them pending trial to avoid risk of flight, so non-third-strike jailees are getting out early (especially drug violators.) And the guys who just got busted for having fertilizer, diesel oil, and drugs on their farm had a whole three ounces of marijuana and personal-use quantities of crank. Maybe they were planning to blow up buildings rather than stumps; but the Feds are trying to paint them as max evil just to build up their case. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

2 1

Re: FCC & Internet phones
by Deranged Mutant 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> wrote: > The real complaint of the telephone companies seems to be not that the > calls are free, but that the 'whatevers' are not subject to the same > tariff regulation that they are. I'm sure it's because they want to be > able to lower their fees to the same level to compete. Quit sure. How can one compare the fees, though? You buy the software (or use a free version of similar software) and get an account with an ISP, and maybe an IRC-type network devoted to Internet phone. Telephone/conferencing over the 'net is different technology than standard telephone. How can they be compared? (The exception maybe if one can route an Internet phone call to regular phone switches.) I notice it's the small LD companies too. The biggies like AT&T and MCI are getting into the ISP business, so they probably don't feel threatened by it. ObCrypto: I don't know. I'm wondering how the FCC or DT Bill will affect the use of uch technologies, since it's pretty easy to plug in good crypto. Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: Petty Civil Disobedience
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:31 AM 3/9/96 -0500, Declan B. McCullagh wrote: > Perhaps we should put up our own protest web sites with one or two > explicit sexual images as real civil disobedience? Major problem here is that ten million horny geeks are likely to bring your server to its knees, but if one only has one image, and it is moderately small, say thirty thousand bytes, perhaps the flood would taper off eventually. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Re: Leahy's guillotine.
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:44 PM 3/9/96 -0500, Chris Townsend wrote: >> 2804. Unlawful use of encryption to obstruct justice >> Whoever willfully endeavors by means of encryption to obstruct, >> impede, or prevent the communication of information in furtherance >> to a felony which may be prosecuted in a court of the United States, >> to an investigative or law enforcement officer shall... >> >> >> I think we may reasonably assume that this section was very carefully >> written, and thus it may contain meanings (or avoid containing meanings) >> that only a careful reading will disclose. >> >> Contrary to some other sloppy interpretations that I've seen here recently >> from organizations that ought to know better, I see nothing in this section >> that limits the prosecution on this law to people who are actually >> participating in a crime. This distinction is vital. While the sentence >> is not diagrammed, it appears to be the INFORMATION which is in "furtherance >> to a felony," not the "obstructing" of that communication. The implication >> is that it is not necessary that a person know the exact information >> involved or be able to decrypt it; he needs only be deliberately using >> encryption to prevent the knowledge of what the information is about, or its >> routing. (As in an encrypted anonymous remailer, for instance.) > > >??? Your third sentence doesn't make any sense. Well, I'll separate it for closer review: >> While the sentence >> is not diagrammed, it appears to be the INFORMATION which is in "furtherance >> to a felony," not the "obstructing" of that communication. The problem is that the original sentence (in the proposed law) is ambiguous. But I think the most likely interpretation is that it is the "information" which is in "furtherance of a felony," and "obstructing the commmication" of that information is the crime they define. > While I agree with your >position, why would it *possibly* be a crime to interefere with felonious >communcations? The law is POORLY worded. Padgett Peterson noticed this yesterday, BTW, and commented on it on Cypherpunks. You've stumbled on the alternate meaning that he complained about. Realistically, however, I think we can probably agree that this meaning was not the one they intended; that's why for purposes of analysis I study the other meaning. > The lanuguage is lamentably unambiguous about the >fact that it is the obstruction and not the information that is >in furtherance of a felony... I think I disagree. What we need, however, is an "emergency-call English major" who could diagram the various possibilities for us and we could study them separately. There's plenty of ambiguity in this sentence; but I think that is absolutely intentional. >> Aside from this, it isn't clear what is meant by the phrase, "obstruct, >> impede, or prevent the communication of information in furtherance to a >> felony." An obvious problem is this: How will they know if the use of >> encryption actually had that effect? If it was UNsuccessful, then obviously >> that encryption did not prevent the government from obtaining information. >> If it was SUCCESSFUL, then how is the government to know that the >> communication in question was "in furtherance to a felony"? Even if they >> can prove the felony by other means, how can they show that the >> communication actually had anything to do with the crime? > >It is quite conceivable that an unsuccessful attempt to obstruct >justice might cause additional trouble, time, and expense to the >guys in the white hats. That depends on who you believe actually wears the white hats... > Note that the language does not distinguish >between successful and unsuccessful attempts...though you're right >that it seems that only unsuccessful attempts could be verified... >the rest is clouded by your assumption that the information, rather >than the obstruction, must be in furtherance of the crime... Well, I invite you to try to construct an interpretation of the sentence in as many ways as you can imagine. I think you'll discover that it is practically intended to mislead. >> Another problem: Encryption, per se, does not "prevent the communication of >> information." What it does, of course, is to prevent the UNDERSTANDING of >> that information. Do the writers of this bill intend to use this law to >> punish the LATTER effect, rather than the former? >> >> Further, how is the person to be charged to know if his use of encryption >> had the effect of "obstruct[ing], imped[ing], or prevent[ing] the >> communication of that information? If he encrypts a file to his hard disk, >> and he doesn't intentionally send the file to the cops, how is he supposed >> to anticipate that the use of encryption had this effect? As far as HE >> knows, it was simply his decision to not send the file to the cops; he can't >> be expected to know that they'll show up the next morning with a search >> warrant and take his computer, can he? Would his refusal to provide the >> decrypt key constitute a violation of this section? > >Probably. That's what the word "willful" is doing in there. Read >carefully: it's willful obstruction, not willful encryption... Justa sec... I think you've forgotten that merely running an anonymous encrypted remailer could be considered "willful obstruction." Now, if the communication wasn't "in furtherance to a felony" then it wouldn't be criminal (it would be a LEGAL "willful obstruction, right?) , but then again the operator wouldn't know that, would he? Which brings us to yet another ambiguity: The operator of an anonymous encrypted remailer wouldn't know that any given packet was "in furtherance of a felony" but he MIGHT be absolutely aware that any one of them COULD be! Does this rise to the level of violating the law? If not, why not? >I am not a lawyer, although I play one on the net. > >I agree with your position, but you're not reading as closely >as the enemy will... Who, in this case, is "the enemy"? As far as I can see, "the enemy" are the people who wrote this section of the bill. While it's been a few decades since I last diagrammed a sentence, I will start by putting parentheses around sections of this sentence to separate it into what I believe is its "intended" meaning. >> 2804. Unlawful use of encryption to obstruct justice >> Whoever willfully endeavors (by means of encryption) to (obstruct, >> impede, or prevent) the communication of (information in furtherance >> to a felony) (which may be prosecuted in a court of the United States), >> to an investigative or law enforcement officer shall... I challenge anyone to re-write this section to: 1. Achieve what he believes to be a "reasonable" result and 2. Avoids the criticisms that I've previously mentioned WRT this portion of the bill. Also, I think anyone who supports this kind of section should be able to give me a few examples of crimes whose investigation has (or could be) thwarted in a way that would violate this section. I've said it before and I'll say it again: The average citizen is essentially never the victim of a crime of this type. For whom, then, is this law written? I think it's written for the benefit of the politicians alone. They want to live. Jim Bell jimbell(a)pacifier.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUJryfqHVDBboB2dAQEZ1wQAhDS3fEz1Q8QaoZCf3c6W6e5fCDbfsz4J 3smXEMg/28xGyiwMiUN1gUjbVOYZKNdczaAMzIKx3I53Reig+9DQnc5CTGHqigaV y1yeiKdV1XKaZk9vV0ZCaTQ31Gv2/GV45eOVKoZRQOtQI+W6AgnrsegLH4TRBxkk NzQv2kNN4Hc= =dBew -----END PGP SIGNATURE-----

1 0