December 2003 - cypherpunks-legacy

PLEASE REPLY!!
by uunet!in2.uu.net!gatech!newsfeed.internetmci.com!news.emeraldis.com!usenet＠warwick.com 17 Dec '03

17 Dec '03

Did this message make it out to the "real" world?? Please reply to this message if it did. Thankyou. *David*

4 3

Re: SurfWatch
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jsw(a)netscape.com" "Jeff Weinstein" 9-MAR-1996 04:41:47.02 > I predict that 6 months after the first internet rating system is widely >deployed, the largest use of search engines such as altavista will be to >look for pages with the most "naughty" ratings. Perhaps such services will >allow text searches for free, but charge for searches based on the rating >tag... Unfortunately, AltaVista doesn't index based on comments field (in which category the SafeSurf ratings fall). Opentext, given that one supposedly can search for links to a page, may be able to do it on the other hand. Putting together a web spider that would search for such could be a profitable undertaking. I did some checking on AltaVista and found one service by the name of "Naughty Lynx" which automatically checks all of its links every hour or so - one problem with "adult-oriented" sites is that they disappear a lot. Some such feature would probably be necessary. Seems to be a good potential use of the DigiCash system, since one doesn't need merchant anonymnity that much until someone comes up with anonymous-location web pages; the Naughty Lynx system appears to support itself via advertising). Combining this with a web proxy would also be good. -Allen

8 8

Re: Another Motivation for the CDA (Federal Sentencing Guid
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 2:32 AM 3/8/96, Deranged Mutant wrote: >That aside, in running trials and in many other little things both >federal and non-federal judges have too much leeway in deciding what >evidence can be admitted, in some of the sentencing details and in >various forms of punishment and restitution, etc. > >But yes, you made a good reminder point about mandatory sentencing. I saw a report on CNN Thursday that a new study (done by some law industry body, I didn't note which) indicated that California's "Three Strikes and You're Out" sentencing law is having this effect: 85% of all of the felons sent away for 25-years-to-life were sent away in cases where there 3rd strike was for a drug deal, petty theft, etc. One guy featured had never committed any violent acts, and his 3rd strike was for lifing a pizza. Now I am generally for harsh punishment for true crimes (murder, rape, and even robbery), but many of the "felonies" are not in this class. Many are drug-related (you all have heard the many horror stories about 19-year-old Deadheads sentenced to 15 years for having blotter acid at Dead concerts). The relevance to this list, and to the CDA? The felonies the CDA defines are just that: felonies. Not misdemeanors. While sentencing guidelines have not been issued--a point Brian Davis reminded me of in a private communication--it is likely under California law that these felonies will count toward the "Three Strikes" sentencing. These fuckers in Congress are full of shit. There, I could be prosecuted under the CDA for "manifestly indecent" language, made available to minors (several high school students have identified themselves as being on the list, so it is highly likely minors are on the list at any given time). It's unlikely that mere indecent language would ever be prosecuted, but the CDA says it can be. I'd better not fuck up a third time....whoops. Oh shit. "25-years-to-life." Welcome once again to Amerika. --Tim May, a felon Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Chaff in the Channel (Stealth PGP work)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:32 PM 2/29/96, Bruce Zambini wrote: >Well, that's what I want to avoid; I think the issue is that as long as >stego is predictable, there's a problem, ie a message to a certain party >can be shown to exist, even if it's not readable. This might prove more >than ample evidence in certain circumstances. > >You shouldn't be able to recover the stego'd message without special >knowledge. This isn't addressed by current software, to my knowledge. Sorry if I haven't been following the latest "stego" messages too closely. If it is desired that an image, say, carry a steganographic message that is "undetectable" to adversaries, then much more than just stripping off the PGP markers (headers, identifying bits, whatever) must be done: the LSB bit plane, if this is the stego channel, must have statistics which are indistinguishable from "normal" LSB bit planes of images. (Not an easy thing to define or to implement, but there you go.) So, when the Khmer Rouge People's Enforcement Division looks at the image they have confiscated from your computer and examines the LSB bit plane for evidence of human rights files encrypted steganographically, that bit plane had better not have unusual statistics...it had better not look "too" random, as real life LSB randomness may not have nearly the entropy of PGP randomness, say. What can be done? One emergent standard could be to the following: - when images are sent, or stored, replace the true LSB bit plane (I say "true" to distinguish the actual "grey levels" of one or more of the color bit planes from RGB encodings in which the nominal LSB is not at all the minimum brightness changes) with a "PGP chaff image." - this PGP chaff image could be randomly generated, or chosen from a library, or (surprise, surprise) actually be an encoded message. - the point is that some percentage of all images would have this chaff present, so that mere possession of an image with the offending statistics would not ipso facto be proof of possession of an encrypted/stegoized message. (Of course, the Khmer Rouge People's Enforcement Division might simply kill you anyway, but then they might kill you for merely having a computer. One would hope that Reno's Raiders would not do likewise, and that the existence of multiple images with "chaff" image planes would be sufficient to confuse things.) - the adversary may know you have an image with a chaff plane, but he doesn't know that you actually know how to decode that chaff, that that chaff is not chaff to you. [How is this any different from simply sending chaff messages conventionally, without using steganography? Why not use the full bandwidth? Answer: Stego provides some plausible deniability, more important in court cases in the U.S. than to the Khmer Rouge, of course. Having random messages filling up one's hard disk is suspicious, but having images of the Mona Lisa which _may_ contain stego bits and which _may_ be readable by the owner is considerably less suspicion-arousing.] This is my take on fixing the stego situation. Instead of worrying about a "stealth PGP version," which is likely to be only a slight speed bump (because of the statistics), think about flooding the detection channels. Longterm, however, I certainly think that cryptographic messages can be made virtually indistinguishable from low-order bit noise. (I have argued this since the late 1980s, so I'm not changing my views now.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Vexatious Litigants (was: SurfWatch)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:11 AM 3/8/96, Bill Frantz wrote: >I agree fully so far. However, when your TimWatch software takes action >based on your opinions, you may have crossed the line between speech and >action. Since you made the decision, rather than just provided an opinion, >you might, in our current legal climate, have caused a tort. So, when someone downloads the Siskel and Ebert list of thumbs up/thumbs down ratings, and then "lets the software decide" which movies to see, a tort has possibly occurred? I don't buy it. SurfWatch is just a ratings service. They aren't coercing people to use it. >It would be interesting to see if a HIV positive teen could sue SurfWatch >because it blocked him from getting information on safe sex. Presumably the owners of the machine he is using--maybe his parents, maybe his Catholic school, maybe his company--installed the SurfWatch or similar program and programmed the ratings. The teen should look to them. (Not that matters, but I really dislike using AIDS education as an example. Any person who claims to not know about AIDS prevention probably is either uneducable or doesn't want to know. A Web site isn't going to make a difference. I'm not arguing for censorship, nor would I ever install SurfWatch in my home, just saying that the hype about AIDS education is a hot button being used by arguers of all stripes to push their policy agendas. More heat than light.) >IMO our society has tilted too far away from caveat emptor toward "it's >someone else's fault". People who let a machine censor their data deserve >what they get. Parents who consistantly hide reality from their children, >instead of helping them learn how to deal with it, are crippling their >children. Well, they're my children to educate as I see fit. I view religions as more crippling than denying a child access to "The Gay Men's Safe Sex Site," but, fortunately, I cannot interfere with the upbringings others give their children. We may dislike the "programming choices" that the current instance of SurfWatch provides, but the solution is _competing_ ratings services, not talk of suing SurfWatch on the basis that it creates a tort, or denies children access to proper exposure to Gay Sex Lifestyles. Let a thousand ratings systems, including the No Rating System, bloom. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Signature 2
by mccoy＠communities.com 17 Dec '03

17 Dec '03

>Hi, > >> Assumption 1 : a privacy key can become uncrackable. >> Assumption 2 : an individual signature can become immune to fraud. >> Posit : fuse the two together so that pseudonyms/aliases/online names ensure >> complete privacy, but ensure that you talk to the same person >> everytime. >> Probably proposed already. > >Unforutnately both of your assumptions are wrong. A key cannot be >100% uncrackable, and a signature cannot be 100% immune to fraud. >With electronic security, there is always a chance that a key can be >cracked or a signature forged. The question is how hard is it to >crack the key or forge the signature? You need to balance the >security with the price. Derek is correct in that your use of the words "uncrackable" and "immune to fraud" were a bit over the top (in recent years everyone in the security and crypto community has become very nervous whenever anyone says things like this; they are usually trying to sell you something which is neither.) OTOH, he might want to temper his statement with a reference to fail-stop signatures... Just because someone with a lot of computational resources can produce a private key which matches your public key does not necessarily mean that they are the same ones that you generated, only that they found a set which work for the particular modulus which was chosen... In the "real world" there is nothing to prevent someone from forging your real signature on a check or document or from disguising themselves as you and taking your place at an important business meeting. The digital equivalents can be slightly more secure, but nothing is ever perfect. jim

2 1

OK, just to incite the rabid...
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

Subj: Re: new "obscenity" law on the net inc si jnz 0166 dec bx Remember my Christmas Card ? Warmly, Padgett

1 0

SLE_aze
by jya＠pipeline.com 17 Dec '03

17 Dec '03

3-8-96. FT: "Asean forum to fight Internet sleaze." The Association of South-East Asian Nations agreed yesterday to censor "negative elements" of the Internet. Information ministers are concerned about "information contamination" and agreed on the need for regulation and to learn from each other's experience, particularly from Singapore. 3-6-96. WSJ: "Singapore Unveils Sweeping Measures To Control Words, Images on Internet." Singapore said it will concentrate on individuals or organizations putting content on the Internet and the country's three access providers. Only public forums, or electronic spaces where people can converse or create displays visible to others who journey there, will fall under the regulations. 3-8-96. TWP: "FBI Advertises for Tips On Spies From Vietnam." FBI officials said the advertisements were prompted by an increase in activity by Vietnam's intelligence agents impersonating relatives of Vietnamese Americans to sneak into the country and steal high-technology secrets. SLE_aze (for 3)

2 1

Re: TCP/IP Stego (was CU-SeeMe)
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-03-08 03:39:00 EST, you write: > -It can be applied by two routers which are in the middle > of the connection. The two endpoints of the TCP/IP > connection would not even notice. For example, if I control > a router "upstream" of a major connection point and the > site I wish to communicate with is in a similar position > then I can run the subliminal channel in a "spread spectrum" > mode across many connections and the packets can get reset > to their original settings by the other site. The user > whose stream we fiddled with does not even know that they > were used as carrier wave... You seem to be oblivious to the fact that this technique is only useful for ISP's, corporate networks, etc. that the average home computer user will never have access to. If I want to send a WAV file of my 2 year old son saying "Hi, gramma" (or a 24-bit color TIFF of him practicing nose-picking techniques) to my relatives, that is not overtly suspicious behavior, even if it has a slight amount of background noise (or graininess). As long as I don't stego too many bits in the file, and I strip out any overt "I'm crypto" headers, it will be impossible to prove that stego techniques were used on a file. Finding random bits where random bits normally live cannot be used to prove anything.

1 0

Re: Looking for code to run an encrypted mailing list
by Powers Glenn 17 Dec '03

17 Dec '03

- > I'd like to run an encrypted mailing list contact colossus(a)colossus.net they've already hacked majordomo to do this. please mention gpowers(a)meaning.com sent you. yes, this is an ad. but, two people have already asked and i figured there might be more. glenn

1 0