December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:29 PM 3/11/96, jim bell wrote: >Welcome to prison, Tim. Your optimism will serve you well, there. > >BTW, it is clear that you haven't yet read Mr. Junger's analysis of the >bill. Nobody except a government stooge could read that and not wonder why >anybody would support that bill. A complete re-write is called for. A question, Jim: do you _ever_ just respond calmly to a post you disagree with, or is everyone you disaagree a stooge, a cretin, an agent for the Feds, or someone who should be disposed of with your "assassination politics"? Yes, I read Junger's analysis. A nice analysis. What does this have to do with the points I was making? I'm a government stooge, to use your terms, because of my points about hotel rooms? (On second thought, don't answer. In fact, I hope you take this opportunity to add me to your kill file, the computer version, not the Assassination Poltics (tm) version.)) --TCM Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: How's that again?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 11:37 PM 3/12/96 -0800, Bill Stewart wrote: > I guess it's no surprise that one of the more-or-less "good guys" > in the Senate can propose a law so ambiguously worded that it > looks good on the face until a good lawyer takes the time to rip > it apart Looking for "good guys" in Washington is like Ronald Reagan looking for "moderates" in Iran. On crypto, and on taxes, our interests and their their interests are completely opposed. We should not care about, or take any interest in, the slight difference between the "moderate" and extremist members of the Senate and the House of Representatives. The best bill we can ever hope to get out of Washington is no bill at all. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Why escrow? (was Re: How would Leahy bill affect crypto
by Deranged Mutant 17 Dec '03

17 Dec '03

On 13 Mar 96 at 9:41, jim bell wrote: > Notice, however, how the government seems to be assuming that "key escrow" > (to the extent that it is implemented at all!) gets implemented in a way > which is "friendly" to government agents. They assume that there is one key Since when is the government intentionally going to let any bill or policy go through that isn't friendly to themselves??? (You don't have to be an anarchist to figure that out!) [..] > Even the most limited planning could easily develop a system that achieves > all the benefits of escrow for the user, but is essentially impossible for > government agents (or for that matter, anyone else!) to use to the detriment > of the user. Nothing is safe from abuse, by the goverment or non-government fols alike. There's always more loopholes to clean up. (Not that this means we shouldn't clean them up... obviously bad policies should be fixed...). Just as no crypto is 100% foolproof, no legal system is 100% abuse-proof. Rob. --- Send a blank message with the subject "send pgp-key" (not in quotes) to <WlkngOwl(a)unix.asb.com> for a copy of my PGP key.

1 0

Re: Why escrow? (was Re: How would Leahy bill affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 06:25 PM 3/14/96 +0000, Deranged Mutant wrote: >On 14 Mar 96 at 12:00, jim bell wrote: > >> At 07:57 AM 3/14/96 +0000, Deranged Mutant wrote: >> >Would it be legal to deceive an escrow agent? >> >> It _should_ be legal. At least, assuming the arrangement is truly voluntary >> and the escrow agent gets his part of the bargain (his usual fee) he has no >> interest in knowing whether or not the data he's holding for you is "real" >> or "imaginary." > >I mean illegal in the sense that your true purpose is to decieve law >enforcement. (Yes, it'll also fake out anyone who bribes the escrow >agent for your keys, though....) As long as they claim that escrowing keys is "voluntary" in the first place, then I find it hard to imagine that they would have a legal claim against you if the key you "escrowed" was phony. OTOH, if one potentially-valid interpretation of the law is that failing to give the keys when you're asked is a crime, presumably even if you never had them in the first place, then all bets are off. IMO, a properly-designed crypto telephone keeps nothing with it that would later be useable to decrypt the conversations it has transmitted or received; one danger in this bill is that its very existence might make the manufacture of crypto phones with this characteristic illegal, on the theory that because they keep no keys, the user is going to be in violation of this law automatically. It's a stretch, but a stretch the government is always anxious to make. And if you recall the requirements the government wanted to put on telephones equipped with Clipper, one thing they eventually admitted was that they were insisting that such phones be designed to be inoperable with a telephone that had its "key-escrow" not "enabled". And they still wanted to call it "voluntary! That's a laugh! >Of course that depends how you give your key to an escrow agent. If >it's already escrowed when you buy a phone, for instance... That's the real danger with any such legislation. Individuals can generally only get things that are manufactured for sale. (You can't buy a car with a 7-cylinder engine, for instance...) If manufacturers are dissuaded from building a good crypto telephone, then key-escrow can be as "voluntary" as you want and you still won't be able to exercise your rights. Jim Bell jimbell(a)pacifier.com

1 0

Re: Why escrow? (was Re: How would Leahy bill affect crypto
by jim bell 17 Dec '03

17 Dec '03

At 07:30 PM 3/14/96 -0500, Yawn82(a)aol.com wrote: >How the hell do I get off this list? You can check out any time you want, but you can never leave.

1 0

Re: FCC-type Regulation of Cyberspace
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:26 PM 3/14/96 -0800, Timothy C. May wrote: >Mr. Frantz, unless you can prove your claims here, forthwith, I must inform >you that they are in violation of the Truth in Speech Act of 1996. Please >retract them, now. Political speech, not commercial speech. The act doesn't apply or is unconstitutional. >Do you see the problem? Of course. Why do you think I said (in the 4th paragraph which you didn't quote) (ZING :-) ): >In thinking back over the discussion, I would like to eliminate the >restrictions without making markets less free by adding yet more barriers >to market entry. We certainly need more robust reputation agencies than we >have now. I just don't know how to encourage their formation. BTW - I consider non-free markets, produced primarily by oligarchic combines of large organizations to be a major impediment to removing government influence from the economic system. Easing market entry is one way to reduce the power of these oligarchic combines. I don't want to just trade elected government oppression for unelected corporate oppression. To put it bluntly, to suppress the 19th century coal mining strikes, the companies hired the Pinkertons. I don't see a whole lot of difference between this kind of private enterprise transaction, and Ruby Ridge. Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Kid Gloves or Megaphones
by Hal 17 Dec '03

17 Dec '03

From: eric(a)remailer.net (Eric Hughes) > The situation is thus. Ian Goldberg et al. have developed a protocol > for simultaneous payer and payee anonymity. It appears to be novel, > albeit not entirely unanticipated. The protocol works with the > existing bank signing oracle and could interoperate with Mark Twain's > current system. > [...] > It is foolishness itself to deceive a public which is substantially in > favor of the program of complete privacy. We must appeal to the > public that finally will decide, not to some officials today who have > power and tomorrow who will not. Clipper itself was not defeated by > constructive engagement with the Clinton wiretap administration. > Clipper was defeated by a general call to arms. > > Therefore, shout out to the world that payee anonymity is possible with > ecash(TM)! As is well known, Chaum has been saying that one of the good features of ecash (from the point of view of regulators and law enforcement) is that payee anonymity is not supposed to be possible. This means that if someone sets up a shop to sell something illegally, they can be caught. (I suspect that is at least part of the reason why you have to fill out a multi page form to open an ecash account, so they have enough information to arrest you if you break the law.) It also means that various kinds of crimes would be prevented as well, such as theft of funds or extortion. Imagine that someone starts lobbing mailbombs at the cypherpunks list, and demands a payment of $1 a week from each subscriber to keep him from doing it, said payments to be posted to some newsgroup encrypted with a specified PGP key. Right now he could be caught when he tries to deposit his ill-gotten riches. But with payee anonymity that could be avoided. As a remailer operator I unfortunately see more of the seamy side of anonymity than most people. I do think there are people who will take advantage of this technology in harmful ways. So payee anonymity will certainly make life more interesting. However, Mark Twain Bank presumably went into this business with the expectation that they were providing a non-payee-anonymous payment system. They have already shut down at least a couple of merchants who were selling materials not to MTB's taste. So if they find out that they are now providing the perfect payment system for criminals, I would not be surprised to see them suspend the ecash trial and demand that Chaum redesign the system to truly make it non-anonymous for payees, if that is possible. So while I admire Eric's ethical concern about making relevant information about the properties of ecash available, it is also important to understand the possible outcome. One thing I notice that was missing from Eric's posting was a description or reference to exactly how the payee anonymity is achieved. Is it his intention to tell people that it is possible, yet to keep secret how it is done? This way there might be a debate about the desirability of full anonymity, while not actually putting these tools into the hands of those who would misuse them. And it might lessen the chance of precipitate action by MTB and other ecash issuers. But on the other hand it's not clear that keeping it secret is possible or desirable. A full discussion of the issue will require understanding of technical aspects. How effective is the payee anonymity? How about a timing/amount coincidence attack, where payments of X dollars to anonymous person A are always followed a few moments later by deposits of X dollars to account B? Does the payee need to trust a "broker" who serves as an intermediary with the bank? Is there any way the bank can distinguish a payee-anonymous deposit from a normal one, and are there any countermeasures the bank could take to prevent payee anonymity? These questions would seem to require understanding of how the scheme works. Also, there were a number of postings a few months ago by people who had ideas about how payee anonymity could be done. They mostly had drawbacks and may not be as nice as what Ian has come up with, but could perhaps serve as a starting point for re-creating something similar to Ian's ideas. So keeping it secret may not be a practical possibility. Hal

2 1

Re: PGP reveals the key ID of the recipient of encrypted msg
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

There is a way to beat this--generate new public keys on a frequent basis, and send them to whoever wants to send you absolutely anonymous mail in encrypted form. Have your anonymous partner do likewise. Since the key ID is fairly random, if it changes constantly, it will be irrelevant if it shows up in a message only once. Keep a separate (and temporary) key ring for these temporary public keys, so you can delete the key ring files when they start getting too large. Jonathan Wienke

1 0

Re: Beat Remote Monitor Snooping?
by jim bell 17 Dec '03

17 Dec '03

At 10:46 PM 3/13/96 -0500, Alan Horowitz wrote: >Visual contrast is not the same thing as frequency diffrence. It is quite >easy to measure extremely small changes of phase. As in, your >plain-vanilla FM receiver. However, that's not how SVGA CRT's do it. NTSC (TV video) modulation is done by phase modulation of the 3.579545 MHz subcarrier. SVGA has three different baseband analog signals feeding three electron beams. Even so, they still should be able to pick up SVGA with a little tinkering. > What's his name put this stuff together in the >mid 1930's. Ed Armstrong

1 0

Re: Leahy bill, legalize crypto
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:14 PM 3/13/96 -0800, Tim wrote: >One reason Washington pushed for the Wiretap Act (aka Digital Telephony) >was because digital switches have made conventional methods of wiretapping >and pen registers harder and harder to do. (I'm not a phone phreaker >expert, as some of you no doubt are, so I don't know the details of how >wiretaps were done prior to the advent of digital switches...I picture >wires connected to the back of PBX systems, and I presume the ESS systems >and their ilk changed this dramatically.) There are different places you can do your wiretap, depending on convenience, weather, observability, whether you've got a warrant, etc. ESSs don't really change the pair of wire coming from your house out to the telephone pole, over to your local wire center, and into the distribution system that eventually connects them to the switch. You've still got a pair of copper wires. On the other hand, underground wiring is harder to get at, and pair gain systems such as Subscriber Loop Carrier bring some of the multiplexing out to your block instead of all the way back to the phone office, and ESSs do make those more cost-effective. Connections from PBXs are also harder to tap than individual phone lines, since your phone call may be on any of the (probably virtual) circuits going from the PBX to the phone office. >The main way they blew it is that the Wiretap Act ostensibly does not cover >end-to-end encryption, especially as computers are used in place of >telephones. I don't think they blew it there, although the EFF's work against S.266 a few years back really hurt them. There are two ways to get oppressive laws enacted - wholesale, or bit by bit. A wholesale ban would have affected a lot of people, and had substantial constitutional difficulties. On the other hand, a mere regulation telling the already regulated telephone companies that they have to do a bit more free work in return for their monopoly status isn't a big constitutional stretch, and mainly annoys phone companies rather than end consumers. Also, it's far easier to enforce regulations on phone companies - there are bureaucrats in place to do it, you can kick them around in all sorts of ways if they don't cooperate, and it gets you most of your wiretapping and enforcement done wholesale rather than retail. (It's still major slime, of course :-) #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 pager 408-787-1281 # "At year's end, however, new government limits on Internet access threatened # to halt the growth of Internet use. [...] Government control of news media # generally continues to depend on self-censorship to regulate political and # social content, but the authorities also consistently penalize those who # exceed the permissable." - US government statement on China...

1 0