December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:12 AM 3/11/96, Gary Howland wrote: >Dan Weinstein writes: >> If I rent cars, someone might one day use a car rented from me in a >> robbery. Does that make my an accessary? NO. > >This is an unfair analogy. Now if you had said that you rented cars >without asking for proof of identification, thus making your car hire >centre very useful to robbers, that may more closely resemble the >anon-remailer situation. If a hotel rents a room to someone who commits a crime in that room, e.g., prostitution, drug use, plotting to blow up a building, can the hotel be seized under the asset forfeiture laws? Not that I have heard. Does it matter if the hotel fails to extensively check identification? (Hint: Rarely have I had my ID checked. Sometimes they ask for a driver's license and write down the number...and we all know how easy it is to get fake DLs. Mostly they don't.) If I lend my chain saw to my next-door neighbor without confirming his identity, and he carves up his wife, am I liable? Not in these parts. (If I lend my chain saw to a ranting, foaming maniac, am I liable? Perhaps.) If I let someone use my telephone without confirming his identity, am I liable for crimes committed with this phone? This last example is, I submit, a nearly perfect parallel to anonymous remailers. And not because the telephone system is a "common carrier," but because of scienter: I have no knowledge, and cannot be expected to have knowledge, of crimes committed with my phone. If I have visitors at my house, perhaps at a party, and I let a stranger go ahead and make a call from the phone in a bedroom, for example, and he plans a drug deal, can my house be automatically seized? Not that I have ever heard about. Maybe so, but if this ever happens, expect an outcry against the asset forfeiture laws that will make Linda Thompson's protest seem tame. Now if I operate a pay phone and encourage dealers and pimps to use it, then maybe the public nuisance, RICO, or "crack house" laws can be used to shut it down. (The public nuisance laws are what I would look to to see remailers shut down, which will just move them offshore, of course. Absent laws about sending encrypted packets outside the country, nothing can be done.) And, finally, packages and letters may be mailed anonymously. This is what pre-paid stamps are all about. And I've used non-U.S. Postal Service package delivery sytems without providing identification. Can Federal Express have their assets seized because of "anonymous remailing"? (Quibblers will no doubt cite laws requiring FedEx to "cooperate," demand ID, etc.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

noise levels
by Anonymous User 17 Dec '03

17 Dec '03

"Perry E. Metzger" <perry(a)piermont.com> wrote: > Noise levels have been rising fast again. I encourage people to think > about whether things are on topic before they post. > > Perry > > This message is generated as part of an ongoing effort to keep noise off of the Cypherpunks mailing list (cypherpunks(a)toad.com) Your message contains no cryptography content. Please do not post messages of this sort to the Cypherpunks mailiing list in the future. Thank you for your cooperation; it will ensure that further action will not be necessary. -- USENET POLICE DEPARTMENT "To serve and obey, and guard men from harm"

2 1

Please ignore testing Private Idaho
by Joseph Olson 17 Dec '03

17 Dec '03

Did I get through anonymously?

1 0

Re: How would Leahy bill affect crypto over HAM radio?
by jim bell 17 Dec '03

17 Dec '03

At 08:36 PM 3/10/96 +0000, Ed Carp wrote: >On Sun, 10 Mar 1996, David Lesher wrote: > >> > >> > Subject asks it. I'm not a HAM, but still curious. Wonder if anyone >> > has brought this to Leahy's attention... >> > >> > Comments from the packet folx on the list? >> >> Non-cleartext has been forbidden for last 60 years anyhow. > >Not quite. Anything intended to hide the meaning of the message is >banned. Compression isn't banned, because the intention is to make more >efficient use of the frequency, not to hide the meaning. >-- >Ed Carp, N7EKG Even so, it isn't clear that this new law WON'T change the rules under which hams operate. An affirmative statement of the right to use encryption would seem to pre-empt prior bans, except if there was some sort of explicit exception for over-the-air transmissions. After all, the law was written broadly, and presumably is to be interpreted broadly. It if doesn't list or single out any particular medium (text on paper; Internet; modem/telephone; etc) then it may reasonably be assumed to apply to all media. Not that such an interpretation will necessarily be welcomed by some hams: Part of the reason for maintaining the ban on encryption would be the fear by hams that ham bandwidth will be surreptiously used by commercial services masquerading as ham users. Encryption would make such usage difficult to detect. However, I happen to believe that hams should be entitled to use good encryption, for voice and data communication. Jim Bell, N7IJS jimbell(a)pacifier.com

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 2:25 3/11/96, savron(a)world-net.sct.fr wrote: >I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >that it gives out the key ID of an encrypted message . From this you >can get the identification of the recipient of the message , if it's >someone who has publicaly distributed his key (keyserver , homepage >...) . So even if you are unable to decode the message you can find >who is the recipient of a given message . I think this is a big >privacy problem . There is little that can be done about this. There must be something in the message to identify who it is intended to be read by. As someone else has stated, you can always set up private keys to be used to send to you that are different from your Public KeyID for cases where you want to hide your identity or that of the party you are communicating with. >The problem is carried along when you encrypt a message for multiple >recipients , you get the key IDs of all the recipients and same >problem as above . I think something like 'blind email copy' should >be used , because the recipients don't have to know the identity of >each other . If you want to hide the recipient list, then send separate messages to each recipient - each of which is only encrypted to that one respective recipient.

1 0

Re: Leahy bill nightmare scenario?
by jim bell 17 Dec '03

17 Dec '03

At 12:01 PM 3/11/96 -0800, Timothy C. May wrote: >At 11:12 AM 3/11/96, Gary Howland wrote: > >>Dan Weinstein writes: > >>> If I rent cars, someone might one day use a car rented from me in a >>> robbery. Does that make my an accessary? NO. >> >>This is an unfair analogy. Now if you had said that you rented cars >>without asking for proof of identification, thus making your car hire >>centre very useful to robbers, that may more closely resemble the >>anon-remailer situation. > >If a hotel rents a room to someone who commits a crime in that room, e.g., >prostitution, drug use, plotting to blow up a building, can the hotel be >seized under the asset forfeiture laws? >Not that I have heard. Your example is so misleading that it's wrong. Cities generally attack motels by threatening to pull their licenses, which is usually called an "administrative process" and thus few of the usual protections apply. >Does it matter if the hotel fails to extensively check identification? >(Hint: Rarely have I had my ID checked. Sometimes they ask for a driver's >license and write down the number...and we all know how easy it is to get >fake DLs. Mostly they don't.) They do if they've been harassed by the city, for example Portland Oregon to name the closest example I know. > >If I lend my chain saw to my next-door neighbor without confirming his >identity, and he carves up his wife, am I liable? Not in these parts. "Criminally", probably not. Civilly, probably if the victim's family has a good enough lawyer. >(If I lend my chain saw to a ranting, foaming maniac, am I liable? Perhaps.) Actually, then you're CRIMINALLY liable, as well. >If I let someone use my telephone without confirming his identity, am I >liable for crimes committed with this phone? >This last example is, I submit, a nearly perfect parallel to anonymous >remailers. And not because the telephone system is a "common carrier," but >because of scienter: I have no knowledge, and cannot be expected to have >knowledge, of crimes committed with my phone. Actually, that's wrong. The question will be asked, "Do you regularly lend your phone to strangers who you can't even see, no questions asked, without listening in to see that nothing untoward is being plotted?" _THAT's_ a more apt analogy. >If I have visitors at my house, perhaps at a party, and I let a stranger go >ahead and make a call from the phone in a bedroom, for example, and he >plans a drug deal, can my house be automatically seized? Not that I have >ever heard about. If your phone was already tapped, and the delivery occurred in your house, you'd better look for new accomodations. >Maybe so, but if this ever happens, expect an outcry >against the asset forfeiture laws that will make Linda Thompson's protest >seem tame. I prefer not to wait until the Pollyannas of this world have been proven wrong. >Now if I operate a pay phone and encourage dealers and pimps to use it, >then maybe the public nuisance, RICO, or "crack house" laws can be used to >shut it down. (The public nuisance laws are what I would look to to see >remailers shut down, which will just move them offshore, of course. Absent >laws about sending encrypted packets outside the country, nothing can be >done.) Justa sec: The Leahy bill makes "encryption furtherance of a felony" illegal. Sending encrypted packets out of the country, containing material you don't know (because they're encrypted) sounds like a classic opportunity to declare you in violation of some "conspiracy to violate the law" of some OTHER country, which is probably considered a Federal felony. Welcome to prison, Tim. Your optimism will serve you well, there. BTW, it is clear that you haven't yet read Mr. Junger's analysis of the bill. Nobody except a government stooge could read that and not wonder why anybody would support that bill. A complete re-write is called for. Jim Bell jimbell(a)pacifier.com

2 1

Noise levels
by Damaged Justice 17 Dec '03

17 Dec '03

Once again I'd like to remind everyone that I run a customized filtering service that drops off a single message in your inbox every day or two, consisting of what I deem to be the most entertaining and informative posts. I also remove any non-topical rants that don't include useful information. This way, your overworked mail filters will never again have to deal with the Perry and Tim show. To subscribe, send a polite message to the human behind this address. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

Mile High Snakeoil
by Andrew Loewenstern 17 Dec '03

17 Dec '03

I was flipping through a copy of Spirit, the official magazine of Southwest Airlines, while on a flight to Vegas and found a thoroughly enjoyable advertisement for a crypto product. Underlines and emphasis are theirs. ---- Begin Snake-Oil Advertisement ---- __UNBREAKABLE__ COMPUTER SECURITY AND PRIVACY AT A __BREAKTHROUGH__ LOW PRICE! Stonewall-Drawbridge - Encryption Sytem In the face of the increasingly dangerous invasion of professional, business and personal privacy, unbreakable computer security at an affordable cost is a must. Lawyers, Accountants, Doctors, other professionals whose stock in trade is confidential information are especially vulnerable to malpractice as a result of unprotected information. It is important to deal with this very real potetial problem before it becomes a problem. Every business, every individual must also be concerned about computer security. Encryption can now be used to secure everything from credit card numbers to legal documents. Encryption through totally unbreakable Stonewall-Drawbridge is your ultimate security blanket. *Available Only to United States Citizens* STONEWALL an unbreakable, streaming type algorithm, 100 to 10,000 times faster than other encryptions. Stonewall compresses prior to encryption, eliminating the possible invasion of your computer files. Its key cannot be broken except by random chance, once in a million years. Good for DOS; Windows 3-1; Windows 95 operating systems..... ......$195 DRAWBRIDGE applies mathematical algorithms to encrypt messages and uses a quasi-infinite, one-way transfer to ensure veracity. Drawbridge uses an Infinite Venegere Key (IVK), combined with a one-way private key transfer which is impossible to break, except by chance, once in a million years. It also incorporates a forge-proof digital signature for verification and authentication insuring absolute transmittal protection. STONEWALL-DRAWBRIDGE ENCRYPTION SYSTEM provides unbreakable security protection for your "need to protect" files, archives and computer to computer transmission. The Stonewall-Drawbridge System is the ultimate encryption system, unmatched by anything else available...at a price that is significantly lower than any competitive product. This means it is affordable for every professional, business or individual who needs and seeks total and unfailing computer security....especially on the Internet.......$295 (includes a second system for your choice of contact) (800) 610-0859 Mr. Thomas <order form deleted> (30 Day Money Back Guarantee) Make Checks Payable to: HWI 747 E. Green Street, Suite 300, Pasadena , CA 91101-2119 ---- End Snake-Oil Advertisement ---- andrew

3 2

Re: Leahy bill nightmare scenario?
by Gary Howland 17 Dec '03

17 Dec '03

Timothy C. May writes: >At 11:12 AM 3/11/96, Gary Howland wrote: >>Dan Weinstein writes: > >>> If I rent cars, someone might one day use a car rented from me in a >>> robbery. Does that make my an accessary? NO. >> >>This is an unfair analogy. Now if you had said that you rented cars >>without asking for proof of identification, thus making your car hire >>centre very useful to robbers, that may more closely resemble the >>anon-remailer situation. > >If a hotel rents a room to someone who commits a crime in that room, e.g., >prostitution, drug use, plotting to blow up a building, can the hotel be >seized under the asset forfeiture laws? I didn't initially use the the car-hire analogy, I was just trying to bring it more into line with the anon-remailer situation. Perhaps a better example would be an agency set up for the sole purpose of hiring cars on behalf of anonymous customers - as long as the customers didn't abuse the anonymous facility too much, then I guess they would be allowed to carry on operating, much like the remailers operate at present. However, I guess they're in for trouble when their service starts being abused at the expense of big brother, and I guess their policy of shredding all evidence at weekends won't help matters either. >If I let someone use my telephone without confirming his identity, am I >liable for crimes committed with this phone? > >This last example is, I submit, a nearly perfect parallel to anonymous >remailers. And not because the telephone system is a "common carrier," but >because of scienter: I have no knowledge, and cannot be expected to have >knowledge, of crimes committed with my phone. But this doesn't match the remailer scenario - this example is better likened to me letting you use my email account whilst at my house. >And, finally, packages and letters may be mailed anonymously. This is what >pre-paid stamps are all about. And I've used non-U.S. Postal Service >package delivery sytems without providing identification. Can Federal >Express have their assets seized because of "anonymous remailing"? >(Quibblers will no doubt cite laws requiring FedEx to "cooperate," demand >ID, etc.) Yes, but when was the last time someone physically mailed copyright source code (eg RC2) to half the world? When was the last time a pair of lawyers made worldwide news due to making a phone call? Again, the anon-postal-mail/anon-telephone-call analogy doesn't work. Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by John Pettitt 17 Dec '03

17 Dec '03

>At 2:25 3/11/96, savron(a)world-net.sct.fr wrote: > >>I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >>that it gives out the key ID of an encrypted message . From this you >>can get the identification of the recipient of the message , if it's >>someone who has publicaly distributed his key (keyserver , homepage >>...) . So even if you are unable to decode the message you can find >>who is the recipient of a given message . I think this is a big >>privacy problem . > and "Robert A. Rosenberg" <hal9001(a)panix.com> replied: >There is little that can be done about this. There must be something in the >message to identify who it is intended to be read by. As someone else has >stated, you can always set up private keys to be used to send to you that >are different from your Public KeyID for cases where you want to hide your >identity or that of the party you are communicating with. > I can see a case where one would want to broadcast a message (say on usenet) with *no* indication of the intended recipient (not even a non registered key-id). It would seem to be easy enough to hack up something that does not have key-IDs - to know if it's for you try decryption and if it works then it was for you. This does not scale well as the recipient must trial decrypt all messages which could use *a lot* (tm) of CPU time. John John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0