December 2003 - cypherpunks-legacy

Attorney-Client / Nyms
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- On Sun, 28 Apr 1996, E. ALLEN SMITH wrote: > From: IN%"unicorn(a)schloss.li" "Black Unicorn" 27-APR-1996 23:07:10.42 > > >Well, using attorney client confidentality to shield things otherwise > >discoverable just doesn't work. > > Given discussions as to attorneys holding passphrases, et al, perhaps > a tutorial from the lawyers on the list (yourself and others, since > disagreements among J.D.'s have been known to happen) on what attorney-client > confidentiality does cover? Proposed FRE 503 probably has the best codification of the prevailing common law on the subject. I reproduce it in part below. Typos are mine. (a) Definitions. As used in this rule: (1) A "client" is a person, public officer, or corporation, association, or other organization or entity, either public or private, who is rendered professional legal services by a lawyer, or who consults with a lawyer with a view to obtaining progessional legal services from him. [...] (b) General rule of privilege. A client has a privilege to refuse to disclose and to prevent any other person from disclosing confidential communications made for the purposes of facilitiating the rendition of professional legal services to the client, [between the attorney and the client directly or indirectly]. (c) Who may claim the privilege. The privilege may be claimed by the client [or his agents or assigns etc.] The person who was the lawyer at the time of the communication may claim the privilege but only on behalf of the client. His authoriety to do so is presumed in the absence of evidence to the contrary. (d) Exceptions. There is no privilege under this rule: (1) Furtherance of crime or fraud. If the services of the lawyer were sought or obtained to enable or aid anyone to commit or plan to commit what the client knew or reasonably should have known to be a crime or fraud; or (2) Claimants through the same deceased client. As to communication relevant to an issue between parties who claim through the samed deceased client, regardless of whether the claims are by testate or intestate succession or by inter vivos transaction; or (3) Breach of duty by lawyer or client. As to a communication relevant to an issue of breach of duty by the lawyer to his client or by the client to his lawyer; or (4) Document attested by lawyer. As to a communication relevant to an issue concerning an attested document to which the lawyer is an attesting witness; or (5) Joint clients. As to a communication relevant to matter of common interest between two or more clients if the communication was made by any of them to a lawyer retained or consulted in common, when offered in an action between any of the clients. (end) Generally speaking the particulars of attorney-client relationships are regulated by state statute, though some states define the provisions through common law. Note the confidentiality requirement. A client is estopped from claiming privilege if he discloses the content of the communication to a third party not connected to the attorney-client relationship. The identity of the client and the existance of the attorney client relationship are not confidential. There are some exceptions. Physical evidence is generally not protected by attorney client privilege unless it is a manifestation of communications between attorney and client (letters, documents etc.) Communications regarding future crimes or frauds are not protected. What I think you will be most interested in, however are the exception for stolen property and destruction of evidence. Stolen property may be held by an attorney for a reasonable time for inspection purposes, but must be returned to the rightful owner or the attorney will be a receiver of stolen goods and participating in an ongoing crime. Privilege will thus not apply. In re Ryder, 263 F.Supp. 360 (E.D.Va 1967). (Some courts will permit the attorney to refuse to disclose the source from which he obtained the property, however). Consider this in the context of trade secrets. All states have laws against destroying or concealing evidence. The attorney who advises his client to destroy evidence is a co-consiprator. Privilege does not apply. Clark v. State, 261 S.W.2d 339 (Crim. App Tex. 1953). (Interesting to wonder if advising a client to encrypt evidence is 'concealing' it). > > >There are many mail forwarding services that don't use attornies. An > >attorney is going to charge you by the hour for this service. I don't > >think you really want to pay for it. > > Most of them aren't anonymous, either... although that does give me > the thought of going to one outside the US and its reporting requirements. > They'd know who I was (or at least the address it was going to), but at least > nobody else would know. Any suggestions, since you've been writing of the joys > of nymdom recently? I suggest you use a forwarding service, sign up with your nym name, and provide the address of a P.O. box for them to forward to, also in the name of your nym. > -Allen -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMYQU6S1onm9OaF05AQHN7ggAstl9Is4Yyt0ZSPiOJYBJvFqPoj8kNtQL 6TuIubS4Ybu+5tWEqI6O/llmwE0NGw9q8ow4zK4yAm7PnbtvcFsRvjLy+KlPbU6/ rVTd1EI9Qz6rGTiK99j3bBxdYsQv4p4AwiC/+sdR/ZJyq6+ZR5PX/RzqPO/Tfxc6 nlM/G0S4PcA45W4v+lDRbj8GTcRaTlziPAl8/8xJGPuapZBrt8Icl92dLrCAFu7e vGe0u0yrRw/ljq2hQ1FjpQzEv4pbQ4XPxylqmoh7lTjkFw2KsT/pNb/36YUNisPv 4n4EiAcRCviVBSmaOF8DzgwANirTR5WEYj9ayIBwN5UmlwZnKWf/Bw== =N2Wa -----END PGP SIGNATURE----- --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

1 0

Re: Java security weaknesses
by Hal 17 Dec '03

17 Dec '03

To add to the list of Java security weaknesses from the Princeton paper I posted the other day, I saw a new one on comp.lang.java this afternoon. It is another bug in the bytecode verifier, different from the one discovered by the Princeton group, that allows you to bypass the security mechanisms completely. Details are not yet available. Apparently the earlier bytecode verifier bug still does not have a fix available. However the nature of the bug itself was kept secret until last week. Now that it is out I hope Sun and Netscape will push to get the fix available ASAP. The bug appears to require considerable sophistication to exploit (understanding the details of the class resolution mechanism). Still with the talent which is out there on the net I imagine it will only be another week or two at most before a demonstration exploit appears. I hope the extended delay in making the fix available means that an intensive review of the code is being conducted, so that for example this other bug will have been fixed as well in the new release. I certainly hope that it won't be another month before a fix comes out for this new bug. Hal

1 0

Re: code vs cypher
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 10:01 PM 4/28/96 -0700, Rich Graves wrote: > I do not recall defending any statist policies. I did not defend the > [SMC call to silence Nazis], and indeed to defend the > [SMC ] would not have been > egregious statism, or indeed any kind of statism at all, I do not recall anyone accusing you of statism on the SMC call to cut Nazi net access -- probably because I deleted all that tedious crap, not because nobody accused you. I and others accused you of statism on various other matters, such as your claim that those who fail to pay taxes steal from society, and I just accused you of always changing the subject to Nazism whenever somebody accuses you of statism. And I also accused you of talking about Nazism much too much. And what happened: You immediately changed the subject to Nazism. Cut the nazism, please. Statism is sometimes on topic. Nazism will not be on topic until the next serious threat to Nazi's net access. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 2

Freedom and security
by angels＠wavenet.com 17 Dec '03

17 Dec '03

>No. "Those who sacrifice security for freedom, will have neither" is >not consistent with Franklin's statement, nor is it true. Security and >freedom are antithetical, and worse than that, security is always an >illusion. But you can have your illusion, as long as you keep it out of >my life. Censor yourself if you wish, but don't censor anything I might >want to look up. > The relationship / balance between security and freedom is always a defining factor in a society. My point is that a society with no laws and no codes of conduct is not a free society. This is not the same thing as saying that all societies need government. Small communities can and do operate without major legislation, using what sociologists refer to as "informal social controls", e.g. peer pressure. But even those small communities require and enforce boundaries on the conduct of their members. There is no society that tolerates the murder of its innocent members. The Internet may once have been one of those small close knit communities, small enough not to require law enforcement - although even then it had rules that had to be followed. But that Internet is gone, and it will never return, because now its the biggest city in the world, and the history of the change from pastoral communities to urban life, to the development of nation states and power blocs is also the history of crime. And as the Internet grows, so will its security problems. My position is to seek a balance between the freedom of the individual and the security of the community. My argument is that when the security of the community is threatened by the freedom of the individual, the community will always prioritise its safety. Good government of course means maintaining individual freedoms *and* maintaining community security. I actually disagree that they are antithetical. On the contrary they are a balance that any society has to find. Where individual freedom takes over you have the urban jungle where predators consume prey. Where security takes over you have the totalitarian state. Neither is necessary nor inevitable. We are simply concentrating on the problem from two different angles. My concern is to maximise community safety while protecting individual freedom. Your angle is to maximise individual freedom while protecting community safety. There is IMHO very little difference between the two. ********************************************************* Colin Gabriel Hatcher - CyberAngels Director angels(a)wavenet.com "Two people may disagree, but that does not mean that one of them is evil" *********************************************************

2 1

Re: The Joy of Java
by Hal 17 Dec '03

17 Dec '03

Somewhat independent of the security/safety issues regarding Java applets, there are also questions about their suitability for crypto applications. Applets currently labor under several restrictions (at least when part of the Netscape browser) which make it hard to do crypto: Applets cannot accept net connections, and they can only make outgoing connections to the host which provided them to the browser. Applets cannot read or write local disk files. Applets cannot access other local hardware, such as smart cards, printers, or microphones. These restrictions make several things difficult. Finding good sources of entropy for random numbers is hard. Applets do have millisecond resolution event timers (provided that the implementation keeps times to that resolution, of which there is no guarantee), so they can get some entropy by keystroke timings or mouse movements. But they have little access to disk files or other sources of environmental noise. Retaining secure information between runs is also hard. Specifically, there is no place to store key data other than by sending it to the server and having it put it somewhere. It would not be hard to have an applet which created a public key, but the key would have to be stored in an insecure location. So the best it could do would be to encrypt the key with a user specified pass phrase and hope that was strong enough. The restriction on connections makes other applications difficult. To make an applet which can send PGP compatible email it needs to be able to look up keys on the key servers. This can only work if the host serving the applet can look up keys for it. It has to be either running a key server or able to forward requests to one. This requirement makes the applet not "self contained" in that to put it on your web pages you also have to have this other infrastructure in place. Another problem is in trusting applets. Imagine an applet to help you participate in electronic commerce. Just type in your ecash pass phrase and it will help you open your ecash account and then charge you tiny amounts as you surf the web. But of course if the applet is capable of withdrawing small amounts, it would also be able to withdraw big amounts as well. It could drain your bank account before you knew it. Some of these problems might be fixed by giving applets limited access to disk files. But even then it would be risky to let an applet see your PGP secret key ring or ecash wallet. Signed applets can probably help with some of these as well. If Phil Zimmermann has signed the PGP applet, maybe you'll trust it as much as you trust the PGP executable. Likewise if Chaum has signed the ecash applet you'll trust it as much as you trust the ecash software. The thing to keep in mind is that you are already trusting people when you use their code, or virtually any code for that matter. PGP is special because source is available. Of course most people don't have any guarantee that your particular binary was built from the source that you see. But all the other software you run makes you vulnerable. How do you know that DOOM, for example, doesn't check to see if there is a network connection and send out your PGP secret key ring? You even have a pointer to it in your PGPPATH environment variable. Maybe that's unlikely because you'd see your modem lights flash suspiciously, but how about networking applications? Suppose Microsoft's Internet Explorer rummaged through key rings and wallets, piggybacking packets on your output data as you browse? You'd probably never know. So there are limits to how much safety you can expect. Hopefully with signed applets it will be OK to authorize some overrides of the current restrictions so that these other kinds of applications can be provided. Hal

3 2

Your I/CODE
by icodesupport＠ipro.com 17 Dec '03

17 Dec '03

Thank you for registering. Your I/CODE is: adct0524. Please write it down since it will be useful at other WWW sites. Please note that the first four chracters of your icode are letters, and the rest and numbers...sometimes they look the same. Also, if you have chosen to protect your I/CODE with a password, our technical support staff will not be able to reveal your I/CODE or your personal information to you unless you can supply that password. Remember, as an I/CODE member, you get all these great benefits: SAVE TIME: You now have a password that will allow you to bypass registration forms at I/CODE-Accepting sites all over the Web. THE RED CARPET TREATMENT Your I/CODE is like a backstage pass to the best of the Web. When you use it, sites will give you access to special content, easy entry into sweepstakes, and more. IT'S FREE: Your I/CODE is free, and using it is free. Forever. Period. MORE INFO: For more information on I/CODEs, I/CODE benefits, and I/CODE sites, please visit the I/CODE Home Page at http://icode.ipro.com Thanks again for your interest, and GO! I/CODE!

1 0

Get your I/CODE today
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I just created a "cypherpunk" identity on I/PRO. Too bad they don't let you choose a nice string like "cypherpunk" to login with. The cypherpunks I/PRO code is: adct0524 (I told them that we live in Djibouti)

1 0

Re: connecting Uni to the Web O Trust
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:56 4/28/96, bryce(a)digicash.com wrote: >I mean, I could explain it to him, but not even counting the >difficulties of communicating such complex concepts among >humans, there is the fact that if Mitch is here, he can >prevent the real Uni from seeing the explanation, and he can >act in Black Uni's place as if he understands. Then he can >go through the necessary steps to increase our trust in his >pubkey, as if Uni were going through them. It is generally acceptable to sign a key after seeing a very easily forgable driver license. Even if you have seen the person before on TV, a similar looking actor could be substituted, the true person could be brainwashed, and what if the person has multiple personality disorder? Should Jim's public key become invalid once John or Alexis have taken over? The PGP web of trust is a practical solution for an imperfect world. Yes, someone might have wrapped Uni into a bubble. But that would have to be some damed good bubble for it to last so many years. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Cell Kill 2
by Jüri Kaljundi 17 Dec '03

17 Dec '03

> The Russians seem to agree. On April 21, two Russian > laser-guided missiles reportedly zeroed in on the cellular > telephone of Dzhokhar M. Dudayev, leader of the Chechen > rebels, and killed him. As far as I know, he was using a satellite phone (probably Inmarsat) on open ground outside a building. They had been using satellite phones before, but usually they were transmitting one-way information only (either voice or video), which had been recorded before, so Dudajev was not near at the time of connections. This time it had to be two-way, because he was negotiating with Moscow officials. BTW Dudajev was living in Estonia for a long time (before he started fighting for Chechen independence), being the head of Russian air forces located in Estonia. Now the building where he was working has been reconstructed as an hotel, and there is a special Dudajev suite, in case someone is visiting Estonia :) Estonian people are also very supportive for Chechen fight for independence. Juri Kaljundi jk(a)stallion.ee AS Stallion

1 0

Re: code vs. cypher
by attila 17 Dec '03

17 Dec '03

** Reply to note from Rich Graves <llurch(a)networking.stanford.edu> 04/28/96 01:41am -0700 = Admitting that you pray -- now, that takes courage, well, in polite = circles in California it does. aahh, but I live in rural Utah where the closest large city has a population of less than 25,000! -- "When you know everything I do - and you will - you will never think of the American government in the same way again." -- Tim McVeigh's defense attorney, Stephen Jones cc: Cypherpunks <cypherpunks(a)toad.com>

1 0