December 2003 - cypherpunks-legacy

Re: Leahy bill nightmare scenario?
by jim bell 17 Dec '03

17 Dec '03

At 12:01 PM 3/11/96 -0800, Timothy C. May wrote: >At 11:12 AM 3/11/96, Gary Howland wrote: > >>Dan Weinstein writes: > >>> If I rent cars, someone might one day use a car rented from me in a >>> robbery. Does that make my an accessary? NO. >> >>This is an unfair analogy. Now if you had said that you rented cars >>without asking for proof of identification, thus making your car hire >>centre very useful to robbers, that may more closely resemble the >>anon-remailer situation. > >If a hotel rents a room to someone who commits a crime in that room, e.g., >prostitution, drug use, plotting to blow up a building, can the hotel be >seized under the asset forfeiture laws? >Not that I have heard. Your example is so misleading that it's wrong. Cities generally attack motels by threatening to pull their licenses, which is usually called an "administrative process" and thus few of the usual protections apply. >Does it matter if the hotel fails to extensively check identification? >(Hint: Rarely have I had my ID checked. Sometimes they ask for a driver's >license and write down the number...and we all know how easy it is to get >fake DLs. Mostly they don't.) They do if they've been harassed by the city, for example Portland Oregon to name the closest example I know. > >If I lend my chain saw to my next-door neighbor without confirming his >identity, and he carves up his wife, am I liable? Not in these parts. "Criminally", probably not. Civilly, probably if the victim's family has a good enough lawyer. >(If I lend my chain saw to a ranting, foaming maniac, am I liable? Perhaps.) Actually, then you're CRIMINALLY liable, as well. >If I let someone use my telephone without confirming his identity, am I >liable for crimes committed with this phone? >This last example is, I submit, a nearly perfect parallel to anonymous >remailers. And not because the telephone system is a "common carrier," but >because of scienter: I have no knowledge, and cannot be expected to have >knowledge, of crimes committed with my phone. Actually, that's wrong. The question will be asked, "Do you regularly lend your phone to strangers who you can't even see, no questions asked, without listening in to see that nothing untoward is being plotted?" _THAT's_ a more apt analogy. >If I have visitors at my house, perhaps at a party, and I let a stranger go >ahead and make a call from the phone in a bedroom, for example, and he >plans a drug deal, can my house be automatically seized? Not that I have >ever heard about. If your phone was already tapped, and the delivery occurred in your house, you'd better look for new accomodations. >Maybe so, but if this ever happens, expect an outcry >against the asset forfeiture laws that will make Linda Thompson's protest >seem tame. I prefer not to wait until the Pollyannas of this world have been proven wrong. >Now if I operate a pay phone and encourage dealers and pimps to use it, >then maybe the public nuisance, RICO, or "crack house" laws can be used to >shut it down. (The public nuisance laws are what I would look to to see >remailers shut down, which will just move them offshore, of course. Absent >laws about sending encrypted packets outside the country, nothing can be >done.) Justa sec: The Leahy bill makes "encryption furtherance of a felony" illegal. Sending encrypted packets out of the country, containing material you don't know (because they're encrypted) sounds like a classic opportunity to declare you in violation of some "conspiracy to violate the law" of some OTHER country, which is probably considered a Federal felony. Welcome to prison, Tim. Your optimism will serve you well, there. BTW, it is clear that you haven't yet read Mr. Junger's analysis of the bill. Nobody except a government stooge could read that and not wonder why anybody would support that bill. A complete re-write is called for. Jim Bell jimbell(a)pacifier.com

2 1

Noise levels
by Damaged Justice 17 Dec '03

17 Dec '03

Once again I'd like to remind everyone that I run a customized filtering service that drops off a single message in your inbox every day or two, consisting of what I deem to be the most entertaining and informative posts. I also remove any non-topical rants that don't include useful information. This way, your overworked mail filters will never again have to deal with the Perry and Tim show. To subscribe, send a polite message to the human behind this address. -- http://yakko.cs.wmich.edu/~frogfarm ...for the best in unapproved information Tell your friends 'n neighbors you read this on the evil pornographic Internet "Where one burns books, one will also burn people eventually." -Heinrich Heine People and books aren't for burning. No more Alexandrias, Auschwitzs or Wacos.

1 0

Mile High Snakeoil
by Andrew Loewenstern 17 Dec '03

17 Dec '03

I was flipping through a copy of Spirit, the official magazine of Southwest Airlines, while on a flight to Vegas and found a thoroughly enjoyable advertisement for a crypto product. Underlines and emphasis are theirs. ---- Begin Snake-Oil Advertisement ---- __UNBREAKABLE__ COMPUTER SECURITY AND PRIVACY AT A __BREAKTHROUGH__ LOW PRICE! Stonewall-Drawbridge - Encryption Sytem In the face of the increasingly dangerous invasion of professional, business and personal privacy, unbreakable computer security at an affordable cost is a must. Lawyers, Accountants, Doctors, other professionals whose stock in trade is confidential information are especially vulnerable to malpractice as a result of unprotected information. It is important to deal with this very real potetial problem before it becomes a problem. Every business, every individual must also be concerned about computer security. Encryption can now be used to secure everything from credit card numbers to legal documents. Encryption through totally unbreakable Stonewall-Drawbridge is your ultimate security blanket. *Available Only to United States Citizens* STONEWALL an unbreakable, streaming type algorithm, 100 to 10,000 times faster than other encryptions. Stonewall compresses prior to encryption, eliminating the possible invasion of your computer files. Its key cannot be broken except by random chance, once in a million years. Good for DOS; Windows 3-1; Windows 95 operating systems..... ......$195 DRAWBRIDGE applies mathematical algorithms to encrypt messages and uses a quasi-infinite, one-way transfer to ensure veracity. Drawbridge uses an Infinite Venegere Key (IVK), combined with a one-way private key transfer which is impossible to break, except by chance, once in a million years. It also incorporates a forge-proof digital signature for verification and authentication insuring absolute transmittal protection. STONEWALL-DRAWBRIDGE ENCRYPTION SYSTEM provides unbreakable security protection for your "need to protect" files, archives and computer to computer transmission. The Stonewall-Drawbridge System is the ultimate encryption system, unmatched by anything else available...at a price that is significantly lower than any competitive product. This means it is affordable for every professional, business or individual who needs and seeks total and unfailing computer security....especially on the Internet.......$295 (includes a second system for your choice of contact) (800) 610-0859 Mr. Thomas <order form deleted> (30 Day Money Back Guarantee) Make Checks Payable to: HWI 747 E. Green Street, Suite 300, Pasadena , CA 91101-2119 ---- End Snake-Oil Advertisement ---- andrew

3 2

Re: Leahy bill nightmare scenario?
by Gary Howland 17 Dec '03

17 Dec '03

Timothy C. May writes: >At 11:12 AM 3/11/96, Gary Howland wrote: >>Dan Weinstein writes: > >>> If I rent cars, someone might one day use a car rented from me in a >>> robbery. Does that make my an accessary? NO. >> >>This is an unfair analogy. Now if you had said that you rented cars >>without asking for proof of identification, thus making your car hire >>centre very useful to robbers, that may more closely resemble the >>anon-remailer situation. > >If a hotel rents a room to someone who commits a crime in that room, e.g., >prostitution, drug use, plotting to blow up a building, can the hotel be >seized under the asset forfeiture laws? I didn't initially use the the car-hire analogy, I was just trying to bring it more into line with the anon-remailer situation. Perhaps a better example would be an agency set up for the sole purpose of hiring cars on behalf of anonymous customers - as long as the customers didn't abuse the anonymous facility too much, then I guess they would be allowed to carry on operating, much like the remailers operate at present. However, I guess they're in for trouble when their service starts being abused at the expense of big brother, and I guess their policy of shredding all evidence at weekends won't help matters either. >If I let someone use my telephone without confirming his identity, am I >liable for crimes committed with this phone? > >This last example is, I submit, a nearly perfect parallel to anonymous >remailers. And not because the telephone system is a "common carrier," but >because of scienter: I have no knowledge, and cannot be expected to have >knowledge, of crimes committed with my phone. But this doesn't match the remailer scenario - this example is better likened to me letting you use my email account whilst at my house. >And, finally, packages and letters may be mailed anonymously. This is what >pre-paid stamps are all about. And I've used non-U.S. Postal Service >package delivery sytems without providing identification. Can Federal >Express have their assets seized because of "anonymous remailing"? >(Quibblers will no doubt cite laws requiring FedEx to "cooperate," demand >ID, etc.) Yes, but when was the last time someone physically mailed copyright source code (eg RC2) to half the world? When was the last time a pair of lawyers made worldwide news due to making a phone call? Again, the anon-postal-mail/anon-telephone-call analogy doesn't work. Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)kampai.euronet.nl> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

Re: PGP reveals the key ID of the recipient of encrypted msg
by John Pettitt 17 Dec '03

17 Dec '03

>At 2:25 3/11/96, savron(a)world-net.sct.fr wrote: > >>I began testing PGP a few days ago ( I'm a PGP newbie ) and I found >>that it gives out the key ID of an encrypted message . From this you >>can get the identification of the recipient of the message , if it's >>someone who has publicaly distributed his key (keyserver , homepage >>...) . So even if you are unable to decode the message you can find >>who is the recipient of a given message . I think this is a big >>privacy problem . > and "Robert A. Rosenberg" <hal9001(a)panix.com> replied: >There is little that can be done about this. There must be something in the >message to identify who it is intended to be read by. As someone else has >stated, you can always set up private keys to be used to send to you that >are different from your Public KeyID for cases where you want to hide your >identity or that of the party you are communicating with. > I can see a case where one would want to broadcast a message (say on usenet) with *no* indication of the intended recipient (not even a non registered key-id). It would seem to be easy enough to hack up something that does not have key-IDs - to know if it's for you try decryption and if it works then it was for you. This does not scale well as the recipient must trial decrypt all messages which could use *a lot* (tm) of CPU time. John John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch PGP Key available at: http://www-swiss.ai.mit.edu/htbin/pks-extract-key.pl?op=get&search=0xB7AA37…

1 0

Re: A lengthy preliminary analysis of the Leahy bill.
by jim bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 12:26 PM 3/11/96 -0500, Peter D. Junger wrote: > >This is a preliminary draft of my preliminary analysis of the Leahy >bill. In it I am primarily concerned with the affect---if any---of >that bill on the constitutionally protected freedoms of speech and of >the press. [much scary but, sadly, probably accurate concerns deleted for space.] > "\S 2804. Unlawful use of encryption to obstruct justice > > "Whoever willfully endeavors by means of encryption to obstruct, > impede, or prevent the communication of information in furtherance to > a felony which may be prosecuted in a court of the United States, to > an investigative or law enforcement officer shall- > > "(1) in the case of a first conviction, be sentenced to imprisonment > for not more than 5 years, fined under this title, or both; or > "(2) in the case of a second or subsequent conviction, be sentenced > to imprisonment for not more than 10 years, fined under this title, > or both. > >This provision is completely incoherent. There is no telling how the >government will interpret it, but at a guess they will use it to make >people reveal their keys: ``if you don't tell us your key, we are >going to charge you with impeding the communication to me of >information about the felony I am investigating.'' Thank you, Mr. Junger, for your entire analysis, but particularly this comment on that atrocious section. I'm repeating it, because I think it bears vast significance to the problems with this bill. The bill needs a complete rewrite. The one thing that makes me hopeful is the fact that the people around here who seem to think that this bill must be accepted as written, with this section included, all claim that there is great opposition to it. If that is true, then all I need to do is to convince people who nominally should be on "our" side that the bill is bad, as written. Mr. Junger's careful, albeit prelimary analysis does that in spades. Jim Bell jimbell(a)pacifier.com Klaatu Burada Nikto -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMUSagPqHVDBboB2dAQEXpwQAiLfZk/xPqhTI0UNbgAY/oQh7wR5ElRYH Cb3QZDHGrPmPBF7MZEFW9bL9U+U/33l0kK/q/20vGvLZMFALImcOPgdFjcidjVRA zqHAHPTnJWsyROJsv1fgO2l6u0QRkONFxT5MF2tyqGp9ArYAOSwZy4NMXgwX4CrM QnqwvuKnZfU= =Qm0E -----END PGP SIGNATURE-----

1 0

Re: PGP : what to do when a user ID has multiple RSA keys
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:25 AM 3/11/96 +0000, you wrote: >My DOS version of PGP 2.6.2 came with a built in PUBRING.PGP >containing two keys ( 1024 and 512 size ) with the same user ID . >For testing purposes I wanted to encrypt a message with the 512 >length key , but only the 1024 size key could be used . > >How can I select the right key , apart from making a clone >PUBRING.PGP with only the key I want to use ? You need to use the hex id of the key. (I have this problem as well.) To get the hex id of the key, try "pgp -kv <yournamehere>". That will give you the hex id (right after the key size). For example, if -kv returned: 2048/F7D02799 you would use "0xF7D02799" instead of your name. (No quotes and case does not matter.) This does have some Cypherpunks relevence... Many of the PGP front-ends I have seen do not use the key ID, and thus, do not pick the correct keys in this curcumstance. (And some use it for some, but not all, operations.) But then, I would like to see key management handled alot differently than it is now. (For example, I would like to see PGP use multiple keyrings with an order of precidence. Search the most used keyring first and then check the mega-keyring if nothing is found in the first one. I expect that kind of feature is a ways off...) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon

1 0

Cut the mystical artist crap. (No crypto relevance here)
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

>Was it Thoreau who said "Consistency is the hobgoblin of >simpletons"? Wrong, my somewhat hysterical anonymous young woman. It was Emerson who wrote, "A foolish consistency is the hobgoblin of small minds." Please, try Bartlett's prior to again making an ass of yourself.

1 0

Re: TCP/IP Stego
by savron＠world-net.sct.fr 17 Dec '03

17 Dec '03

It seems that bit fiddling involve a direct connection of two partners having each one a TCP/IP Stego adapted kernel to work . This is a direction to study , but we can't forget those who can't directly connect with their 'stego' partner . We can't forget also those who can't hack their kernel . Any comment welcome

1 0

PGP : what to do when a user ID has multiple RSA keys
by savron＠world-net.sct.fr 17 Dec '03

17 Dec '03

My DOS version of PGP 2.6.2 came with a built in PUBRING.PGP containing two keys ( 1024 and 512 size ) with the same user ID . For testing purposes I wanted to encrypt a message with the 512 length key , but only the 1024 size key could be used . How can I select the right key , apart from making a clone PUBRING.PGP with only the key I want to use ? Any comment welcome

2 2