December 2003 - cypherpunks-legacy

FBI probes CompuServe adult programming
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

COLUMBUS, Ohio, May 8 (UPI) -- The FBI, acting on a complaint from a Christian morals watchdog group, Wednesday sought to determine whether CompuServe Inc. has violated a new law against indecency. FBI agents said they were attempting to determine whether CompuServe's Entertainment Drive, which contains some adult material, violates the Communications Decency Act. The law prohibits offering pornography to on-line users, especially minors. CompuServe, headquartered in Upper Arlington, noted parents can now block their children from reaching any adult-oriented content. Users must use a password to reach certain restricted areas. ``At this time we are not doing anything,'' CompuServe spokeswoman Daphne Kent told the Columbus Dispatch. ``We cooperate fully with any law enforcement agency, but we have not had talks with (the FBI) at this time.'' The FBI started the investigation after the Justice Department determined a complaint from the American Family Association had merit. A spokesman said American Family made CompuServe a target because the on-line service is one of the world's largest such businesses and offers sexually oriented content. American Family, based in Tupelo, Miss., also objects to CompuServe's MacGlamour Forum, which contains adult pictures and movies.

1 0

Re: Transitive trust and MLM
by Raph Levien 17 Dec '03

17 Dec '03

I'm really glad to see this thread. I think this is a problem that is well worth thinking about. I think what is really called for is a model of when keys are likely to be bogus, and when signatures, etc., are likely to be correct. Before going into the math, I'll go through some examples. Any key that's "well connected" in the MIT keyring is likely to be good. Specifically, if it's signed by lots of people, and each of those people is reachable from my trust root, then I'm pretty much willing to believe the key is good. Unfortunately, there are a fair number of reasons why a key may be bad. A really _cool_ thing to do with a compromised machine would be to sign a big bunch of bogus keys. Given how easy it is to compromise a machine, this is a very real worry. I don't know if this attack has been realized yet, but it's best to assume it could be and will be. Another weakness is the "clueless user" who signs keys gotten from the Net, or otherwise not properly verified. I don't claim to know all of the vulnerabilities, but I do think it would be a good idea to quantify them before designing a key distribution system. Hal calls into question the value of signed keys. To me, this points to the pressing need for better manual verification of keys, by communicating secure hashes through the phone and on physical channels, including business cards. These channels are more secure than the Net, are more convenient for all but the most hardcore net.heads, and would actually work quite well, I think. But I do think it would be nice to have access to "probably good" keys for casual e-mail. With luck, a densely connected Web of manually obtained keys can serve as a good foundation for the latter. Now for the mathematical model. Signatures can bind keys to e-mail addresses, or act as assertions that the signed public key is trusted to transitively sign other keys. Let's assume that each signature has a certain probability p of being good, and a 1-p probability of being bogus, and that all probabilities are independent. These are probably bad assumptions in the real world, but that's the difference between theory and practice. Now we can actually evaluate the probability of a given key being good. Consider a Monte Carlo process in which each edge in the graph is present with probability 1-p. For each run, we determine whether the recipient's public key (actually the binding between public key and recipient's e-mail address) is reachable from our trust root. The probability over a large number of runs is (given our assumptions) the probability of the key being good. One encouraging consequence of this model is that densely connected subgraphs can result in highly trusted keys even if p itself is quite small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For example, if p is a mere 50%, then in a clique of size 10, each key in the clique is trusted with a probability of 99.9%. This computation is (I think) known as the network reachability problem, and is probably quite hard to evaluate. In practice, you'd probably want to compute upper and lower bounds instead, Let's see if we can come up with a model that preserves this property of giving high trust values to densely connected keys, yet is also highly resistant to (some plausible model) of attacks against the Web of trust. Raph

1 0

HAVE YOU HAD YOUR (TAX) BREAK TODAY?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, As of 1 May, there is yet another reason to do your offshore business in Liechtenstein. On that date the country's first McDonald's opened in the town of Treisen. Liechtenstein is the 95th country to have a McDonald's. It was not reported whether or not the Princely family was at the VIP party that marked the gala opening, or if mutual recognition would be exchanged with McDonaldland. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

ecash payee anonymity, cpunk archives
by Alex Strasheim 17 Dec '03

17 Dec '03

A while back someone posted a note saying that an ecash protocol garaunteeing payee as well as payer anonymity had been devised. Did that ever get posted here? The last message I saw said that it would be posted soon. Also, I missed whatever discussion there was about why the archives got shut down. Was it a copyright thing? A lack of resources? No one to volunteer? -- Alex Strasheim, alex(a)proust.suba.com

3 2

No Subject
by Gary Howland 17 Dec '03

17 Dec '03

CRYPTOGRAPHIC EXTENSIONS FOR JAVA _________________________________________________________________ DESCRIPTION This library contains a suite of cryptographic classes for Java. All of the classes have been implemented in native code for performance reasons, and have been tested on Windows 95, Windows NT and Solaris. Download in source or binary form at http://www.systemics.com/software/ FEATURES All of the following have been implemented using native methods: * BigInteger class (based on code from Eric Young). This class implements arbitrary length integers and some associated mathematical functions. * DES class (based on code from Eric Young) * IDEA class * MD5 class (based on code from RSA Data Security, Inc.) * SHA class (based on code from NIST and Peter C. Gutmann) COPYRIGHT This library includes (or is derived from) software developed by (and owned by) the following: * Peter C. Gutmann * NIST * RSA Data Security, Inc. * Systemics Ltd <http://www.systemics.com/> * Eric Young <eay(a)mincom.oz.au> Also planned for release: * Cryptographic library for Java * PGP library for Java * Cryptographic library for Perl * PGP library for Perl

1 0

Mandatory Voluntary Self-Ratings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:31 PM 5/7/96, Joseph M. Reagle Jr. wrote: >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better Regarding this "(which I see few cases in which it wouldn't)" point, I have a different view. Should "voluntary self-criticism" become widespread, I expect to rate all of my posts as suitable for children of all ages, suitable for hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. Regardless of whether I'm advocating post-birth abortions or forced encheferation of Muslim girls. Then we'll see what happens. (This is an old debate, here and on the Cyberia-l list, to wit, what happens when people/perverts/libertarians choose to subvert the voluntary ratings by deliberately mis-rating their stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters should be exposed to certain things?) I believe the whole debate about PICs-type ratings and other "voluntary self-labeling" has taken us astray. I don't see calls for authors to voluntarily self-rate their print works, nor do I see calls for newspapers to have articles rated. Nor speech in general. However, the drumbeat of "V-Chip" advocacy is now spilling over into cyberspace. I say it's a waste of our time to even be thinking or worrying about how to implement an infrastructure for ratings. In fact, building such an infrastructure could make later imposition of "mandatory voluntary ratings" (Orwell would be unsurprised) a greater likelihood. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

3 2

Re: Why I Pay Too Much in Taxes
by nobody＠replay.com 17 Dec '03

17 Dec '03

Black Unicorn wrote: >Where does the company get the funds to pay you? >From Tim's day work. It's a consulting company, i.e. it sells his services to whomever is employing him today. The whole idea was to hide Tim's income sources, or that's what he asked for anyway. You can hide your income by putting it in another jurisdiction. >What pay? I don't get it. Where does this friend gets his money? As a cut from the money Tim's employer gives him. >> By the way, are there any PGP encrypted mailing lists for >> discussing serious tax fraud? > >If such a list existed, would we tell an anonymous poster/fed? >If your above scheme is intended merely to conceal funds it is a fairly >poor example as it depends on the secrecy of each and every 'employee' of >the company. No it doesn't. One person knows where they money went when it left the country (and he is getting paid for the risk of doing time). Nobody knows where the funds are concealed. Probably in a trust that you can access when you are on vacation abroad. Mr.X.

2 1

Re: remailer-in-a-box
by Bill Stewart 17 Dec '03

17 Dec '03

>At 3:51 PM 5/7/96, anonymous-remailer(a)shell.portal.com wrote: >>No one answered me. >>What's the best remailer-in-a-box. >>I'd like to run one. I would think people would be falling >>over eachother to tell me. I was running a modified ghio2-based remailer until I shut it down because of spammers. You should be able to get the code off my web page, or send me email and I'll forward it. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: self-ratings
by rick hoselton 17 Dec '03

17 Dec '03

Timothy C. May writes: >Should "voluntary self-criticism" become widespread, I expect to rate all >of my posts as suitable for children of all ages, suitable for >hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. >Regardless of whether I'm advocating post-birth abortions or forced >encheferation of Muslim girls. Not me. If someone doesn't want to be offended, then I would rather they never read anything from me, ever. I share family, race, culture, and backround with my father, and there have been times when I offended him unintentionally. One person liked me enough to marry me, but I occasionally offended her, too. Imagine how easily I might offend a stranger. Better to take no chances at all. If somebody wants a rating system, then they should just consider everything I have to say as "X-rated" in EVERY category, just to be safe. And that's a policy that everyone on the net should follow. If this self rating system becomes mandatory, I think the cypherpunks should cooperate fully, by notifying ALL sites that are not self-X-rated if they can find ANYTHING that ANYONE might EVER find offensive. Better safe than sorry. Nobody will be prosecuted for saying they have an offensive site, even if they don't. Imagine a prosecutor trying to prove that NOBODY could POSSIBLY be offended by my newsgroup postings! But many people will be prosecuted for not identifying their sites as offensive. Now, if everyone follows my advice, the net may become very boring for those who have their filters set on, but congress will NEVER make "being boring" against the law. If mandatory-self-rating ever becomes the law, cypherpunks can definitely promote true justice by strictly interpreting it and supporting it completely.

2 1

MD5 weaknesses
by Bill Stewart 17 Dec '03

17 Dec '03

Perry Metzger posted a note to coderpunks about >A paper by Hans Dobbertin dated May 2 in private circulation has found >an easy method for generating collisions (not pseudocollisions as was >done in previous work) in the MD5 compression function. I was told >that this was public information. And somebody provided a URL to http://www.cs.ucsd.edu/users/bsy/dobbertin.ps The coderpunks discussion has been titled Re: Favorate flavor of hash? for which I suppose there are alternative interpretations :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0