December 2003 - cypherpunks-legacy

Re: misunderstandings of PICS
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 04:40 PM 5/6/96 EDT, E. ALLEN SMITH wrote: > In other words, the CyberAngels want to eliminate any pages that >contain material they think minors shouldn't see that aren't self-rated with >a PICS self-rating (the first of the three types) intended to block minors >from seeing it. Yes, this is an abuse of the market oriented variety of PICS; >they obviously don't know and/or don't care. If you want to convince them >otherwise, start cc:ing your messages (and forwarding mine, on this I give you >permission) on PICS and the CyberAngels to angels(a)wavenet.com. I didn't see the cyberangel proposal, but how is this an abuse? Regardless, it's a waste of time, browsers will have the option of "If not PICS labled, don't return." They're better off advising people to flip that switch if this is such a big concern. _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Why I Pay Too Much in Taxes
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:17 PM 5/7/96, Clay Olbon II wrote: >At 5:34 PM 5/6/96, Timothy C. May wrote: >>Also, the effect of inflation has been to inflate salaries and thus inflate >>people into higher tax brackets, even when their "real wages" have not gone >>up. > >This used to be true. A bill passed during the Reagan administration >indexed the brackets to inflation to remedy this situation. I don't know >how succesful the bill was in eliminating "bracket creep", but that was the >stated purpose. No, it _still_ is true. One bill during one administration does not a major change make. Look at the actual rates, average salaries, increases, etc. (Sure, there have been all sorts of rate increases, decreases, changes, loopholes added, loopholes subtracted, etc. But the fact is that the average starting salary for an EE was about $12,000 a year in 1975 and more than 30,000 in 1995, with about the same buying power but with tax _rates_ dramatically higher.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

UK IP Censorship
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Financial Times, 6 May 1996 Internet provider to launch censorship By James Mackintosh in London Unipalm Pipex, the biggest provider of Internet access to British businesses, has acceded to government calls for voluntary censorship in a significant boost to ministerial attempts to restrict access to electronic pornography. Pipex is to block much of the worst child pornography from subscribers and will also be supplying new software to allow companies to limit the parts of the Internet - the international computer network - accessible by staff. The decision is likely to have far-reaching implications for the Internet in Britain because Mr Peter Dawe, managing director of Pipex, is also political officer of the Internet Service Providers' Association, the body negotiating a voluntary code of conduct with the government. Until recently Mr Dawe was opposed to any form of censorship. But he has now decided to stop supplying discussion groups - which are devoted to pictures of young children. The software package will allow subscribers to block parts of the Internet considered unsuitable, making them accessible only with a password. As a result, parents will be able to control which parts of the Internet are available to children, and managers to ensure staff are not breaking the law. However, Mr Dawe emphasised the impossibility of completely blocking offensive parts of the Internet. Pipex - the UK arm of UUNet of the US - does not expect a backlash from users over the censorship. Mr Dawe said he was sure Pipex's corporate users "would be horrified" at what is available on the Internet. He said that if pornographic pictures were found on office computers, companies could be open to prosecution. Cambridge-based Pipex, which claims more than 60 per cent of the UK's corporate Internet users, selected which news groups to block after seeking the advice of police at Scotland Yard in London. The Obscene Publications Squad confirmed that child pornography on the Internet had already become a serious problem. "The majority of the people we deal with have used news groups," he said. Child pornography had become available to people who a few years ago would not have known how to find it. The approach Pipex has taken fits with the government's preferred option of a voluntary code of conduct for Internet providers, leaving censorship matters to users. ---

4 3

[JKinney@commprod.com: Security Engineer Needed for a Project]
by Eric Blossom 17 Dec '03

17 Dec '03

Hi, Here's an opportunity for somebody who knows something about NetWare. I don't know anything other than what is posted below. Call or write Don Wagner for more info. Eric Blossom ---------------------------------------------------------------- X-Mailer: Novell GroupWise 4.1 Date: Tue, 07 May 1996 13:00:05 -0500 From: Jim Kinney <JKinney(a)commprod.com> To: eb(a)comsec.com Cc: dwagner(a)commprod.com Subject: Security Engineer Needed for a Project Eric: Listed below is a description of a Network Security Specialist that we have a requirement for on one of our Defense contracts. This work would be performed either in Indy or Pensacola, FL. Can you please forward this to the CypherPunks or other appropriate mail group for distribution? +++++++++++++++++++++++++++++++++++++++++++++ Novell NetWare Security Specialist The Novell NetWare expert shall have expert knowledge in NetWare 4.x internals and NetWare 4.x security. The individual shall have programming experience writing applications to access NetWare security functions that alter NetWare attributes like rights, passwords and access list, etc. This individual shall be knowledgeable about the various NetWare-related configuration parameters, including those associated with IPX/SPX, NUC, NVT and SAP. This individual shall have extensive C and Assembly language programming experience using DOS and/or Windows that interfaces with Novell NetWare Application Programming Interface (API) or NetWare Loadable Module (NLM) APT. Lacking these specific skills, this individual shall be knowledgeable with NetWare internals and have experience in both application and system programming. This individual shall be knowledgeable about LAN analysis techniques, hardware, memory configurations, NETBIOS protocols, BTREIVE, and other NetWare or Windows APIs. +++++++++++++++++++++++++++++++++++++++++++++++ Anyone interested should respond to: Attn: Mr. Don Wagner CPI 7301 E. 90th St. Indianapolis, IN 46256 Fax: 317-842-0278 email: dwagner(a)commprod.com Thanks in advance for your help. jk

1 0

Transitive trust and MLM
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I have a few thoughts relating to the "web of trust" versus hierarchical key certificate systems. This description is pretty elementary and is intended more for people who have not been familiar with the issues before. First some background. The problem to be solved is how to know that a particular public key is actually associated with a particular person. This actually gets into some fuzzy philosophical areas in terms of what we mean by a person and what this association involves, but let's avoid those and just consider the specific question of binding a key to a particular email address and/or user name. Most of the "corporate" systems being advanced today use a hierarchical approach. One or a small number of trusted key certification authorities (CAs) are at the root of a tree. The root CA issues key signatures binding keys to ID's. However usually these are not the ID's of end users, but rather of other lower-level CA's who will be associated with some smaller domain. These may sign yet other CA's keys, until the whole world is partitioned into small enough pieces that the lowest level CA's actually sign user keys. This is often mapped onto a corporate model where a company has a master CA key which gets signed by the root CA (or perhaps by a lower level CA between the root and corporate level), and which then, depending on the company size, may directly sign the keys of employees, or at the other extreme will sign keys for a division, which will sign them for a department, which will sign them for a group, which will then sign the employee's keys. Similar structures can be used for educational institutions as well. The idea behind this is that at each level only a relatively small number of keys are needed, and the signatures are on entities closely related to the key doing the signing. So the key signer is in a position to verify the accuracy of the signatures he is making. PGP uses a completely different system which Phil Zimmermann calls the "web of trust". It also uses the idea of key signatures, but there is no hierarchy. Instead, each person individually decides which other signers he will trust. A key which has a signature from a trusted signer is accepted as validated. PGP also allows people to specify other signers as partially trusted. A key will be accepted if it has multiple signatures by partially trusted signers. It is important to eliminate a common misconception about the web of trust. Suppose Alice signs Bob's key, and Bob signs Clara's, and Clara signs Don's key. Suppose further that Alice trusts Bob and Bob trusts Clara as key signers, but that Alice doesn't know Clara. In terms of PGP's web of trust, this does not give a chain from Alice to Don which lets her trust his key. Alice has to have a signature on Don's key by someone she trusts. In this case, since she doesn't know Clara she presumably can't trust her, and hence Clara's signature on Don's key is worthless to Alice. I had many discussions with Phil during the time when he was developing this concept, and he was adamant about the importance of this point. The phrase he used was "trust is not transitive". Transitivity is a mathematical property where if A has some relation to B, and B has the same relation to C, then A has that relation to C. For example, "greater than" is transitive with respect to numbers. But trust in general cannot be considered to be transitive in this sense, as Phil saw it. Asking Alice to trust Bob to sign keys is one thing. But asking her to trust everyone that Bob trusts as a key signer is something else. That requires a lot more insight into the mind of the other person, to judge not only whether he is careful about his key signatures, but whether he is careful about judging how careful other people are about key signatures. The situation reminds me of a maxim of multi-level marketing (MLM) companies like Amway. These businesses typically sell a product, but they use a pyramid scheme for distribution where people not only sell the product, but try to recruit others to sell for them. Each person not only gets profit for the sales he makes, but he gets a share of the profit for sales made by the people he recruited, and a further smaller share of the profits from the people they recruit, and so on. If he gets a large enough "downline" of people selling below him then he can actually retire and just live off the profits they are producing. At least, that is part of the sales pitch for these outfits. To achieve success, though, the saying goes like this: You not only have to sell; you not only have to teach your people to sell; but you have to teach your people to teach people to sell. Only once you have developed this skill do you have a chance of having really big success in MLM. The idea is that being a good salesman is not enough. You have to recruit people and teach them to be good sellers, but that is not enough either. You also have to take your recruits and teach them not only to be good sellers, but also teach them how to pass this knowledge on down the line so that the whole downline thrives. (It does seem strange that the saying stops where it does. Don't you also have to teach your people to teach people to teach people to sell, etc.? I think though the human mind starts to lose track of what these increasingly abstract goals would mean. Stopping where they do conveys the idea that the teaching must be carried on indefinately at each level.) The analogy to transitivity of trust is this. If you want to have transitive trust, you have to be sure the other person knows how to securely sign keys. But you also have to make sure he knows how to make sure that the next person knows how to securely sign keys. And further you have to make sure he knows how to make sure the next guy knows how to make sure, and so on. Note too that the hierarchical structure of the MLM is similar to that used in traditional hierarchical key CA's. So this points out one of the big problems with these systems, which is the requirement to have transitive trust. Just trusting the root CA is not enough. You have to trust that it makes sure that all the CA's whose keys it signs will be careful, as well. And further it has to make sure that each lower-level CA will pass on the need for care to all the CA's below it. At the time this concept was created, several years ago, users of the net largely consisted of students and employees of national labs and large corporations. The hierarchical idea mapped pretty well into the large bureaucracies which ran these places. But today things are different. It's hard to see how a hierarchy would work for the subscribers to AOL or MSN. So instead one idea is to flatten the hierarchy. Instead of a CA giving out perhaps a few dozen key signatures, it might give out hundreds of thousands. Obviously this is a totally different concept in terms of the checking possible and the security of the resulting signatures. At least there is less delegation and transfers of trust. But the logistical problems can be very large. PGP takes care to avoid transitive trust. When you mark various key signers as trusted, it is very careful to strip out that information when you extract a key for sending to someone else. Phil had another reason for this beyond the general difficulties mentioned above. The basic problem is the social implication of trusting or not trusting another person as a key signer. Revealing that information could cause difficulties. People might be offended to learn that someone else doesn't trust them. Worse, people might feel pressure to trust someone else if this were public knowledge. Maybe the other person is in a position of power where publically offering trust would be valuable. These kinds of social interactions could ruin the meaning of the trust markings. So PGP doesn't allow it at all. However the problem is then that with PGP it is hard to find someone you trust who can reliably sign the keys of people you want to communicate with. In a small group with many social interactions it can work OK, but if you see a random posting by someone who sounds interesting, the chances that you know someone who has signed his key are very small. So I don't think that the web of trust in practice works very well, at least for a lot of the communication that people do. Unfortunately we are left with a choice between three not very good possibilities: accept transitive trust and hierarchical key CA structures; use very flat hierarchies where one signer validates huge numbers of keys; or accept that only a small number of keys can be validated by key signatures. I think all these are troublesome and in fact it makes me question the whole notion of key signatures. Hal Finney -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBMY+NZxnMLJtOy9MBAQEE6gIAro4leHAsPn6OaqDreXY9/zhhOgQjLKTB YzESC3lmIDEo1TnSGeibh2pM4N+VfO6ReqB5GQP0vxss2Rb3Ud2yug== =KFDL -----END PGP SIGNATURE-----

2 1

MS Personal Effects Exchange
by Joel McNamara 17 Dec '03

17 Dec '03

Interesting proposal from Microsoft regarding digital certificates (containing keys and a variety of other information) that can be moved from one computer to another. A typical marketing response viewing Navigator supports certificates and Explorer doesn't. If certificates really take off, that 80 to 90% of the market that currently uses Netscape is going to be hesitant to switch over to Explorer. Love the name. Aren't personal effects what are left over after they body-bag you or what the the cops call the contents of your pockets after you're busted... Details at: http://www.microsoft.com/INTDEV/SECURITY/BRINK009.HTM

1 0

RSAREF and the Mac...
by Peter Wayner 17 Dec '03

17 Dec '03

Has anyone ported RSAREF to Metrowerks's compiler for the Mac? The PGP project has converted it to run with Think C, but what about Metrowerks? Also, where can I get plain RSAREF? I couldn't find it at www.rsa.com. Do I need to sign something? Thanks, Peter Wayner

1 0

money laundering conference
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

OTC 05/06 1518 ADVISORY/International Money Laundering ... (May 6) BUSINESS WIRE -May 6, 1996--With attendees coming from across the United States and from Latin and South America, more than 200 people are expected to participate in the Third International Money Laundering Conference May 15 and 16 in Miami. The likely attendance is the largest since the conference was first held in 1993. "New federal rules and laws, as well as concerns about emerging techniques to launder money, such as using the Internet, are generating intense interest," said Charles A. Intriago, publisher of Money Laundering Alert and a leading authority on the subject. Money Laundering Alert is co-sponsoring the conference with America Lawyer Media, which publishes American Lawyer magazine and operates the Court TV network. ALM also publishes the Daily Business Review in South Florida. This year's conference will include panel discussions on sush topics as ways to detect and counter new forms of money laundering including so-called "cyberlaundering" and trade laundering; the "alphabet soup" of world money control rules, laws and organizations; cooperative blueprints for financial institutions and governments to prevent money laundering; hidden traps in U.S. laws, new suspicious reporting rules and the workings of the U.S. Office of Foreign Assets Control. Speakers include officials from the IRS, SEC, FBI, Federal Reserve, Office of the Comptroller, Justice Department and other government agencies, as well as private-sector bankers, lawyers and academic experts. Among the panelists this year are Senior U.S. District Judge William M. Hoeveler of Miami, the presiding judge in the federal government's money laundering case against former Panamanian dictator Manuel Noriega, Gerald F. McDowell, chief, asset forfeiture and money laundering section of the U.S. Justice Department, Richard A. Small, special counsel, Federal Reserve Board, and John J. Byrne, senior legislative counsel for the American Bankers Association. The two-day session will be held at the Hyatt Regency Hotel in downtown Miami. Information on conference attendance can be obtained by calling Money Laundering Alert at 800/232-3652, or 305/530-0500 (Fax 305/530-9434). Reservations can be made by calling the Hyatt at 305/358-1234. There are still a limited number of places available. Limited sponsorships for conference events are also available. Credentials for accredited members of the media will be extended. The conference is drawing interest from news media in this country, South America and Europe. --30--jd/mi CONTACT: Alert Publications Wendy Brown, 305/530-0500 or Daily Business Review Martin Donsky, 305/347-6617 KEYWORD: FLORIDA INDUSTRY KEYWORD: BANKING PUBLISHING ADVISORY REPEATS: New York 212-575-8822 or 800-221-2462; Boston 617-236-4266 or 800-225-2030; SF 415-986-4422 or 800-227-0845; LA 310-820-9473 BW URL: http://www.businesswire.com

1 0

Re: Police tactics question
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

At 11:26 PM 5/6/96 -0400, Michael Froomkin wrote: >One of my students has written a paper that may answer some of your >questions, Online Stings: High Tech Entrapment or Innovative Law >Enforcement?, by Jeffrey D. Weinstock >http://www.law.miami.edu/~froomkin/seminar/papers/weinstock.htm Also, I'll stick in a plug for a paper I wrote a year ago for Mitch Kapor's "Political Economy of the Digital Infrastructure" class at the Media Lab: Entrapment in Cyberspace -- On The Likelihood of Digital Stings http://farnsworth.mit.edu/~reagle/career/stuff/sting.html _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Police tactics question
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I've often heard of the police/postmaster mailing someone child pornography prior to going in and busting them for possession of it. What are the legal matters in such cases? Thanks, -Allen

5 4