December 2003 - cypherpunks-legacy

Re: PGP, Inc.
by timd＠consensus.com 17 Dec '03

17 Dec '03

At 11:10 PM 5/9/96, E. ALLEN SMITH wrote: >From: IN%"shamrock(a)netcom.com" 9-MAY-1996 23:02:01.67 > >>At 19:37 5/9/96, E. ALLEN SMITH wrote: >>> I can see some fascinating legal questions with what, exactly, a >>>VeriSign certificate obligates the company for. Digital signature laws should >>>get interesting - any application of this to the Utah one? > >>VeriSign is going to offer four levels of certs. The first requires only >>uniqueness. For the other three levels, VeriSign will require more and >>better assurances of the correctness of True Name stated on the cert. I >>don't know what form these assurances are supposed to take. > > The first level, in other words, is less of a certification than a PGP >key with self-signature and signature from one other person. It doesn't have >_any_ effort to verify that the email address stated on it is the actual email >address of that nym. Or am I misinterpreting you? The only effort they make is that when using the email-based CA, it mails the certificate to the address within, so it's not trivial to get a cert for an address that you don't have access to. (I'm not saying it's impossible, or even hard, just that it requires some skill and effort). - Tim Tim Dierks -- timd(a)consensus.com -- www.consensus.com Head of Thing-u-ma-jig Engineering, Consensus Development

3 2

Edited Edupage, 9 May 1996
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"educom(a)elanor.oit.unc.edu" 9-MAY-1996 22:01:14.77 >REGIONAL BELLS WANT RATE HIKES FOR WIRING SCHOOLS >The United States Telephone Association would like to raise the average U.S. >monthly phone bill by about $10 over the next five years to pay for wiring >schools and libraries with new lines for phones and computers, and to >subsidize poor and rural customers. The proposal assumes an $11 billion >cost for wiring schools and libraries, with local phone companies paying >about a third to a half of that. The rest would come from a surcharge on >other services, such as cellular. "No single industry should be held >responsible for fulfilling this major goal," says USTA's president. "Each >has a role and should make a significant contribution to the national >education technology mandate." (Investor's Business Daily 8 May 96 A7) The "subsidize poor and rural customers" line makes me glad I don't have a phone line. >ALLIANCE SEEKS ELECTRONIC SECURITY >An alliance of software companies has established the Electronic Licensing >and Security Initiative to develop a system that uses electronic tokens >linked to a software package to securely track software rentals, licenses >and purchases. The group also plans to develop an electronic clearinghouse >to provide and track licenses. Several major software producers, including >Microsoft, IBM and AT&T have said they will support the Initiative's >technology. (Wall Street Journal 6 May 96 B6) Anyone know how this is supposed to work? It sounds like a non-anonymous digital cash system, in essence. >IBM'S INFOMARKET TOLL BOOTH >IBM has persuaded some 30 companies, including Eastman Kodak, Xerox, >Reuters, America Online and Yahoo!, to use its new infoMarket >electronic-content clearinghouse for displaying and distributing their >wares. The infoMarket concept requires customers to pay for only what they >use, with the content providers controlling the information and setting >their own prices. "Charging only for what you want is a very attractive >scheme," says one electronic database provider. The system is based on >"Cryptolopes" -- secure electronic packaging that, when opened, bind the >user to a contractual agreement regarding the use of the content. If the >content is distributed beyond that agreement, the technology can track its >usage and bill the original purchaser for subsequent viewings. "It's a >complete break from all other ways information has been published on the Net >to date," says an industry consultant. "It turns pass-along from a business >threat to a business opportunity." (Business Week 13 May 96 p114) Again, it's not clear how this is supposed to work. It does remind me of that information-network thing that was promoted on the Extropian lists, except that didn't have any provisions on reuse. -Allen >*************************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Alfred North Whitehead (if your name is Alfred North Whitehead; otherwise, >substitute your own name). ... To cancel, send a message to: >listproc(a)educom.unc.edu with the message: unsubscribe edupage. (If you >have subscription problems, send mail to educom(a)educom.unc.edu.)

1 0

Re: Why I Pay Too Much in Taxes
by Duncan Frissell 17 Dec '03

17 Dec '03

At 01:32 PM 5/9/96 -0400, Black Unicorn wrote: >> >> By the way, are there any PGP encrypted mailing lists for >> >> discussing serious tax fraud? >> >> > If such a list existed, would we tell an anonymous poster/fed? >> >> Well, if such a list does exist, I would like to know about it. >> >> -Robin >> > >Again, in the absence of any credentials or recommendation, I can't see >how the moderators/originators/managers of such a list would disclose the >details of its publication. Such a list could be published openly in any case since discussing techniques of tax fraud is legal. Even advocay would be legal in almost all cases. (Since tax fraud is a non-violent crime, you don't have any of these 'agitating an angry mob' scenarios.) As long as you avoided conspiring with anyone, you can discuss techniques all you like. Some *participants* might like to subscribe anonymously however. DCF

1 0

Free demo disk of "distorted number" crypto
by Mark O. Aldrich 17 Dec '03

17 Dec '03

C'punks: I got a call from a group in Maryland called "Marketing Technologies, Inc." They are starting to distribute free demo copies of a new crypto technology created by "Blackstar, Inc." The crypto product, called "Supercrypt," is based upon "distorted number generation." This does not appear to be the product sold under the same name by Computer Elektronik Infosys. Naturally, I enquired as to where the algorithms had been published in the technical literature, but the sales rep indicated that, while copyrighted, Blackstar does not yet hold a patent so they are concerned about releasing the details. She described the product as using a "proprietary" algorithm. If you'd like to get a demo copy of the software, call Marketing Technologies at 301.588.1971. You'll probably be speaking with Linda Greenwald, who's got _some_ information available, but not anything that's technical. They are also offering a technical write-up via fax-back at 301.588.2162. Note that I'm not endorsing this product, I'm just relaying information that may be of interest. If anything, you can get a copy of a new toy to muck with in your spare(?) time. No, they are not yet on the Internet. I'll relay my experiences with the product after I get it. ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

2 2

Re: remailer@utopia.hacktic.nl down
by Rich Burroughs 17 Dec '03

17 Dec '03

At 07:15 PM 5/9/96 -0700, qut(a)netcom.com (Dave Harman) wrote: [snip] >Oh, in what way was Elrom racist? (he's not anti-asian or anti-semitic, >for instance) [snip] Chris Owen has written an essay about Hubbard's support of the racist South African govt. http://www.demon.co.uk/castle/audit/aprtheid.html He quotes Hubbard as writing: "Just as individuals can be seen by observing nations, so we see the African tribesman, with his complete contempt for truth and his emphasis on brutality and savagery for others but not himself, is a no-civilization." Rich ______________________________________________________________________ Rich Burroughs richieb(a)teleport.com http://www.teleport.com/~richieb See my Blue Ribbon Page at http://www.teleport.com/~richieb/blueribbon New EF zine "cause for alarm" - http://www.teleport.com/~richieb/cause

2 1

Internet en danger
by gep2＠computek.net 17 Dec '03

17 Dec '03

You think we're having problems here in the USA with the idiotic CDA, right? I just received the following message from a colleague and friend who operates a large ISP in Paris, France. The translation is mine, and I can't assure its total accuracy, (anyone who sees an error on my part, please correct it for me). I'm leaving the original French so that the original intent of the message can be viewed. <---- Begin Forwarded Message ----> Return-Path: opinions(a)storm.certix.fr Date: Thu, 9 May 1996 19:42:12 +0200 From: Communication client <opinions(a)storm.certix.fr> To: gep2(a)storm.certix.fr Subject: Internet en danger > Cher(e)s abonne(e)s, Dear Subscribers, > Nous n'avons malheureusement plus la possibilite de vous laisser acceder au service de News. Exception faite des news world-net.communnaute, world-net.support, fr.network.internet. Unfortunately, we no longer have the possibility to let you access Usenet. The only exceptions are the newsgroups "world-net.communnaute", "world-net.support", and "fr.network.internet". > En effet, la justice francaise rend actuellement World-Net responsable de tout ce qui est diffuse sur Internet ; j'ai ete personnellement, en tant que responsable de World-Net, mis en examen hier parce que des images a caractere pedophile, venant de l'autre bout du monde etaient accessibles par notre service de News. Aujourd'hui les news, demain peut-etre le web. The French courts currently hold World-Net responsible for everything which is distributed on the Internet; I was personally, as director of World-Net, interrogated yesterday because some pedophile images, coming from the other end of the world, were accessible through our News server. Today Usenet, tomorrow perhaps the Web. > La majorite d'entre vous connait le fonctionnement du reseau Internet et sait bien que World-Net n'est que votre transporteur sur ce reseau. Cependant nous n'avons pas le choix. The majority of you understand the functioning of the Internet network and clearly realize that World-Net provides merely your access to this network. It's not a matter of our choice. > Nous diffuserons sur notre serveur Web l'ensemble des informations citees dans la presse et a la television concernant ce dossier. We will distribute via our Web server complete information as cited in the press and on television concerning this whole affair. > Si vous voulez soutenir World-NET, envoye un mail de soutien a opinions(a)worldnet.net. If you want to support World-NET, send a mail message of support to "opinions(a)worldnet.net". > Sebastien Socchard Directeur de World-Net. (director of World-Net) >Ci-joint le communique de presse de l'A.F.P.I., que nous remercions pour leur soutient : Here is the press release from the A.F.P.I., which we thank for their support: >COMMUNIQUE DE PRESSE DE L'A.F.P.I. Association FranÁaise des Professionnels d'Internet PRESS RELEASE FROM THE A.F.P.I. French Association of Internet Professionals > Mardi 7 Mai 1996 Tuesday, May 7, 1996 > Affaire: Newsgroups/Pedophilie/Internet: deux dirigeants en gardes a vue. Affair: Newsgroups/Pedophilia/Internet: Two directors <translation?> > Resume: "Nous demandons a l'ensemble des providers >franÁais et des administrateurs des reseaux d'universites de fermer l'acces a tous les Newsgroups, afin que plus un seul Newsgroup ne soit accessible du territoire franÁais, du moins tant que les fournisseurs d'acces n'auront pas en France un statut clair". Summary: "We ask all French ISPs and administrators of University networks to close access to all Usenet newsgroups, such that no longer will even one single Newsgroup will be accessible from French territory, at least until French ISPs have a clear legal position within France." > Depuis 48h00 les deux dirigeants des societes FranceNet et WorldNet sont en garde a vue pour avoir simplement fait leur metier consistant a fournir l'acces a l'Internet... Since about 48 hours, two directors of French companies, "FranceNet" and "WorldNet" are <translation?> for having simply done their job, consisting of providing access to the Internet... > En effet, la Section de Recherches de Paris de la gendarmerie Nationale a procede lundi a leurs arrestations et a la saisie de leurs materiels, pour avoir diffuse au travers des Newsgroups des images pedophiles. Ces Newsgroups et les images qu'ils abritent, sont tous produits a l'etranger et rapatries comme le font la plupart des fournisseurs d'acces franÁais via les serveurs de News de Transpac, filiale de France Telecom. The Research Section in Paris of the National Gendarmes started on Monday their arrests and seizures of equipment, for having distributed pedophile images through the Usenet newsgroups. These Newsgroups and the images they contained (?) are all originated abroad and brought into France as is done by the majority of French access providers via the News servers of Transpac, which is a subsidiary of France Telecom. > Alors que la justice, dans une affaire similaire mais liee cette fois a des contenus racistes ou revisionnistes presents sur l'internet, ne s'est pas encore prononces a l'encontre de neuf fournisseurs d'acces, alors que le ministere des Postes et des Telecommunication, au travers de son ministre FranÁois Fillon assurait encore recemment qu'en aucun cas les fournisseurs d'acces ne pouvaient Ítre tenus pour responsables des contenus qu'ils ne produisaient pas et qui circulaient sur l'internet, alors que le lieutenant-colonel Browne, commandant la SR de Paris, reconnait lui meme que les serveurs en question recevaient, stockaient et distribuaient (tout comme Transpac) mais ne produisaient pas ces Newsgroups, deux hommes, deux chefs d'entreprises sont aujourd'hui en prison simplement parce que les autorites n'ont toujours rien compris a l'Internet et a son fonctionnement. The [French] courts, in a similar case but this time based on racist or revisionist contents present on the Internet, have not yet passed their judgement regarding nine ISPs, although the Ministry of Post and Telecommunications, through its minister Francois Fillon, stated again recently that in no case can access providers be held responsible for content that they do not produce and which circulates via the Internet, and although Lieutenant-Colonel Browne, commander of the Research Section in Pairs, admitted himself that the servers in question receive, store, and distribute (the same as Transpac), but do not produce these Newsgroups, two men, two company directors, are today in prison simply because the authorities still haven't understood anything about the Internet and its functioning. >La plupart des providers rapatrient de 6 a 8 000 Newsgroups chaque jour, soit plusieurs centaines de milliers de messages, pouvant egalement contenir des images. Parmi ces messages ils y a incontestablement des contenus contraire a la loi franÁaise (sans doute moins de 5%), tout comme il peut en circuler par la poste, ou dans les soutes a bagage d'Air France. Il est materiellement impossible pour un provider de controler l'ensemble du contenu des messages des Newsgroups, il lui est eventuellement possible de supprimer l'acces a ceux dont le titre est de faÁon evidente contraire a la loi (ex.alt.binaries.pedophilia...), ce qui n'empechera pas le lendemain de voir surgir un nouvel intitule pour remplacer le Newsgroup censure. Depuis plusieurs mois deja les membres de l'AFPI (Association des Professionnels de l'Internet) dont FranceNet est l'un des fondateurs, ont spontanement decide de supprimer l'acces a une vingtaine de Newsgroups dont le simple libelle ne laissait aucun doute quant au caractere illegal de leurs contenus. The majority of providers import from six to eight thousand Newsgroups each day, therefore several hundred thousand messages, any of which could also contain images. Among these messages there are incontestably some contents which are contrary to French law (no doubt less than 5%), just as they could circulate through the mails, or in the baggage holds of Air France. It is materially impossible for a provider to check the contents of all Newsgroup messages; it is possible to block access to those whose title is clearly contrary to the law (e.g. alt.binaries.pedophilia...), which wouldn't prevent the following day to see a new group appear to replace the censored one. Since several months already, the members of the AFPI (Association of Internet Professionals), of which FranceNet is one of the founders, have spontaneously decided to suppress the access of about twenty Newsgroups whose title left no doubt as to the illegal character of their contents. > Aujourd'hui ce sont les Newsgroups qui sont vises, demain ce sera sans doute le tour du Web. Si les fournisseurs d'acces, qui nous ne le repeterons jamais assez, ne sont que de simples transporteurs facilitant l'acces a un reseau, peuvent Ítre emprisonnes, avec comme simple piece a conviction un contenu produit au Canada ou en Australie, nous allons assister purement et simplement a la mort de l'internet en France. Today it is the Newsgroups which are wiped out, tomorrow it will be doubtless the Web's turn. If access providers, which we can never emphasize enough, are but the simple transporters facilitating access to a network, can be imprisoned, due to the singular cause of an item produced in Canada or in Australia, we are going to see, purely and simply, the death of the Internet in France. >En signe d'indignation, de protestation et de solidarite envers nos confreres FranceNet et Worldnet, le fournisseur d'acces ImagiNet, egalement membre fondateur de l'AFPI, a decide de fermer purement et simplement l'acces a tous les Newsgroups. Nous demandons a l'ensemble des providers franÁais et des administrateurs des reseaux d'universites d'en faire autant afin que plus un seul Newsgroup ne soit accessible du territoire franÁais, du moins tant que les fournisseurs d'acces n'auront pas en France un statut clair. As a symbol of indignation, of protest, and of solidarity with our brothers at FranceNet and WorldNet, the access provider ImagiNet, also a founding member of the AFPI, has decided to purely and simply close access to all newsgroups. We ask all French ISPs and administrators of University networks to do the same, such that no longer will as much as a single Newsgroup will be accessible from French territory, at least until access providers in France have a clear legal status. >Nous esperons sincerement que cet appel sera suivit par l'ensemble des prestataires de connexion internet. We sincerely hope that this call will be followed by all Internet access providers. >Nous nous excusons aupres de nos abonnes pour la gene ainsi occasionnee par une telle decision, mais nous savons que vous la comprendrez et que la majorite d'entre vous nous soutiendrons dans cette action. We ask the understanding of our subscribers for the inconvenience caused by such a decision, but we know that you will understand and that the majority of you support us in this action. > Patrick Robin President d'ImagiNet. robin(a)imaginet.fr Tel 43 38 10 24 <---- End Forwarded Message ----> Please feel free to forward this message to all appropriate venues. "If we don't all hang together, we shall assuredly all hang separately." ---Thomas Jefferson (?) Gordon Peterson http://www.computek.net/public/gep2/

1 0

Re: Transitive trust and MLM
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+IlYDbnW00UfAI10=1K(a)andrew.cmu.edu> Raph writes: > Now for the mathematical model. Signatures can bind keys to e-mail >addresses, or act as assertions that the signed public key is trusted to >transitively sign other keys. Let's assume that each signature has a >certain probability p of being good, and a 1-p probability of being >bogus, and that all probabilities are independent. These are probably >bad assumptions in the real world, but that's the difference between >theory and practice. I'm not happy with the independence assumption. Let's say I create a keypair, put "president(a)whitehouse.gov" in the name field, and try to get people to sign it as valid. (I don't know what you're asserting when you sign a key, but I'd say you're at least binding the key to the name and address attached to it.) Each signature has an /a priori/ probability p of correctly indicating validity, but these probilities are not independent at all: this key isn't valid, period. If one certifying signature is incorrect, all others on the same key must be, and vice versa -- about as correlated as they come. > Now we can actually evaluate the probability of a given key being >good. Consider a Monte Carlo process in which each edge in the graph is >present with probability 1-p. For each run, we determine whether the >recipient's public key (actually the binding between public key and >recipient's e-mail address) is reachable from our trust root. >The probability over a large number of runs is (given our assumptions) the >probability of the key being good. There are two separate problems: 1) key reachability -- do I think I can trust this key? 2) key validity -- is this key really okay? The graph reachability problem asks whether there exists a valid path. This is what you want for the key reachability problem. But the key validity problem should be asking whether all paths are valid; a single invalid path to me (posing as the Prez, remember) means that I get to read your mail to Bill (big deal, eh?). So you'd need to turn it around, and ask whether there exists an invalid path. From your use of "1-p" for the probability, you may have been thinking along these lines already. So an edge (u,v) in G indicates that u trusts v. With probability q = 1-p, Mallet is able to fool v. That is, Pr[(u,v) in G'] = q. Then we ask whether there's a path from s to t in G' -- that is, from you to the key you pulled off the net. If one exists, you lose. To limit transitivity, constrain the path length. This limits key reachability too, but I think we agree that it's essential in the real world. (It should also make the math simpler!) The model generalizes to non-binary conceptions of trust, but I don't think these can rehabilitate transitivity. Hmm, there are some possible approaches, though. These probabilities q are somewhat dependent: if I'm smart about whom I trust, all of the q_(me, v) values will be somewhat lower, and vice versa. I think they're mostly independent, though. But this is an improvised model; poke holes in it. -- . Eli Brandt usual disclaimers . . eli+(a)cs.cmu.edu PGP key on request . . violation of 18 U.S.C. 1462: "fuck".

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sameer(a)c2.org" 10-MAY-1996 06:48:23.53 > Also useful for chaining purposes. Yes, for the cryptographic purposes. It doesn't make much difference on the juristictional end of things - I'd need to locate a UNIX account in another country for that. Hmm... possible. -Allen

1 0

Bill Frantz, Churchill Club, Privacy
by Andre Bacard 17 Dec '03

17 Dec '03

Bill Frantz wrote an excellent review of the recent "Churchill Club: 20th Anniversary of Public Key Crypto" dinner & forum at the San Francisco Airport Marriott Hotel, an event which I attended. Bill's summary particularly caught my attention: Impressions: In conversation afterwards, I noted that discussion of personal privacy seemed to be politically incorrect in this group. Unless it directly supported corporate commerce, we didn't discuss it. It's worth noting that "privacy" and "security" -- in the practical Big Brother and corporate worlds -- are often opposites. In many instances, (personal) "privacy" shields individuals from organizations; whereas, "security" protects organizations from individuals. For example, when a corporation proudly announces that it has installed greater "security," it invariably means that the corporation has stepped up ways to spy upon employees. For obvious reasons, it is "politically incorrect" to discuss these issues in many quarters of society. See you in the future, Andre Bacard ====================================================================== abacard(a)well.com Bacard wrote "The Computer Privacy Stanford, California Handbook" [Intro by Mitchell Kapor]. "Playboy" Interview (See Below) Published by Peachpit Press, (800) http://www.well.com/user/abacard 283-9444, ISBN # 1-56609-171-3. =======================================================================

2 1

Re: Transitive trust
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sunder(a)dorsai.dorsai.org" "Ray Arachelian" 10-MAY-1996 16:37:22.44 >But it is - it's a pain in the ass, but you can always revoke your own >key and generate a new one, then sign everyone's keys whom you've signed >as trusted, EXCEPT the one you wish to revoke. Well... that has the problem that all the signatures on your old key won't transfer, so far as I know. Now, this may have the good effect of decreasing the effective reputation of anyone who goofs and needs to revoke a signature (and of causing people to check more carefully when first signing)... but it's also a motivation not to check carefully _after_ the first time (you might need to revoke it). This balance is also present about other reasons to revoke a key - on the one hand, someone who frequently revokes keys may not be keeping up with them very well, and thus should not be trusted. On the other hand, it may be someone who changes them on a regular basis for security (a reason to keep a master key to sign your key with & vice-versa, then get signatures on it) or someone who is keeping a sharp eye out for violations and will revoke a key whenever they suspect a problem. -Allen

1 0