December 2003 - cypherpunks-legacy

ecash payee anonymity, cpunk archives
by Alex Strasheim 17 Dec '03

17 Dec '03

A while back someone posted a note saying that an ecash protocol garaunteeing payee as well as payer anonymity had been devised. Did that ever get posted here? The last message I saw said that it would be posted soon. Also, I missed whatever discussion there was about why the archives got shut down. Was it a copyright thing? A lack of resources? No one to volunteer? -- Alex Strasheim, alex(a)proust.suba.com

3 2

Re: Police tactics question
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"reagle(a)mit.edu" "Joseph M. Reagle Jr." 7-MAY-1996 15:31:28.97 > Also, I'll stick in a plug for a paper I wrote a year ago for Mitch >Kapor's "Political Economy of the Digital Infrastructure" class at the Media >Lab: >Entrapment in Cyberspace -- On The Likelihood of Digital Stings >http://farnsworth.mit.edu/~reagle/career/stuff/sting.html Actually, I found that one also. Nice things, web search robots. Thanks, -Allen

1 0

Re: misunderstandings of PICS
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"vznuri(a)netcom.com" "Vladimir Z. Nuri" 6-MAY-1996 18:53:10.45 >but OK, I see that the CyberAngels have focused on a part of the >PICS proposal that can be twisted into their own unique interpretation. >I see you/they have a semi-valid concept here. frankly, it only suggests >to me how dangerous the "self-rating" concept is, and perhaps that >it should be downplayed in the PICS proposal imho. (any PICS designers >out there listening?) The simplest cure for this, and one that would be effective - unlike implorings by the PICS designers - would simply be to not have inclusion of a rating in a page as part of the protocol. In other words, if you want a rating, get it from an agency. >> Yes, this is an abuse of the market oriented variety of PICS; >>they obviously don't know and/or don't care. If you want to convince them >>otherwise, start cc:ing your messages (and forwarding mine, on this I give >>you permission) on PICS and the CyberAngels to angels(a)wavenet.com. >since you are so interested and brought it up, I think you ought to >do it. I am doing all that I care to do in posting to this group. you >have given me reason to write on the issue. As I have previously stated, I irritated Mr. Hatcher by trying to get the CyberAngels to concentrate on spamming and other actual dangers to the Net, as opposed to their censorship efforts. (I count acting as an informant for governmental censorship a variety of censorship). Consequently, I have been asked not to mail to them. >Incidentally, their pressure (especially the legal variety - acting as >informants) could also include against an ISP that doesn't do the second for >material the CyberAngels don't like. >I do hope the CyberAngels seize on the other aspects of PICS that would >effectively let them put CyberAngel stickers on every single page in >cyberspace, if they have the attention span to actually pull this off. Quite. Anything that both the CyberAngels and, say, the Christian Coalition rate as unsuitable for minors is likely to be interesting. -Allen

1 0

Freedom of Information Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

IIRC, the FOI act has come up here before. Possibly this list may provide some answers. -Allen From: IN%"rre(a)weber.ucsd.edu" 7-MAY-1996 00:36:11.83 From: Phil Agre <pagre(a)weber.ucsd.edu> =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Thu, 2 May 1996 17:23:13 -0400 Sender: State and Local Freedom of Information Issues <FOI-L(a)LISTSERV.SYR.EDU> From: "Barbara C. Fought" <bcfought(a)MAILBOX.SYR.EDU> Subject: how-tos for FOI-L I've gotten several questions lately about the correct address for this mailing list discussion. It changed a year ago. Some of you may want to unsubscribe for the summer. Or put this on digest (all messages once a week) or vacation stop. Save this message for future reference. For any change in service you send an e-mail message to: listserv(a)listserv.syr.edu In the body of the message you type one of the following, depending on what you want to do: WHAT YOU WANT COMMAND (put in body of email TO DO message, not in the subject line) subscribe subscribe FOI-L firstname lastname unsubscribe unsubscribe FOI-L get a digest set FOI-L digest vacation stop set FOI-L nomail resume delivery set FOI-L mail list of subscribers review FOI-L _____________________________________________________________________________ Barbara Croll Fought Asst. Prof., Broadcast Journalism list manager, FOI-L S.I.Newhouse School, Syracuse University bcfought(a)mailbox.syr.edu 215 University Place voice: 315/443-4054 fax: 315/443-3946 Syracuse, NY 13244-2100 _____________________________________________________________________________

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hfinney(a)shell.portal.com" "Hal" 7-MAY-1996 18:58:41.28 >Unfortunately we are left with a choice between three not very good >possibilities: accept transitive trust and hierarchical key CA >structures; use very flat hierarchies where one signer validates huge >numbers of keys; or accept that only a small number of keys can be >validated by key signatures. I think all these are troublesome and in >fact it makes me question the whole notion of key signatures. I think the web-of-trust without transitivity of _some_ trust is too limited. If a lot of completely-trusted key signators have signed a key, and that person's key is self-signed and has signed the keys of those key then keys signed with that person's key are significantly more likely to be good than those without this signature. I wouldn't count the person as a completely-trusted signator, but I wouldn't count them at 0 either. However, the above is just my opinion. Have any studies been done of the likelihood of a key to be later discovered to not match up to the claimed nym? I suspect there isn't adequate data as yet, but it could still be a good thing to check. -Allen

1 0

Re: Transitive trust and MLM
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:50 AM 5/7/96 -0700, Hal wrote: >Unfortunately we are left with a choice between three not very good >possibilities: accept transitive trust and hierarchical key CA >structures; use very flat hierarchies where one signer validates huge >numbers of keys; or accept that only a small number of keys can be >validated by key signatures. I think all these are troublesome and in >fact it makes me question the whole notion of key signatures. Some of the solution to this problem may come from the answer to the question, "What am I trusting the receiver with?" I can see a number of possibilities: (1) I just want an envelope so casual eavesdroppers can't read the mail. Given the people Rich Graves has been dealing with, I see this as a powerful reason to encrypt all private email, just as you might send all private postal mail in envelopes rather than on postcards. In this case, I don't need a lot of confidence. Yes, a man-in-the-middle (MIM) can read the mail, just as the post office can open the envelope. However, the rest of the world won't see it unless the MIM wants to get caught. End-to-end, out of band acknowledgements can ensure that the message gets thru. (If the people I'm going to the mountains with don't pick me up, and I got in-band acknowledgements, I WILL suspect a MIM.) (2) I am sending someone else's secrets to a perfect stranger. An example might be sending company confidential information to a researcher another company R&D center half way around the world. In this case, I want to get the key from a location approved by the owner of the secret, making the problem the companies and not mine. (3) I am sending information which, if released, might cause significant harm to me or someone close to me. I can't see sending information of this nature to someone I don't know really well. In this case, out-of-band key fingerprint exchanges will work well. Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

2 1

Security Scruffies vs Neats, revisited
by smith＠sctc.com 17 Dec '03

17 Dec '03

This is an attempt to restart the discussion in a slightly different direction. I've been giving the topic some thought since Tim's truncated essay appeared. But when I re-read it just now, I realized that I read in my own interpretation of "scruffy" and "neat" to this. IMHO, the critical property of AI scruffies is that they believe in the value of some notion of emergent behavior -- if you build it right, it'll surprise you and do something clever and unexpected to fulfill its objectives. The "neats" have to know exactly why the behavior emerged, but the scruffy methodology almost never allows such a detailed analysis to succeed. Intuitively, I tend to think of scruffies as trying to build biological processes or concepts into computers. The goal seeking built into IP packets, for instance. The Internet is an impossible artifact, if you view distributed computing with '70s blinders. Nobody would want to cede control so much to largely autonomous routers. Once you drop an IP packet into the "system" it generally gets to its destination or dies of old age trying. When I try to apply this style of thinking to security, I find myself going towards layered defenses. These goal seeking, semi biological processes are somewhat failure prone, so you probably need a set of them to make things "safe." Falling back to biology, we see "security" in the various defensive mechanisms developed in plants and animals. But now things start to break down. "Security" these days means more than defense -- it means access control. "Let me in" as well as "Keep them out." How do you "tune" or "train" a semi-biological mechanism to exert such fine control? It's not clear to me that you can. When I read Kevin Kelley's book "Out Of Control" I kept wondering who wanted to live with his semi-biological toasters and heating plants, tolerating burned toast and frozen bathrooms until the devices finally "learned" how to behave. (but I shouldn't get started on that book -- I once wrote 20 pages of notes about how bogus I thought it was). In other words, the problem may be with the concept of security itself. Defense seems to be a biological concept, but security is not. It's too artificial, involving the reflection of some abstract and arbitrary human intent. Constructing a subsumption device to collect pop cans is one thing, but building one to construct a cuckoo clock (or play doorman) is something else. Rick.

1 0

Re: Why I Pay Too Much in Taxes
by nobody＠replay.com 17 Dec '03

17 Dec '03

Timothy C. May wrote: >Indeed, I am extremely limited in how I can avoid complete traceability of >my major income sources. Not rich enough to shelter income in a really big >time way That's just lack of creativity. Try this: Get a friend of yours to setup a consulting company and hire you (and maybe a few more people who pay too much taxes,acting like a mixmaster). The company pays you salary to cover your cost of living. Anything above that, i.e. money that you would otherwise save, is paid to an offshore company as license fees (or something, this is the creative part). This is really legal as long as you don't receive any money from offshore without paying the taxes. If you borrow the money back it gets a little fuzzy. Thousands of people in upper middle class are doing exactly this, so the mixmaster is really in place already. The local mix is just an extra precaution for deniability (it was my friends company, I had no idea what he was up to!). For the friend to accept the (very minor) risk of jail, he/she should probably be much poorer than you, or have a *lot* of clients, to make his pay outweight the risk. By the way, are there any PGP encrypted mailing lists for discussing serious tax fraud? Mr.X

4 4

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

No one answered me. What's the best remailer-in-a-box. I'd like to run one. I would think people would be falling over eachother to tell me.

1 0

Re: Attorney-Client / Nyms
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"unicorn(a)schloss.li" "Black Unicorn" 29-APR-1996 02:21:48.23 >On Sun, 28 Apr 1996, E. ALLEN SMITH wrote: >> Given discussions as to attorneys holding passphrases, et al, perhaps >> a tutorial from the lawyers on the list (yourself and others, since >> disagreements among J.D.'s have been known to happen) on what attorney-client >> confidentiality does cover? >Proposed FRE 503 probably has the best codification of the prevailing >common law on the subject. I reproduce it in part below. Typos are mine. Thank you. >Note the confidentiality requirement. A client is estopped from claiming >privilege if he discloses the content of the communication to a third >party not connected to the attorney-client relationship. Understandable. >The identity of the client and the existance of the attorney client >relationship are not confidential. There are some exceptions. What are the exceptions? >Communications regarding future crimes or frauds are not protected. I kind of knew that already... as should others. >Stolen property may be held by an attorney for a reasonable time for >inspection purposes, but must be returned to the rightful owner or the >attorney will be a receiver of stolen goods and participating in an >ongoing crime. Privilege will thus not apply. In re Ryder, 263 F.Supp. >360 (E.D.Va 1967). (Some courts will permit the attorney to refuse to >disclose the source from which he obtained the property, however). >Consider this in the context of trade secrets. A good point... although if it hasn't been proven whether something is stolen (e.g., an encrypted piece of data sent to the attorney), I would hope that privilege would still obtain. Of course, there would be the question (also important for First Amendment issues) of whether information that the recipient can't understand is communication. >All states have laws against destroying or concealing evidence. The >attorney who advises his client to destroy evidence is a co-consiprator. >Privilege does not apply. Clark v. State, 261 S.W.2d 339 (Crim. App Tex. >1953). (Interesting to wonder if advising a client to encrypt evidence is >'concealing' it). A good question. Of course, again there's the point of what if the attorney has investigated the matter and decided that no crime is being committed, but that the material should be destroyed because it could be embarrasing, lead to other problems (e.g., civil lawsuits), etcetera. If a court later decides that the attorney was wrong, would privilege still obtain, and would the attorney be a co-conspirator? I would hope the answers would be yes and no. >> Most of them aren't anonymous, either... although that does give me >> the thought of going to one outside the US and its reporting requirements. >> They'd know who I was (or at least the address it was going to), but at >> least nobody else would know. Any suggestions, since you've been writing of >> the joys of nymdom recently? >I suggest you use a forwarding service, sign up with your nym name, and >provide the address of a P.O. box for them to forward to, also in the name >of your nym. The P.O. box signed up in the name of the nym would be a problem, however, given the current laws on ID necessary for this. Of course, this assumes not using fake ID (including that of a fictitious employer). I've gotten a couple of P.O. boxes in my own name recently (not wanting to disclose my current address), and they did want a couple pieces of ID. I should check what ID they will accept. -Allen

1 0