December 2003 - cypherpunks-legacy

Re: Disappearing Cryptography
by pcw＠access.digex.net 18 Dec '03

18 Dec '03

>A book by Peter Wayner (pcw(a)access.digex.com) >of interest to cypherpunks. >(OK, cypherpunks mailing list subscribers then) > >There is more info at Peter's home page: >http://www.access.digex.net/~pcw/pcwpage.html >but I couldn't get to it when I tried just now. Yes, my service provider, DIGEX, is really terrible about providing access to my net page. I'm sorry about this, but if you need more information, feel free to write me. > >I got my copy from Border's in Houston on Sunday. > >He describes mimic functions, a particular interest of >mine. He also covers basic encryption, error correction, >secret sharing, compression, context free grammers, >anonymous remailers, reversible computing, etc. > >There is an evaluation of several stego packages, and >an inclusive (there isn't enough published about >steganography to call it extensive) bibliography. > >The presentation is at an introductory, but not trivial >level. I wish there had been more technical explanations, >but I suppose the author would have lost a sizable fraction >of an already tiny audience. > Yes, this was one dilemma I faced with writing the text and I decided that a "Scientific American" level text would be more likely to appeal to more people. In fact, my hope is that many people will be interested in a presentation of this level because of the political implications. If you can't find the information, you can't censor it. I think, though, that there will be plenty of meat on the bones of this book for many people. Anyone who reads cypherpunks carefully and works through the mathematical details won't find much new here, but I don't know if there is much else out there. The proceedings from the information hiding workshop in Cambridge will generate some more papers, but that's in the future. >By the way, "the people who participate on the cypherpunks >mailing list" get a nice "thankyou" in the preface. Of course this should be repeated and amplified. Many people post great stuff to the cypherpunks list. I couldn't have done it without you. My only regret is that the best people on the list might not learn much new from the book. Sigh. > >Rick F. Hoselton (who doesn't claim to present opinions for >others)

1 0

Remailer in a box
by Adam Shostack 18 Dec '03

18 Dec '03

You should at least bother to read the list before claiming no one answered. Adam >From adam Sat May 4 09:43:26 1996 >Subject: Re: your mail >To: anon-remailer(a)utopia.hacktic.nl (Anonymous) >Date: Sat, 4 May 1996 09:43:26 -0500 (EST) >Cc: cypherpunks(a)toad.com >In-Reply-To: <199605040605.IAA19372(a)utopia.hacktic.nl> from >"Anonymous" at May 4 >, 96 08:05:07 am >X-Mailer: ELM [version 2.4 PL24 ME8b] >Content-Type: text >Content-Length: 329 >Status: RO > >Mixmaster with my install script. Get mixmaster from www.obscura.com, >my installer by sending me mail with a subject line: >get mix-installer > >Adam <>----- Forwarded message from anonymous-remailer(a)shell.portal.com ----- <> <>From cypherpunks-errors(a)toad.com Tue May 7 22:11:26 1996 <>Date: Tue, 7 May 1996 15:51:06 -0700 <>Message-Id: <199605072251.PAA01721(a)jobe.shell.portal.com> <>To: cypherpunks(a)toad.com <>From: anonymous-remailer(a)shell.portal.com <>Comments: This message is NOT from the person listed in the From <> line. It is from an automated software remailing service operating at <> that address. <> THE PORTAL SYSTEM DOES NOT CONDONE OR APPROVE OF THE CONTENTS OF THIS <> POSTING. Please report problem mail to <hfinney(a)shell.portal.com>. <>Sender: owner-cypherpunks(a)toad.com <>Precedence: bulk <> <> <>No one answered me. <>What's the best remailer-in-a-box. <>I'd like to run one. I would think people would be falling <>over eachother to tell me. <>

1 0

Re: remailer-in-a-box
by Jay Haines 18 Dec '03

18 Dec '03

Reply to: RE>>remailer-in-a-box >>No one answered me. >>What's the best remailer-in-a-box. >>I'd like to run one. I would think people would be falling >>over eachother to tell me. >The reason for the quiet may be twofold. First, I and many others delete >unread list messages with out subjects. Second, remailer-in-a-box does not >.really exist. Mixmaster, and most of the other remailers are fairly easy to. >set up for anyone with UNIX experience. I run Mixmaster + Ghio + reorder >scripts. > -Lance Does one exist for the MAC? If not, would anyone be interested enough to see one developed?

2 1

Re: PGP, Inc.
by shamrock＠netcom.com 18 Dec '03

18 Dec '03

At 7:46 5/7/96, Raph Levien wrote: [...] > The S/MIME spec indicates the use of X.509v3 certificates, which, in >turn, are explicitly allowed to contain trust roots originating in the >client's local configuration. In other words, yes, the spec allows for a >Web of trust. > The big question, of course, is how easy the key management will be >in such a case. Everything I've seen points to key management being >super-easy if you use VeriSign certs, and probably just as bad as PGP >otherwise. Unlike PGP, most e-mail clients will probably not come >configured with the capablity to sign other keys - in the X.500 world, >e-mail clients and "certification authorities" are two separate >applications. Since VeriSign is going to issue certs for nyms for free, the only requirement being uniqueness, using their certs might not prove much of a problem. Disclaimer: My opinions are my own, not those of my employer. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: misunderstandings of PICS
by Clay.Olbon＠dynetics.com 18 Dec '03

18 Dec '03

At 5:31 PM 5/7/96, Joseph M. Reagle Jr. wrote (in part): >>my fear is that the supposed "failure" of self-ratings could be twisted >>by its opponents as evidence that it is inadequate to deal with the >>real problem. > > I think your fears are a little too paranoid here, but maybe they >aren't. The question is how much of this hoopola stems from fundamentalist >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better >educated and feeling pretty secure their kids won't get their hands on >naughty material. And then if self labeling had some failures, that's an >incentive for others to provide third party services (as others have >argued). PICS had to sell itself to the net as much as to the masses. >Self-labeling appeals to the net, it may appeal to the masses, but there are >other things in there to sweeten the deal for them if not. I disagree - paranoia is warranted here. One problem with our legislative process is that is is vulnerable to emotional issues. It is very easy to bring up issues that sound horrible (child porn, terrorist info, flag burning), then create legislation controlling them. Being opposed to this legislation for whatever reason brands you as "anti-family" or "soft on crime". It is clear to me that improperly labeled material will be paraded before congress and the media as justification for stricter control over this material. Congressmen, not wanting to face attack ads claiming that they support pornography (or terrorism, or whatever), will pass silly laws such as the CDA. It has happened before, it is naive to think that it will not happen again. There are only three solutions: 1) Vote in congressmen that support the first amendment. 2) Hope that judges protect our rights. 3) Deploy technological solutions that make any laws passed ineffectual. The first solution is improbable and the second is risky. Only the third solution actually provides a method where we can really have an impact. I think PICS is a great idea, and I think it may have an impact on judicial decisions. It should be implemented because it puts the control over information where it belongs, in the hands of the end-user. I would hope that it is a good-enough solution to avoid further control over the internet, but I have my doubts. Remember, if congress can try and legislate against something as innocuous as flag burning, what else would they be willing to do to curb our right to free speech? Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

Mandatory Voluntary Self-Ratings
by tcmay＠got.net 18 Dec '03

18 Dec '03

At 9:31 PM 5/7/96, Joseph M. Reagle Jr. wrote: >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better Regarding this "(which I see few cases in which it wouldn't)" point, I have a different view. Should "voluntary self-criticism" become widespread, I expect to rate all of my posts as suitable for children of all ages, suitable for hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. Regardless of whether I'm advocating post-birth abortions or forced encheferation of Muslim girls. Then we'll see what happens. (This is an old debate, here and on the Cyberia-l list, to wit, what happens when people/perverts/libertarians choose to subvert the voluntary ratings by deliberately mis-rating their stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters should be exposed to certain things?) I believe the whole debate about PICs-type ratings and other "voluntary self-labeling" has taken us astray. I don't see calls for authors to voluntarily self-rate their print works, nor do I see calls for newspapers to have articles rated. Nor speech in general. However, the drumbeat of "V-Chip" advocacy is now spilling over into cyberspace. I say it's a waste of our time to even be thinking or worrying about how to implement an infrastructure for ratings. In fact, building such an infrastructure could make later imposition of "mandatory voluntary ratings" (Orwell would be unsurprised) a greater likelihood. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

3 2

FBI probes CompuServe adult programming
by reagle＠rpcp.mit.edu 18 Dec '03

18 Dec '03

COLUMBUS, Ohio, May 8 (UPI) -- The FBI, acting on a complaint from a Christian morals watchdog group, Wednesday sought to determine whether CompuServe Inc. has violated a new law against indecency. FBI agents said they were attempting to determine whether CompuServe's Entertainment Drive, which contains some adult material, violates the Communications Decency Act. The law prohibits offering pornography to on-line users, especially minors. CompuServe, headquartered in Upper Arlington, noted parents can now block their children from reaching any adult-oriented content. Users must use a password to reach certain restricted areas. ``At this time we are not doing anything,'' CompuServe spokeswoman Daphne Kent told the Columbus Dispatch. ``We cooperate fully with any law enforcement agency, but we have not had talks with (the FBI) at this time.'' The FBI started the investigation after the Justice Department determined a complaint from the American Family Association had merit. A spokesman said American Family made CompuServe a target because the on-line service is one of the world's largest such businesses and offers sexually oriented content. American Family, based in Tupelo, Miss., also objects to CompuServe's MacGlamour Forum, which contains adult pictures and movies.

1 0

Re: self-ratings
by rick hoselton 18 Dec '03

18 Dec '03

Timothy C. May writes: >Should "voluntary self-criticism" become widespread, I expect to rate all >of my posts as suitable for children of all ages, suitable for >hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. >Regardless of whether I'm advocating post-birth abortions or forced >encheferation of Muslim girls. Not me. If someone doesn't want to be offended, then I would rather they never read anything from me, ever. I share family, race, culture, and backround with my father, and there have been times when I offended him unintentionally. One person liked me enough to marry me, but I occasionally offended her, too. Imagine how easily I might offend a stranger. Better to take no chances at all. If somebody wants a rating system, then they should just consider everything I have to say as "X-rated" in EVERY category, just to be safe. And that's a policy that everyone on the net should follow. If this self rating system becomes mandatory, I think the cypherpunks should cooperate fully, by notifying ALL sites that are not self-X-rated if they can find ANYTHING that ANYONE might EVER find offensive. Better safe than sorry. Nobody will be prosecuted for saying they have an offensive site, even if they don't. Imagine a prosecutor trying to prove that NOBODY could POSSIBLY be offended by my newsgroup postings! But many people will be prosecuted for not identifying their sites as offensive. Now, if everyone follows my advice, the net may become very boring for those who have their filters set on, but congress will NEVER make "being boring" against the law. If mandatory-self-rating ever becomes the law, cypherpunks can definitely promote true justice by strictly interpreting it and supporting it completely.

2 1

Re: Transitive trust and MLM
by Raph Levien 18 Dec '03

18 Dec '03

I'm really glad to see this thread. I think this is a problem that is well worth thinking about. I think what is really called for is a model of when keys are likely to be bogus, and when signatures, etc., are likely to be correct. Before going into the math, I'll go through some examples. Any key that's "well connected" in the MIT keyring is likely to be good. Specifically, if it's signed by lots of people, and each of those people is reachable from my trust root, then I'm pretty much willing to believe the key is good. Unfortunately, there are a fair number of reasons why a key may be bad. A really _cool_ thing to do with a compromised machine would be to sign a big bunch of bogus keys. Given how easy it is to compromise a machine, this is a very real worry. I don't know if this attack has been realized yet, but it's best to assume it could be and will be. Another weakness is the "clueless user" who signs keys gotten from the Net, or otherwise not properly verified. I don't claim to know all of the vulnerabilities, but I do think it would be a good idea to quantify them before designing a key distribution system. Hal calls into question the value of signed keys. To me, this points to the pressing need for better manual verification of keys, by communicating secure hashes through the phone and on physical channels, including business cards. These channels are more secure than the Net, are more convenient for all but the most hardcore net.heads, and would actually work quite well, I think. But I do think it would be nice to have access to "probably good" keys for casual e-mail. With luck, a densely connected Web of manually obtained keys can serve as a good foundation for the latter. Now for the mathematical model. Signatures can bind keys to e-mail addresses, or act as assertions that the signed public key is trusted to transitively sign other keys. Let's assume that each signature has a certain probability p of being good, and a 1-p probability of being bogus, and that all probabilities are independent. These are probably bad assumptions in the real world, but that's the difference between theory and practice. Now we can actually evaluate the probability of a given key being good. Consider a Monte Carlo process in which each edge in the graph is present with probability 1-p. For each run, we determine whether the recipient's public key (actually the binding between public key and recipient's e-mail address) is reachable from our trust root. The probability over a large number of runs is (given our assumptions) the probability of the key being good. One encouraging consequence of this model is that densely connected subgraphs can result in highly trusted keys even if p itself is quite small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For example, if p is a mere 50%, then in a clique of size 10, each key in the clique is trusted with a probability of 99.9%. This computation is (I think) known as the network reachability problem, and is probably quite hard to evaluate. In practice, you'd probably want to compute upper and lower bounds instead, Let's see if we can come up with a model that preserves this property of giving high trust values to densely connected keys, yet is also highly resistant to (some plausible model) of attacks against the Web of trust. Raph

1 0

RE: self-ratings vs. market ratings
by Blanc Weber 18 Dec '03

18 Dec '03

>From: Vladimir Z. Nuri (in response to Tim May) > >hmmmmmmmm, I seem to recall earlier letters in which you advocated >a market-type rating system in which services could rate things, >in the way that stocks are now rated, doctors/lawyers >could be rated, etc.-- let a thousand ratings services bloom. >(or maybe we were talking about reputations. in my mind, they are >mostly interchangeable--hence my interest in "rating" systems). ..................................................................... In consideration of the difference between "ratings" and "reputation": I think of a rating as something which is attached to something "pre-knowledge", whereas a reputation is something which develops over time & based upon informed knowledge ("after-knowledge"). A rating is applied to something (a service or whatever) by only those few individuals who are acquainted with what they are rating. A reputation is accumulated by the impressions made upon larger numbers of individuals - a general population not necessarily employed to collect these impressions - but who have nevertheless sufficient exposure to and acquaintanceship with the person/service/etc. to make an informed conclusion about it. A rating can make a statement on what something "is" or is expected to be (eg, general in content vs explicitly sexual), where a reputation reflects on past behavior. .. Blanc

3 2