December 2003 - cypherpunks-legacy

why is no one (apparently) worried about escrowed key length limits?
by Ernest Hua 17 Dec '03

17 Dec '03

It appears that (from the responses I have gotten on why there are key length limits at all on escrowed encryption) I am not forgetting anything obvious. So why is no one seriously questioning why this limit has to be there for key escrow? One suggestion was: the NSA does not completely trust key escrow. But if the NSA (who should know all the inner secrets of it) cannot completely trust key escrow, then why should WE trust key escrow? Obviously, the implication is that brute force (or "near brute force") methods WILL be used against encrypted transactions. So in the best case, there is some lower strata of law enforcement who are only allowed to use the escrowed path to intercept, but there is also some upper strata of law enforcement (presumably some anti-terrorist or national security section of ATF or FBI or CIA or Secret Service) who will be allowed to use such super-duper cracking methods to achieve their goals (assuming their goals are good). But, if the best case happens, then we're all Ozzie and Harriet (or Archie and Edith), and we should be in a love fest with the government. Obviously we don't competely and blindly trust our government. So why do we allow the NSA to get away with such a policy? "Here is something you can use. We can't completely trust it but it should be good enough for you folks." Ern

2 1

Re: Long-Lived Remailers
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hendersn(a)zeta.org.au" 23-MAY-1996 11:35:09.98 >I really like this idea. How about instead of a full-scale remailer being >the final jump of the message, you have a _very_ simple remailer set up >along the lines of anon.penet.fi. No encryption, just strip off the headers >and send the message to its final destination. Sorry for being clueless in >how this works(I'm learning as fast as I can), but wouldn't this kind of >system be incredibly easy to start up and fold? You could have a host of >such final emanation points winking in and out of existence while the actual >encrypting remailers remain relatively safe. Well, an anon.penet.fi one has the disadvantage of not encrypting between the final sendings.... which means that it's relatively easy to trace back a given message to whatever remailer sent it, via traffic monitoring. A forwarding remailer that decrypted mail according to a published key would get around this, especially if it were being run out of a POP or other email forwarding account (otherwise, the operator of the system could just look and see what the private key was, and thus be able to trace back). -Allen

1 0

SSL Telnet Proxy?
by herodotus＠alpha.c2.org 17 Dec '03

17 Dec '03

Does anyone know of a publically available telnet proxy, preferably one using SSL? -- Herodotus <herodotus(a)alpha.c2.org>

2 1

Re: Children's Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"gelmanl(a)gwis2.circ.gwu.edu" "Lauren Amy Gelman" 23-MAY-1996 14:26:28.11 >The text of the Children's Privacy Protection and Parental Empowerment >Act is available at the Epic "Children's Privacy" web site: >http://epic.org/privacy/kids/ >Read it before you trash it! I have examined it; I see no reason to change my stated opposition to it. Quite simply, it is an invasion of the privacy rights of businesses to force them to turn over such information as the law demands they turn over; it is an invasion of the property rights of businesses to mandate what they do with the information they have received and consequently own. -Allen

2 1

Please Post Widely -- The NRC Cryptography Policy Report
by CRYPTO 17 Dec '03

17 Dec '03

To whom it may concern: The Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) has completed a congressionally mandated study of national cryptography policy. The final report, Cryptography's Role in Securing the Information Society, will be released to the public on May 30, 1996 at a public briefing. A large number of the authoring committee members will attend. The public briefing will take place in the Main Lounge of the National Press Club, 14th and F Streets, N.W., Washington, D.C., from 1:00 PM to 3:00 PM, on Thursday, May 30, 1996. Committee members will respond to questions from attendees, and a limited number of pre-publication copies of the report will be available at that time. By the close of business on May 30, a summary of the report will be made available through http://www2.nas.edu/cstbweb; the full publication will be made available when final printed copies of the book are available (probably around the beginning of August). The committee also intends to conduct a second public briefing on the report in Menlo Park, California at SRI International. The briefing will be held in the Auditorium of the International Building from 10 to 11 am on Wednesday, June.5. The address is 333 Ravenswood Avenue, Menlo Park, California, 94025. For more information about the briefing at SRI, contact Alice Galloway at 415-859-2711 (alice_galloway(a)qm.sri.com) If you have suggestions about other places that the committee should offer a public briefing, please let me know (crypto(a)nas.edu or 202-334-2605). If you wish to be kept informed of various other public activities regarding dissemination of this report, you can sign up for an e-mail list by visiting the web page http://www2.nas.edu/cstbweb/notifyme.html. I apologize to you for the short notice on this invitation, but hope that you will be able to attend. Herb Lin Senior Staff Officer Study Director CSTB/NRC Study of National Cryptography Policy

1 0

RE: Truth can sometimes be harmful...(talk.cpunks.truth)
by blanc 17 Dec '03

17 Dec '03

From: Sandy Sandfort This is the most concise and logical response yet, to my suggested answer of "Truth" to Bell's question. Blanc has masterfully shown why that dog won't hunt. ........................................................................... Thanks for the compliment, Sandy. I understood what you meant. I appreciate the general nature of truth, in spite of the possibilities for misinterpretations of or prevarications from it. Jim, a quote for you: "We are able to act at all - that is to say, we have the power to order our conduct in such a way that the ends we desire can be attained - only because the phenomena of the world are governed not by arbitrariness, but by laws that we have the capacity to know something about. If it were otherwise, we should be completely at the mercy of forces that we should be unable to understand." ~ Human Action, Ludwig Von Mises Substitute the word "truth" for "laws" and it makes equal sense. We would be at the mercy of forces that we could not control, if our perceptions and interpretations could not correspond to the actual, the real, the truth. (and anyway, what does God have to do with crypto? Never mind....) .. Blanc

2 1

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"sunder(a)dorsai.dorsai.org" "Ray Arachelian" 23-MAY-1996 16:51:17.15 >One flaw in this is that some systems (my isp, dorsai, included) shut off >the finger daemon for security reasons. In this case, the remailer >should store the anonymous message on its hard drive for upto a week and >send a notice message to the target asking them if they want to receive >the email or not, and how to deal with future anonymous requests The >remailer then has to keep a table of those recipients for whom finger fails. One other reason to have such a voluntary message is to account for users/nyms who wouldn't want that they receive anonymous messages to be made public. For instance, that would clue in someone that they might have a nym at a nym-server, thus narrowing down the field for traffic analysis and forensic stylology. >While this is going to eat up a bit of space on the remailer, space could >be limited for the user, etc. If the space on the server runs out, what >do you do? The remailer should still inform the target, but again a >policy question rises - does the remailer send the message anyway, does >it delete the message but inform the target that "Sorry dude, you had an >anonymous email, but I had no room to store it and so I delted it. IF >you don't want it delted the next time around, activate finger tags >thusly, or send a reply to this message with "Accept Anonymous Email" or >"Reject Anonymous Email" as the subject and I'll respect your wishes from >now on"??? The latter has the advantage of preventing spamming via flooding the remailer. >Another thought is that we could set up some universal remailer allow >fingering service where the remailers can use some server somewhere or a >list of servers somewhere to look up a user's email address and see if >they are willing to receive anonymous email. Sort of like PGP key servers. The possible problem of improper information going out (as per the finger idea) is also the case with this one. -Allen

1 0

Re: FYA: "The ANOREV INTERCEPTS" [Usenet censorship] (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 24-MAY-1996 01:09:35.99 (quoting tallpaul) >Because of the role I played in the campaign to get people to VOTE NO >on "rec.music.white-power" many people have sent me e-mail asking about >the vote results on several political news groups on the internet. The >following is the latest data available as posted in the official USENET >news group called "news.groups". Oh? And were you, tallpaul, behind the mailing to uninvolved mailing lists of politically-biased pleas to vote "no" on that group, sans a copy of the CFV? If I had had time, I would have voted in favor of it on those grounds. >R. Graves was the original proponent of TPN-S. He had opposed the >earlier RMW-P group but on technical, not political reasons, and he >does, as he once put it, "not consider [himself] anti-racist." Rather >Graves opposition centered on whether the nazi news group had >demonstrated sufficient interest as a music group, whether it had been >properly proposed in terms of proper USENET/uunet electronic paperwork >at the like. I have read over the proposal in question, specifically its latter version. It has a robomoderator that attempts to reach the laudable goal of reducing inappropriate crossposting by persons arguing on this issue. While I have my doubts about how effective this is likely to be (looking for whether approximately identical posts with the same subject line had been posted to the excluded groups would probably be necessary, to prevent spamming tactics from being used), it is a valid goal. >Highly skilled technically, Graves seems quite clueless about the >nature of fascism as a political tendency off the internet in the real >world. He has opposed individual cybernazi dirty tricks in cyberspace, >including some first-class technical tracking of cybernazis using >anonymity and other devices to hide their identities. On the other >hand, he has announced, for example, that there are only some one-to- >two thousand hardened nazis in the entire world. To my knowledge, Rich has not opposed anonymnity; indeed, he has praised anonymnity as needed on groups such as alt.revisionism. I would be interested in hearing whether tallpaul supports anonymnity; it appears to be on-topic for cypherpunks. (Interestingly, the address from which various non-political mailing lists were sent the aforementioned improper email was either quickly shut down or the product of email header faking, according to the results I got when I emailed the person back with a letter of protest.) I would also suspect that tallpaul may be biased on his estimates of the number of full-blown nazis in existence, although this admittedly depends on definitions; activists are prone, often innocently, to overinflate the problems with which they deal. (I refer interested parties to the statistics on rape customarily used by those promoting action against it; they typically include such occurrences as sexual harrassment - a usage of free speech. While I disapprove of sexual harrassment and tend to regard rapists as proper subjects for the death penalty, I wish activists would be more accurate in their statistics.) >Graves's new view threatens additional ominous organizing by cybernazis >on the net as they go for an additional news group even before the >results of their previous organizing effort is announced. Cybernazi organizing is an inevitable consequence of the ability of all minority political groups to organize better thanks to the Internet. They have as much right to organizational activity as anyone else - including anti-fascist activists such as tallpaul. I would suggest reading over some issues of CuDigest with my contributions in them for further discussion on this matter. -Allen

1 0

Re: Children's Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 24-MAY-1996 04:18:17.16 >I recognize that criminalizing the free flow of information is like trying >to stick your finger in a dike, but every little bit has an effect. In >this case, I'd call it a positive effect. That's funny, most people would call the German action to censor pro-nazi information a criminalization of the free flow of information with a positive effect. >I was certainly disappointed to hear a couple of cypherpunks the other day >discussing for-profit offshore data havens full of personal information >that is illegal to collect in the US as a business opportunity *they* were >interested in pursuing. I just can't see myself doing that, for anybody. >Gubmint or private, doesn't matter. Why, pray tell, _should_ someone be able to conceal that they declared bankrupcy - e.g., ran out on their debtors that they had freely contracted to repay - more than 7 years ago? Should prison terms to theft be limited to 7 years? Moreover, there are significant negative economic impacts for criminalizing the possession of such information. The above is one instance; another, which is even more of interest to me due to my profession, is that of genetic information and insurance. Genetic screening for insurance purposes decreases the risk to an insurance company. It is therefore possible to issue insurance with less of a pool backing it up (for claims in insurance, for bad debt in the case of credit). This increases the number of businesses who can get into a given market, which will decrease prices for insurance since the current insurance business is quite ogliopolistic. Thus, for the average individual the availablility of such information is beneficial. I would personally be interested in setting up some such business in the future, specifically one with a genetic screening lab. While I would not wish to devote my entire time to it, I would be quite willing to help with setup and updating it - if paid a fee, of course. -Allen

2 1

Alternative to remailer shutdowns...
by MAILER-DAEMON＠kermit.aatech.com 17 Dec '03

17 Dec '03

There are hundreds of machines littered around the net that dont bother adding "received" headers to mail. I dont think that these provide anything near the security and anonymity that a single remailer (much less a remailing chain) provide, but it seems to me that routing outbound traffic from a remailer through one of these sites would provide at least /some/ measure of protection for the remailer-operator. It feels a bit underhanded, but it may be that involving some "innocent" bystanders in the remail process would be useful. Even if the sites being routed through /were/ keeping logs it would still require their participation in any investigation to discover where the mail had originated, and this would introduce the question of whether the (psuedo)anonymous sendmail host should bear any liability for not tracking where mail came from. The operator of the particular smtp host would seem to have a pretty good defense should a charge be raised, but in defending the smtp-host you could also be strengthening the defense of the r-ops. Another possibility is that rather than operating remailers at all, maybe we should be operating non-logging smtp hosts that dont add received headers. Building a client to take advantage of these servers would be trivial (i wrote one last night, and i am not proficient in C) and it could be argued that the situation was not created intentionally to allow anonymous messages, merely to preserve disk space and bandwidth. Flame Away...

2 1