December 2003 - cypherpunks-legacy

Re: SafE Mail Corporation
by Deranged Mutant 17 Dec '03

17 Dec '03

What the heck: I'm bored tonight... Well, not that bored. Don't need another 'tear snake-oil to bits or is this a damned troll' thread. Why does "M. Wagoner" sound familiar? On 17 Jun 96 at 17:21, "M.Wagoner" (safemail(a)ntrnet.net) wrote: > We would like someone to be able or should I say try and crack our > encryption. IT IS IMPOSSIBLE. > > Our Web site is http://www.sfmc.com Phone number is 1-800-252-9938. > > Randy Estridge > SafE Mail Corporation Uh oh. I checked the page. Claimed Public Key, Sigs, Error Correction, Compression, lots of nice stuff. They kind of got the vocabulary down. Only in a fuzzy way. Hypes "INTERNET Compatible" is if that means anything, a "22 character public key" (no, it's not a type. twenty-two character public key, in several places said that), proprietary algorithm, etc. etc. Yawn, Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

pretty bad idea (was Re: pretty good reputation)
by Deranged Mutant 17 Dec '03

17 Dec '03

On 16 Jun 96 at 12:32, Vipul Ved Prakash wrote: [..] > > That's the point, though. PGP *does not* try to model a reputation > > system. When you sign keys, you only attest that you are sure that > > that key belongs to the person whose name is on it. A signature says > > *nothing* about a person's reputation. [..] > in that case if alice receives a key signed by bob, she would know > the key is good. Pretty-good, yes. (Assuming she trusts anything signed by Bob.) > ... and there is no need for the two other fields. > infact the reason why i felt pgp is trying to model a reputation system > if because of these two fields that carry trust values. Those are private/personal trust values only. Alice rates Bob on how well she'd trust a key signed by Bob. This is subjective for Alice, based on her relationship with Bob. She may not know him well and assign him a low rating. Or she may know him all too well, and give him a low rating. This has no meaning for Carol, or Don, or anyone else, since they have different (if any at all) relationships with Bob. > > You can't set up a global web of trust. It's computationally > > infeasable, esp. with contradictions, to resolve. It's also > > meaningless. Say Alice trusts Bob. Bob trusts Carol. Carol trusts > > Don. Should Alice trust Don? No... subjective factors like "trust" > > don't commute. > > this is precisely what i wanted to know. can there be a model wherein one > can compute a trust-like parameter? if yes in what ways should this parameter No, at least not one with meaning. There are many factors that would go into one's rating of another: how well one knows the other; part history; bias for or against another because of thing like race, religion, political viewpoint, favorite OS, skills/talent or lack thereof, etc. People's ratings of each other change as well... just imagine global ratings of a once overly well-liked famous person who after several years is now infamous (or an infamous person who is now forgiven). And again, social pressure to give someone a certain rating... [..] > lets say a reputation system involves alice, bob, carol and don. Computing > trust parameter with respect to each other can lead to situtions where > alice trusts bob x% and has y% proof that he is a liar, after considering > all other relations. If this x% > y% she'll believe him, if not she won't. Generally x+y=1 in this scheme. But lets say for a moment they are separate: x = trust level; y = mixtrust level, independent of x... that makes little sense, since if y>.5, then Bob isn't trustworthy, but why is x > y? x and y would always have to be adjusted for each other... (so it's better off to use something like x+y=1). > thats why i feel the liar paradox doesn't really pose much of a > threat. But even then, For Alice, x(Bob) > y(Bob), so Bob is trustworthy. For Bob though, x(Alice) < y(Alice). So what of Carol? She does not yet know Alice and Bob, and sees their ratings about each other [Note: some people would assign ratings based on others; others would assign ratings based on personal experience... another problem with a global rating scheme]. Carol asks Alice about Bob, who says he's trustworthy. She asks Bob about Alice, who says Alice is untrustworthy. If Alice is correct, then according to Bob she's not worth listening to, but then why listen to Bob. If Bob is correct, Alice isn't worth listening to, but then again, maybe Bob isn't since she says Bob is... so why should Carol bother with any of them. Ok, in real life it's possible to meet two people, one of him is a liar but not so much as to admit another is more truthful... and that truthful person agrees. It's actually quite common... but how does a third person who doesn't know any of them figure it out? How does a computer program using a formula? But given a system with several variables (ie, several people rating each other) you'll have something that's even harder to resolve. Given a global system with thousands or millions of variables... how does one make sense of all those ratings about a particular aspect of one person? [..] > There will be inconsistency only if trust/untrust values are absolute. > that is you either trust someone or you don't. i am talking of a system > wherein trust values lie between 0..1 which are derived from a set of Oh no. There's also a lot of inconsistency there too. Doesn't matter if you use boolean or fuzzy values. > tags. in that case bob alice trusts bob x% bob trusts carol y% and carol > trusts alice z%. if z < x, z < y simply implies alice trusts bob, bob trusts > carol more than carol trusts alice. so the system will be relative rather than You're ignoring how much Alice trusts Bob, how much Carol trusts Bob and how much Alice trusts Carol. > absolute. a person who is trusted by more people will carry greater > weight Why should that person carry more weight? (more weight than who else?) What if all the people who trust that person are idiots? Why should I, or you, or anyone else care about somebody more or less because "x number of people trust so-and-so"? > and people trusted by him will carry higher weight too. this way snoopy There's another flaw. And what if those people trust him? Exponentially increasing trust? > who is not trusted by many people will automatically have a weak relationship > with others. Not many people know Snoopy, so he has no trust level. Nobody wants to get to know Snoopy just because he has no trust level. He's locked out. Bad idea. > > There's the other point that someone else on the list (Perry?) brought up: > > if people publicly rate each other, there may be social/political > > pressure to give some people lower or higher ratings. > > again these ratings will be decided in a web rather that on one-to-one basis. > that way the social/political pressure can be reduced though not completely > eliminated. No. Individuals put their ratings in the web to skew or confuse things. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

THIS IS SORT OF ... CRYPTIC
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I'm not sure what this item is about. Anybody know? S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ---------- Forwarded message ---------- Date: Mon, 17 Jun 1996 14:31:16 -0700 (PDT) From: CHINANET Moderator <cnm(a)SDSC.EDU> To: chinanet-tech(a)sdsc.edu Subject: CINET-L Newsletter, Issue No. 69 (CN96-012), June 16, 1996 Optic Fiber Automatic Surveillance Network Ready in Three Years The construction of the national optic fiber automatic surveillance network has been going on smoothly. The three surveillance stations located from Beijing to Tianjin are operating normally. It was estimated that the construction of another 23 surveillance stations will be completed by July. People concerned also estimate that the construction of the national optic fiber automatic surveillance network, installed with 500 surveillance stations, will be completed within three years. (Info(a)AsiaInfo.Com, June 5, 1996) ____ ____ ____

1 0

[Noise] Re: Java
by mccoy＠communities.com 17 Dec '03

17 Dec '03

s1113645(a)tesla.cc.uottawa.ca writes: > [...](One thing that detractors of > Smalltalk claim is that it is slow--slower than Java. However there is a > research dialect from Sun called Self which is supposed to be 50% as fast > as C.) Self also give a new meaning to phrase "code bloat." A 'Hello, world!' that requires more than a megabyte kind of kills any enthusiasm one might or a language which otherwise takes a neat slant message passing... [Although I gave up before version 4.0 so maybe things have gotten better] jim

1 0

Re: "Termination"?
by jim bell 17 Dec '03

17 Dec '03

At 07:54 PM 6/17/96 -0400, s1113645(a)tesla.cc.uottawa.ca wrote: > > >On Sat, 8 Jun 1996 ichudov(a)algebra.com wrote: > >> Since corrupt officials are likely to have more anonymous cash that >> phreedom phighters, guess who will win. Remember, Chudov was wrong about this. It's not just the amount of money you have, it's whether you can identify people as your "enemies." >> Also, think about this: lots of people have someone they'd like >> to assassinate but do not actually do it because of lack of anonymity >> and associated hassles (like dealing with assassins non-anonymously, >> abundance of traces, possible confession of the assassin and so on). >> With your assassination clearinghouse these hassles go away. I think it >> would present an excellent prospect for reducing the population. > >I could see an easy possibility for sting operations with the added >feature that you can have assassinated all the supected assassins (ie anybody >that may have come near whatever surveillance there may have been). >Why bother with courts and trials? > >I still think assassination politics is self-terminating. It would probably be more accurate to say that it is "self-limiting." There's a difference, you know. There may never be a "last" AP death. However, AP deaths may (and probably will) eventually become comparatively rare, precisely because they so straightforwardly obtained if there is a justification for them. That will cause the behavior of people to change, to avoid doing anything which draws the ire of somebody else. Think back to integral calculus, where the area under an infinitely long curve may be finite. If we think of X as being time, and the rate of deaths as the height of the curve above Y=0, the total number of deaths is reflected in the area. Some death rate schedules will integrate to a finite, limited number of deaths. Even if reality doesn't quite approach this optimum situation, it MAY approach a much better reality where the eventual rate of deaths is far lower than the status quo. However, the system will only self-limit to the extent that overt agression among people will be eliminated. If nobody agresses against you, you will have no reason to agress against anyone else. Therefore, the system cannot end in a dictatorship. >> Maybe *that* will help the whales and trees, because of the effect on demand. > >Don't you mean supply? Stores and physical companies are easier to target >than consumers. But the only remaining environmentalists or for that >matter any other people with strong views will be net-based pseudonyms. >Usenet flamewars, editorials and talk shows just don't seem dying for, imho. It is true that there may be a strong deterrent against "people with strong views." However, as I pointed out to the head of a 'Net freedom organization (who was worried about his future!), the only reason our society NEEDS figurehead people such as him is to change unpopular policies that are forced on the rest of us. Once AP begins operating, you don't have to stick your neck out to deter agression against you, and you don't need heads of organizations such as him, or for that matter organizations either. Quite simply, why do you need the head of the ACLU, or for that matter the ACLU as an organization, if you can target anybody who violates the rights that the ACLU currently protects? Jim Bell jimbell(a)pacifier.com

1 0

Re: SafE Mail Corporation
by John Deters 17 Dec '03

17 Dec '03

At 05:21 PM 6/17/96 -0400, you wrote: >We would like someone to be able or should I say try and crack our >encryption. IT IS IMPOSSIBLE. > >Our Web site is http://www.sfmc.com Phone number is 1-800-252-9938. > >Randy Estridge >SafE Mail Corporation Well, when I read this letter, I was sure it was a troll. I was amazed to find that not only are these people serious, but they're convicing other people to buy into this nonsense! Almost every page on their web site contains factual errors that range from misleading to incorrect to slander. Here's a gem from the comparison page: http://www.sfmc.com/comp.html Security of different programs | Public | Compres.| Error | ITERNET Program | Key | | Correct.| Compatib. --------------+---------+---------+---------+---------- SafE Mail(TM) | YES | YES | YES | YES PGP | YES | NO | NO | NO PEM | YES | NO | NO | Yes --------------+---------+---------+---------+---------- [ So, how many of you were surprised to learn that PGP is not Internet compatible, and doesn't do compression? I'm sure Mr. Zimmerman will be quite amazed! ] -- >From their FAQ: http://www.sfmc.com/faqu.html * SafE Mail utilizes a short 22 character Public Key which I realize is "great" for key exchange. Does this short Public Key the encription code vulnerable to attack? No! The Public Key is generated by a "One Way Hash Function" when the owner of the software names a private key or passwords. This makes the encryption code secure and not vulnerable to attack by unautorized individuals. * Is SafE Mail software a solution to concerns about under age or general viewing of obscene material on the INTERNET? Yes! Remember SafE Mail will encrypt virtually any type of computer generated files including pictures, video and audio. * How can SafE Mail be used for exchanging sensitive or obscene materials over the INTERNET? Image provider and Subscriber should both utilize SafE Mail software. Upon exchange of Public Keys by both parties, Image provider can transmit encrypted files that can be decrypted by Subscriber with his public and private keys. Files encrypted with SafE Mail will be a strong barrier to any unauthorized viewing. [So, remember, the next time you wish to break the law by transmitting obscene images (which have been shown in court already to be illegal), use SafE Mail.] -- More from the comparisons page: http://www.sfmc.com/comp.html SafE Mail and RSA® algorithms comparison table | SafE Mail(TM) | RSA (RC4+MD5) -------------------+-----------------------------+-------------------- Programm | SafE Mail(TM) for Win 1.12 | Entrust 1.1r1 | SafE Mail(TM) for DOS 1.12 | | | Performance Speed | ~4400kB/Sec (In addition to | ~770kB/Sec (Only (Results based on | Encryption also performs | does Encryption) 33mHz SunSparcs | Compression, Error | Station) | Correction, Internet | | Compatibility and Electronic| | Signature at the same time).| | | Compression | Yes, up to 85% | No, increases | | file size by up | | to 40% | | Internet | Yes | No Compatibility | | | | Electronic | Yes | Yes Signature | | | | Public Key | Yes | Yes Distribution | | | | Length of Public | 22 characters only | Over 1200 characters Key | | can distribute on the | | diskettes only | | Integrity Checking| Yes | Yes | | Error Correction | 9 different levels, selected| None Available | by user. | | | Best Attack | No known way | Statistical | | Analysis | | [ Where to begin? I wonder if it's their DOS or Windows version that runs on the 33MHz SparcStation? Oh, and I love the "no known way" to attack them. ] -- What are the trade magazines saying about SafE Mail? Well, this is from that traditional bastion of reporting integrity, the Carolina Computer News, June 1995: http://www.sfmc.com/scop02.html " ...SafE Mail is designed to be a powerfull business and personal communications tool, ideal for public or private network communications. SafE Mail provides the least expensive, fastest, INTERNET compatible, secure file transmission on the ma rket today. SafE Mail has a unique encryption algorithm. It's encryption key is longer than any other similar product currently available on the market today. The user can define the distortion/error correction level which determines the length of the encryption key. The longer the key length, the more difficult it is to break. SafE Mail employs the Public Key Distribution algorithm. Unlike currently available encryption algorithms (DES,RSA), SafE Mail generates a unique 22 character public key for each user. Des has no public key generator and the RSA Public Key becomes larger (up to several kilobytes) as the number of recipients increase. SafE Mail error correction is capable of restoring a binary file having 15% distortion errors or an ASCII file with 30% errors. SafE Mail excellent compression capability allows an ASCII file to be deflated by almost 85%!... " [ If you read the quotes from the various magazines, you probably won't be surprised at the list of quality magazine names that have been taken in by these hucksters: Byte, PC Week, PC Today, and others. ] -- However, it gets even better than this. The capstone (if you'll pardon the pun) of these folks is their contest, described at http://www.sfmc.com/cont.html If you can break their security, you'll win FIVE FREE COPIES of SafE Mail! Gosh, how can we pass up such an opportunity? -j, ROTFLOL :-) -- J. Deters >From Senator C. Burns' Pro-CODE bill, which I support and you can find at: http://www.senate.gov/member/mt/burns/general/billtext.htm " (2) Miniaturization, disturbed computing, and reduced transmission costs make communication via electronic networks a reality." +---------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'33"N by 93^16'42"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +---------------------------------------------------------+

1 0

Re: SafE Mail Corporation
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 17:21 6/17/96, M.Wagoner (1 wrote: >We would like someone to be able or should I say try and crack our >encryption. IT IS IMPOSSIBLE. Sigh. Yet another one... Unless you make source code available, you will be at best ignored, and at worst sued by users of your product should they discover that your unbreakable encryption isn't so unbreakable after all. Unless you use a hardware RNG and OTPs, your statement that it is impossible to break your encryption software is simply false. Do not expect that individuals who do have clue are going to waste their time on trying to break an encryption scheme invented by someone that so obviously doesn't know what he is doing. Go back to bed. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Disclaimer: My opinions are my own.

1 0

Re: "Termination"?
by jim bell 17 Dec '03

17 Dec '03

At 07:54 PM 6/17/96 -0400, s1113645(a)tesla.cc.uottawa.ca wrote: > > >On Sat, 8 Jun 1996 ichudov(a)algebra.com wrote: > >> Since corrupt officials are likely to have more anonymous cash that >> phreedom phighters, guess who will win. Remember, Chudov was wrong about this. It's not just the amount of money you have, it's whether you can identify people as your "enemies." >> Also, think about this: lots of people have someone they'd like >> to assassinate but do not actually do it because of lack of anonymity >> and associated hassles (like dealing with assassins non-anonymously, >> abundance of traces, possible confession of the assassin and so on). >> With your assassination clearinghouse these hassles go away. I think it >> would present an excellent prospect for reducing the population. > >I could see an easy possibility for sting operations with the added >feature that you can have assassinated all the supected assassins (ie anybody >that may have come near whatever surveillance there may have been). >Why bother with courts and trials? > >I still think assassination politics is self-terminating. It would probably be more accurate to say that it is "self-limiting." There's a difference, you know. There may never be a "last" AP death. However, AP deaths may (and probably will) eventually become comparatively rare, precisely because they so straightforwardly obtained if there is a justification for them. That will cause the behavior of people to change, to avoid doing anything which draws the ire of somebody else. Think back to integral calculus, where the area under an infinitely long curve may be finite. If we think of X as being time, and the rate of deaths as the height of the curve above Y=0, the total number of deaths is reflected in the area. Some death rate schedules will integrate to a finite, limited number of deaths. Even if reality doesn't quite approach this optimum situation, it MAY approach a much better reality where the eventual rate of deaths is far lower than the status quo. However, the system will only self-limit to the extent that overt agression among people will be eliminated. If nobody agresses against you, you will have no reason to agress against anyone else. Therefore, the system cannot end in a dictatorship. >> Maybe *that* will help the whales and trees, because of the effect on demand. > >Don't you mean supply? Stores and physical companies are easier to target >than consumers. But the only remaining environmentalists or for that >matter any other people with strong views will be net-based pseudonyms. >Usenet flamewars, editorials and talk shows just don't seem dying for, imho. It is true that there may be a strong deterrent against "people with strong views." However, as I pointed out to the head of a 'Net freedom organization (who was worried about his future!), the only reason our society NEEDS figurehead people such as him is to change unpopular policies that are forced on the rest of us. Once AP begins operating, you don't have to stick your neck out to deter agression against you, and you don't need heads of organizations such as him, or for that matter organizations either. Quite simply, why do you need the head of the ACLU, or for that matter the ACLU as an organization, if you can target anybody who violates the rights that the ACLU currently protects? Jim Bell jimbell(a)pacifier.com

2 1

Re: Britain to control crypto - official (fwd from Usenet)
by jim bell 17 Dec '03

17 Dec '03

At 07:38 PM 6/17/96 -0400, Simon Spero wrote: >4) Will LEAs be permitted to impersonate a non-consenting third party >for the purposes of allowing a conversation to be intercepted? >(blatant violation of the 4th ammendme... oh shit- never mind). You may recall discussions on CP many months ago concerning the extent to which an Internet provider would be obligated to obey a cop with a warrant who asks for (for example) a "data wiretap" of a customer. I happen to believe that one of the things that's going to have to be settled, and settled soon, is a ban on governments coercing people (ISP's, etc) to violate their contracts with others. If my ISP enters into a contract with me to (among other things) tell me if my data is tapped, OR he agrees to send me a certification of non-tap status daily as long as it's valid and cease sending them when tapping starts, etc, presumably if he fulfils his part of the agreement I will soon learn of a tap. One of the things that was particularly important to the Founding Fathers was what they referred to as "Impairment of Contracts," which meant as I recall the act of government passing laws and rules which affect my ability to contract with you. Not surprisingly, they didn't like that, such restrictions. If their desires were respected, presumably there would be no way for the government to come between two contractors to get one to betray the other. Jim Bell jimbell(a)pacifier.com

1 0

"Mail Exploders"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:23 PM 6/17/96, Lucky Green wrote: >At 9:45 6/17/96, Duncan Frissell wrote: >>At 08:43 AM 6/17/96 -0400, Declan B. McCullagh wrote: >> >>>I believe we used the term "email exploder" instead of "mailing list," >>>particularly in cross-examination and closing arguments, to convey the >>>idea that such a device is often used for conversation, not just one-way >>>communication. >> >>Was this term invented during the hearings or has anyone heard of it before? > >I have heard of it before. I believe "mail exploder" is a rather old term. I haven't heard the term in many a year, but it fits with the "Internet = explosives instructions" slant in popular opinion. "Those nerds are getting their revenge by developing "mail exploders" and spreading mayhem across the Net." I wonder where they got their technical information? --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0