December 2003 - cypherpunks-legacy

Austin Cpunks Meet Saturday
by Steve Tonnesen 17 Dec '03

17 Dec '03

The Austin Cypherpunks will have a monthly general meeting on Saturday June 1 at 6:00PM at the Central Market Cafe on North Lamar. Look for the stack of crypto-related books. This is an informal meeting for discussion of assorted projects including the remailer, the video, recent crypto events, etc. -S

1 0

WWW Security
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

I just noticed that the WWW-security mailing list and group are run out of Rutgers. What opinions do people have on the current drafts, references to which can be found at http://www.ietf.cnri.reston.va.us/html.charters/wts-charter.html? Thanks, -Allen

1 0

Re: Where does your data want to go today?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"mclow(a)owl.csusm.edu" "Marshall Clow" 29-MAY-1996 19:18:31.60 >* Why encrypt before compression? If the encryption is any good, then the >encrypted data won't compress much at all. However, compression before >encryption has its own problems. What problems does compression before encryption have? It at least seems to work for PGP. -Allen

3 2

Re: Statistical analysis of anonymous databases
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"alanh(a)infi.net" "Alan Horowitz" 29-MAY-1996 19:09:26.68 >I would ask, is there any known medical gain that has resulted from >such a data-base correllation. >I do not accept a researcher's own statements as to the utility of the work >(S)he's done with someone's funding. Seen too much of it at close >quarters... Nor do I accept reeports in the lay press - these are >nothing more than re-gurgitated press releases from PR depts of institutions. Medical gain? I was doing some research a bit back (paid for out of my own pocket, thank you very much) that involved such correlations. We've used them to revamp some allergy skin testing so that patients don't have to suffer so many tests. -Allen

1 0

NSA's role in Digital Telephony bill...
by Robert Hettinga 17 Dec '03

17 Dec '03

C'punks, I had dinner with another cypherpunk, Peter Cassidy, and he said that he just finished something for the Sacremento Bee's "Forum" section, which talks about the NSA's involvement in the Digital Telephony bill. Those of you who get the Bee might want to fill us in on the details, whenever the article. He said that the article might go to the wires, so we might see it elsewhere... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: [crypto] crypto-protocols for trading card games
by Gary Howland 17 Dec '03

17 Dec '03

David F. Ogren wrote: > Cards are not transferrable. In order to make cards transferrable the > game company must be able to invalidate cards which have been traded > to others. In other words if Alice wants to give a cards to Bob she > must: > > 1. Contact the game company and tell them she wants to give the card > to Bob. 2. The game company must issue a new card to Bob with a new > serial number and with Bob's public key rather than Alice's. 3. The > game company must invalidate Alice's old card. Since there is no way > that the game company can make sure all copies of the card have been > destroyed it must create a "invalid serial number list" and have the > players dial into that list everytime the game is played. This is the double spending problem. > Since step 3 is so costly to implement, I think it is unlikely that a > cryptography-based trading card game will have tradable cards. Given that untraceability of tradable cards is less of an issue than with e-cash, why not have a central registry of the owners of the cards (which would consist of the card details paired with the public key of the owner)? Admittedly this means the players must be on line, but then we all know how difficult off line detection of double spenders is. For anyone who is _serious_ about starting work on such a game system, I have a few pieces of Perl and Java code that would really get you on your way - let me know if you are interested. Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

1 0

NRC Cryptography Report: One More Recommendation
by John Gilmore 17 Dec '03

17 Dec '03

Sigh. Add one more Recommendation. It wasn't on the summary page of the fax copy I got, but it was in the text of the Report, and is in the Web page: Recommendation 6: The U.S. government should develop a mechanism to promote information security in the private sector. John

1 0

Policy Post 2.21 - Your Privacy Online: CDT Unveils Demo & Clearinghouse
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 21 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 21 May 30, 1996 CONTENTS: (1) Your Privacy Online - CDT Unveils Demonstration and Clearinghouse (2) Join Rep. White Wed 6/5 At HotWired to Discuss the Internet Caucus, the CDA, and other Internet Policy Issues (3) Subscription Information (4) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) Your Privacy Online - CDT Unveils Demonstration & Clearinghouse Many people surf the World Wide Web with an illusion of anonymity, believing that their activities are unobserved and that they can explore the Internet without leaving a trail. In reality, this is not the case. During the normal course of using the Internet, a great deal of personally revealing information is routinely generated, collected, and stored. Most of this information is collected for purposes of system maintenance, billing, or other necessary functions. But a sophisticated marketer, determined hacker, or law enforcement official can put together a detailed profile of your online activities, personal tastes, interests, habits and vices with relative ease. Today, the Center for Democracy and Technology unveiled an interactive privacy demonstration and privacy policy clearinghouse on our World Wide Web site. The demonstration is located at http://www.cdt.org/privacy/ The goals of the demonstration are two fold: 1. To educate the public about the extent to which personal information is automatically revealed online, and 2. To begin to make available examples of privacy and information usage policies that give people greater knowledge of and control over the personal information revealed online. The current focus of this "Privacy Clearinghouse" is centered on commercial online service providers (ie, America Online, CompuServe, Prodigy, Microsoft). Future updates of the clearinghouse will include information on Internet Service Providers, content providers, and web browser software. Future updates will also explore the extent that users can employ various technological solutions to control the collection and disclosure of personal information. FEDERAL TRADE COMMISSION TO HOLD HEARINGS ON ONLINE PRIVACY On June 4 and 5, the Federal Trade Commission (FTC) will hold hearings to explore online privacy issues. The FTC is particularly interested in exploring privacy protecting technologies which empower users to exercise more control over the collection and use of personally identifiable information online. CDT has been invited to present testimony at the hearings. Testimony and other background information on the FTC hearings will be available at CDT's web page at the end of next week. Details on the hearings are available at http://www.ftc.gov/. WHY SHOULD NETIZENS CARE ABOUT THIS ISSUE? Although it may not seem like it, someone is following you through cyberspace. Every time you retrieve a file, view an image, send an email message or jump to a new web site, a record is created somewhere on the Net. While much of this information may never be used, it can be, and you have little control over it. In the hands of a marketer with a powerful computer, or the government, it is possible to build a detailed profile of your tastes and preferences by monitoring your online activities. The information can be used to send you unsolicited email or snail mail, to call you, or to even put you on a list of people likely to support a particular political candidate. A single piece of information about you can support a tremendous range of activities. For example, if your repeated visits to web sites containing information on cigarettes results in free samples, coupons, or even email to you about a new tobacco product, you may not be concerned. However, if your visits to these web sites result in escalating insurance premiums due to categorization as a smoker - now you're beginning to get concerned. HOW PERSONAL INFORMATION IS COLLECTED ONLINE Web sites and Web browsers -------------------------- Your personal information (including your hobbies, political and product interests and ways to contact you, such as your email address) can be collected by web sites in two ways: directly or indirectly. * PASSIVE RECORDING OF TRANSACTIONAL INFORMATION: The transactional information revealed in the normal course of surfing the net reveals a great deal of information about your online activities. When you visit a particular web site, for example, the webmaster can determine what files, pictures, or other information you are most interested in (and what you ignored), how long you examined a particular page, image or file, where you came from, where you went to. Web servers collect transactional information in order to allow the system operator to perform necessary system maintenance, auditing, and other essential system functions. However, when correlated with other sources of personal information, including marketing databases, phone books, voter registration lists, etc, a detailed profile of your online activities can be created without your knowledge or consent. * COOKIES: Additionally, many web browsers contain a feature called "cookies," or client-side persistent information. Cookies allows any web site to store information about your visit to that site on your hard drive. Every time you return to that site, "cookies" will read your hard drive to find out if you've been there before. (The Privacy Demonstration has a link to a site that utilizes cookies.) * DIRECT DISCLOSURE OF PERSONAL INFORMATION: A growing number of web sites offer users the ability to register with the site. In many cases, registration brings real, important benefits, such as access to special areas, timely information, discounts, etc. While registration or other mechanisms by which users divulge personal information to a web site provide some obvious benefits to a users, it also provides the site's operator with a detailed picture of how you use the site. Regardless of how the information is obtained, a great deal of personally identifiable information is revealed in the normal course of surfing the web. Commercial Online Service Providers ----------------------------------- Commercial online service providers are configured in a variety of ways, but generally, little personally identifiable information is revealed to Internet sites visited directly from an online service. If you subscribe to a commercial online service, your service provider has access to lots of information about your online activities. These records are generated in the normal course of using the service, and are important for billing and maintenance purposes. However, not all services treat the use and disclosure of this information the same way. Please visit The Center for Democracy and Technology's Clearinghouse on Privacy Policies (http://www.cdt.org/privacy/) for a detailed description of the information practices of the major commercial online services. Future updates of the clearinghouse will focus on other Internet entities, such as browsers, content providers, and Internet service providers. ------------------------------------------------------------------------ (2) JOIN CONGRESSMAN RICK WHITE (R-WA) LIVE ONLINE TO TALK ABOUT THE INTERNET CAUCUS, THE CDA, AND TAKE YOUR QUESTIONS Congressman Rick White (R-WA) will be live online at HotWired on Wednesday June 5 at 9:00 pm ET to discuss his efforts to encourage better communication between members of Congress and the Internet community, his plans for the Congressional Internet Caucus, and other topics. Representative White will also answer questions from Netizens. DETAILS ON THE EVENT * Wednesday June 5, 9 - 10 pm ET (6 pm Pacific) on HotWired URL: http://www.hotwired.com/wiredside/ To participate, you must be a registered HotWired member (there is no charge for registration). You must also have RealAudio(tm) and a telnet application properly configured to work with your browser. Please visit http://www.hotwired.com/wiredside/ for information on how you can easily register for Hotwired and obtain RealAudio. Wednesday's forum is another in a series of planned events, and is part of a broader project coordinated by CDT and the Voters Telecommunications Watch (VTW) designed to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues. Transcripts from last week's discussion with Senator Leahy are available at http://www.cdt.org/crypto/. Events with other members of Congress working on Internet Policy Issues are currently being planned. Please check http://www.cdt.org/ for announcements of future events ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.21 5/30/96 -----------------------------------------------------------------------

2 1

NRC Cryptography Report: The Text of the Recommendations
by John Gilmore 17 Dec '03

17 Dec '03

Recommendation 1: No law should bar the manufacture, sale, or use of any form of encryption within the United States. Recommendation 2: National cryptography policy should be developed by the executive and legislative branches on the basis of open public discussion and governed by the rule of law. Recommendation 3: National cryptography policy affecting the development and use of commercial cryptography should be more closely aligned with market forces. Recommendation 4: Export controls on cryptography should be progressively relaxed but not eliminated. 4.1 -- Products providing confidentiality at a level that meets most general commercial requirements should be easily exportable. Today, products with encryption capabilities that incorporate 56-bit DES provide this level of confidentiality and should be easily exportable. 4.2 -- Products providing stronger confidentiality should be exportable on an expedited basis to a list of approved companies if the proposed product user is willing to provide access to decrypted information upon legally authorized request. 4.3 -- The U.S. government should streamline and increase the transparency of the export licensing process for cryptography. Recommendation 5: The U.S. government should take steps to assist law enforcement and national security to adjust to new technical realities of the information age. 5.1 -- The U.S. government should actively encourage the use of cryptography in nonconfidentiality applications such as user authentication and integrity checks. 5.2 -- The U.S. government should promote the security of the telecommunications networks more actively. At a minimum, the U.S. government should promote the link encryption of cellular communications and the improvement of security at telephone switches. 5.3 -- To better understand how escrowed encryption might operate, the U.S. government should explore escrowed encryption for its own uses. To address the critical international dimensions of escrowed communications, the U.S. government should work with other nations on this topic. 5.4 -- Congress should seriously consider legislation that would impose criminal penalties on the use of encrypted communications in interstate commerce with the intent to commit a federal crime. [Page 28 of the "Overview and Recommendations". There's a lot more discussion of each of these in the whole overview, which should be up on the web late today at www2.nas.edu/cstbweb/.]

6 5

Re: Asendmail Status & Politikal Rant
by - 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben Holiday wrote: <Asendmail Status report deleted> >On to politiks: > >I understand that the entire concpet of this program is a bit >controversial, and I can accept that. Personnaly I am not certain exactly >how to feel about it. I suppose that I am not thrilled about the idea of >cloaking the mailer this way, but at the same time I perceive it as an >evil of requirement. Yes. Yet another example of Unintended Consequences. I seem to be hearing that meme more-and-more these days. >I beleive very strongly that remailers SHOULD exist, >whether or not the CoS, or the FBI agree; and I am willing to be a bit >impolite if thats what needs to be. My only hesitation is that I'm afraid >now might be to soon. Absolutely, I think no fair observer could say that "we" [I know, "there's no 'we'"] "started it." Your concern is valid, IMO, but it should be balanced with the equally-valid fear that later might be too late. I have said this many times, both privately and in public, but it bears repeating: "Things are likely to be worse after the election." Like many here, I am surprised, and somewhat happy [easy issue for my political party] that the administration is making GAK3 noises now, and still trying to Newspeak it into the word "escrow." <"Escrow"-rant resisted to save bandwidth> ... >Anyway, someone raised the argument that the problem was political, and >that a technical solution would do more harm than good - maybe you're >right, I can't see the future, But it seems to me that I read somewhere >that "Cypherpunks Write Code". This statement is amazingly profound in its >implications. You are right, but it all interacts, IMO, in a "team effort." cypherpunks DO write code, and politico-crypto-punks like me admire your work greatly.We also talk about it, and try to spread it around in order to "protect" it. Users are far better off if someone besides me writes their software, :) but I can help them install PGPetc. without too much trouble. [Besides, 2/3 of the Cybergate-cypherpunks seem to write excellent code. I could never compete!] >Anonymous communication on the net depends on the technical solutions >embodied in the current remailing software, and cryptography applications. >If, years ago, the cypherpunks had decided that a publicity campaign, >political lobbying, and apologizing were the right course of action, >anonymous speach on the internet would be virtually non-existant today. If >the cypherpunks decide today that coding is not the answer, where will >free speach on the net be in 5 years? I think it is very naive to beleive >that the world is going to change enough, quickly enough, that remailers >will become accepted, and protected, methods of speaking - no matter how >politically correct we try to be. Sadly, despite my and others' political work to make this statement untrue, I must again agree with Ben Holiday. >Why do we see big business and big government launching a full frontal >assault on the remailers, while the mailing lists continue to operate >without incident? Because the enemy's of free speach recognize where the >true threat to their opression lies. Relying on politics to preserve our >rights is like throwing down your gun and asking the bear to please not >eat you. Agreed. >The powers that be want us to shut up. The programs that we write are the >weapons that will defend our right to speak. Yes, and many like you fill another important function for us, a function for which many of you take personal risks and spend a lot of unpaid time (and I thank you). Without comparing the particular goals, individuals, or any other aspects of earlier movements to the "Internet Privacy movement" of today, I see examples from recent history of how we interact without always knowing it. First, and despite current anti-gun sentiments among many of the same people, I think that the Civil Rights movement in the '60s _would_ have suffered more brutality from law enforcement and the KKK were it not for the armed Black Panthers, who had a diametrically opposed strategy. Second, the more recent "environmental" movement has profited by continuously spinning off more radical factions of itself [ex. "Earth First!"] to make its positions seem more reasonable and reduce the chances of compromise. The key to success seems more to be the capability of more radical action, and yet avoidance of violence or even the advocacy of violence among the mainstream to maintain either good PR, principles, or both, while continuing the political- legal fight. The "threat" of a technical solution "weapon" forces any political opponents to show their cards before they play (or just lie) and ideally involves (because it requires) *no* physical violence whatsoever. Despite opinions to the contrary, "war is [still] the health of the state." -- I forget who said that, sorry. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "Why is it that hundreds of government and university machines can operate what amount to anonymous remailers, and no one pays any attention, and yet cypherpunks are threatened with jail time for what is essentially the same thing?" -- Ben Holiday ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <liberty(a)gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMa3D7G1lp8bpvW01AQEzawP/VhP+EU1hk5aniN3IZ7cGkn5joUFA9dhj yC/D67wj68pfsTQZNOvRsVpEiapfc2OB3INVnjJroLY3i4r7ebiCoowTl+TF6NR+ MtheZ+mkyclpG832cJQLkWI5C61Lk1M5nNRNZ4blR3Gr07Ip5ku0RVovS0Qo8qyi V9KzwwveO48= =mydx -----END PGP SIGNATURE-----

1 0