December 2003 - cypherpunks-legacy

[NOISE} Re: Responding to Pre-dawn Unannounced Ninja Raids
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:10 AM 7/20/96 -0800, Vinnie Moscaritolo wrote: >Speaking of Bob Hettinga put it to words best, told me that standing on the >Concord bridge he could see the colors of the American flag eminating >outwards to the rest of the country. Yup this is where it all started.. Should teach him not to drink so much in the combat zone in Boston. ]:> --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

3 2

Re: Responding to Pre-dawn Unannounced Ninja Raids
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:38 AM 7/20/96 -0400, Perry E. Metzger wrote: > >Llywarch Hen writes: >> You have not had the opportunity to look closely at the business end >> of a gun. The hole looks enormous. > >The opening in the barrel of just about every rifle or pistol I've >looked at seems to be about half an inch or less. Perhaps you have >been looking at the 18" guns on the battleship "New Jersey"? There is a time and space dilation when the gun is pointed directly at you and about to be fired. (Been there, done that...) Perception tends to be skewed when all of the adrenaline is pumping into your bloodstream because of a perceived impending death. Believe me, it does look big. A 12 gauge especially... (Had a brother who came close to shooting me because he thought I was a burglar. Not fun.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

2 1

Re: ABC News on internet telephony
by jim bell 17 Dec '03

17 Dec '03

At 02:12 AM 7/19/96 -0500, snow wrote: > It is my understanding that billing is one of the biggest headaches >and expenses for a phone company. Going to a flat rate would solve a >decent amount of that wouldn't it? I've heard it claimed that billing and customer service is half of their costs, at least. If that's the case, then "flat rate" billing can't be far behind. Prodded by "free" Internet phone, they can't avoid it for much longer. Jim Bell jimbell(a)pacifier.com

1 0

Re: [Noise] was Re: Giving 6 year old kids Uzi's
by Alan Olsen 17 Dec '03

17 Dec '03

At 08:31 AM 7/20/96 -0400, Brad Dolan wrote: >> Would you just hand out guns to all teenagers? > >My twelve-year-old daughter asked for and received a .22 for her birthday. >Her four and six year old siblings enjoy shooting it, under close >supervision. I learned how to shoot very young. My father taught me, as well as enrolling me in NRA competitions around age 14. They still have high school rifle teams where I used to live as well. But then the culture is quite different towards guns in Alaska than it is here... (For one, people do not view them as toys and/or possessed by evil spirits or the like...) >Rural America has a very different culture than urban America and urban >America's recent attempts to impose its values (like hoplophobia) on us >really chafes. I bet the "National Curfew" crap that Clinton is trying to push is not going down well either. He seems to think that the problems of a small fraction of the country apply to the whole country... (But it makes for good sound bites.) --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

[NOISE] Re: Firewall Penetration
by Alan Olsen 17 Dec '03

17 Dec '03

At 05:29 PM 7/19/96 +0800, Jerome Tan wrote: >Is it possible to penetrate a firewall? Yes, but it requires alot of time and money. (As well as a nice car and a six figure income.) I recommend taking the firewall out to a nice restaurant, feeding it dinner, taking it out for drinks and then back to your house or apartment. If everything works, you should be able to penetrate said firewall. But she will not return your calls in the morning... --- |"Computers are Voodoo -- You just have to know where to stick the pins."| |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by Arun Mehta 17 Dec '03

17 Dec '03

At 01:10 20/07/96 -0700, Timothy C. May wrote: >By "you," I have to presume you mean "me." No, I am not at likely to use >this weapon in a rage against a loved one. Trust me. This was not intended to suggest how "you" might behave, I don't know you that well, it would have been less confusing for me to have used the pronoun "one." >It may sound "stupid" to you...I suggest you read up on evolutionary game >theory. Sometimes one has no choice but to respond to an arms buildup. >Unilateral disarmament rarely works. There are surely alternatives to the extremes of unilateral disarmament and an arms race? For instance, slowing down the race? More often than not, it is the US that has upped the ante. They consistently had more nuclear warheads than the Soviet Union, new technologies that disrupted the status quo came generally from the West. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/ finger amehta(a)cerfnet.com for public key

3 2

Curfews again
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:37 PM 7/20/96, Alan Olsen wrote: >I bet the "National Curfew" crap that Clinton is trying to push is not going >down well either. He seems to think that the problems of a small fraction >of the country apply to the whole country... (But it makes for good sound >bites.) Yes, I have written about the local "curfew" in my local newsgroup (scruz.general), and I forwarded at least one of these articles to this list, as you may recall. Consistent with my views on gun control, mandatory doping of children, the outlawing of certain dietary items, and on and on, I would be mighty pissed if a kid of mine was picked up the cops and hauled off to a processing center for eventual disposition for the thought crime of being on the street without an excuse acceptable to the local gendarmes. (In fact, I think I'd be tempted to just not answer any phone calls from the reeducation center staffers; getting through to me on the phone can often be difficult, of course, and I doubt they know about e-mail.) I told someone in scruz.general who argued strongly for the need for curfews on kids that her points had convinced me, that I now understood her position, that I now agreed with it, and that I would be doing my part by making a citizen's arrest of any curfew violators I found in my area...especially cute 16-year-old girls. (I never heard from her again...after she stopped foaming at the mouth she probably contacted the Thought Crimes Task Force of the Sheriff's Department.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: PGP Keyserver at jpunix.com
by John A. Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The problem with the PGP keyserver at jpunix.com has been corrected. It turned out to be a corrupted keyring. The keyserver is once again available via email at pgp-public-keys(a)jpunix.com as well as by WWW from www.jpunix.com. The WWW interface uses Bal's PGP WWW interface. I apologize for the downtime and the inconvenience. On the up side, I didn't lose any key requests during the downtime. John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfFE6lOTpEThrthvAQE3cQP/cy7x/LnmfC/31AcIgom3X2Cc/YMR01Jw 95kPt7W0JAz154DZezXLyR79Q7fJ4DYSkHRO6HFGwd5QiCkHrUjv/xweECPf9Q4s x41VnTFxrXGr3+YTm47vL+gBnuVmSTP4ujMC9s6r2zcGOCE3jQXKBLEhGNB6kPxg ab37bM4iGHo= =oONb -----END PGP SIGNATURE-----

1 0

A Snake-Oil FAQ
by Deranged Mutant 17 Dec '03

17 Dec '03

I've written a short "Snake Oil FAQ" below. It's incomplete and needs some work (adding a few definitions, rewording, aesthetic formatting, etc.), so think of it as a 'beta' FAQ (please don't post it on web pages, though I don't mind if it's distributed among anyone interested in criticizing or contributing). Comments and suggestions would be appreciated. Note that the aim is to write something accessible to 'newbies'. (Jeremy Barrett contributed to this, BTW) Snake-Oil Warning Signs Encryption Software to Avoid (Revision 0.1) Introduction ====================================================================== Good cryptography is an excellent and necessary tool for almost anyone. However, there are a multitude of choices for what products to use. Many good cryptographic products are available, both commercial and free. However there are also some extremely bad cryptographic products (known in the field as "Snake Oil"), which not only fail do their job of providing security, but are based on, and add to, the many misconceptions and misunderstandings surrounding cryptogra phy and security. It is extremely important that users of cryptography actively question the product they are considering using, to insure the security and integrity of their data-- be it personal or business informat ion. In order to make a more informed decision, it is necessary to understand some of the "red flags" to watch out for, and what they mean. For a variety of reasons, this document is general in scope and does not mention specific products or algorithms as being "good" or "Snake Oil". Some Common Snake-Oil Warning Signs ====================================================================== The following are some of the "red flags" one should watch for when looking at an encryption product: Technobabble ------------ The vendor's descrption of the product may contain a lot of hard-to-follow use of technical terms to describe how the product works. If this appears to be confusing nonsesense, it may very well be (even to someone familiar with the terminology). Technobabble is a good means of confusing a potential user and masking the fact that the vendor doesn't understand anything either. A sign of technobabble is a descrption which drops a lot of technical terms for how the system works without actually explaining how it works. New Type of Cryptography? ------------------------- Beware of any vendor who claims to have invented a "new type of cryptography". Avoid software which claims to use 'new paradigms' of computing such as cellular automata, neural nets, genetic algorithms, chaos theory, etc. Just because software uses to different mehtod of computation doesn't make it more secure. Anything that claims to have invented a new public key cryptosystem without publishing the details or underlying mathematical principles is highly suspect. Proprietary Algorithms ---------------------- Avoid software which uses "proprietary" or "secret" algorithms. Security through obscurity is not considered a safe means of protecting your data. If the vendor does not feel confident that the method used can withstand years of scrutiny by the academic community, neither should you. Beware of specially modified versions of well-known algorithms. This may unintentionally weaken the cipher. The use of a trusted algorithm, along with technical notes explaining the implementation (if not availablity of the source code for the product) are a sign of good faith on the part of the vendor that you can take apart and test the implementation yourself. Old Ciphers Never Die... ------------------------ Beware of something that sounds like a sophisticated nineteenth- century or even World War II scheme, or something based on a mechanical system. If the product's authors sound like they are entirely unfamiliar with the state of the art, that's a good warning sign. Experienced Security Experts ---------------------------- Beware of any product claiming that "experienced security experts" have analyzed it, but it won't say who (especially if the scheme has not been published in a reputable journal). Unbreakability -------------- Some vendors will claim their software is "unbreakable". This is marketing hype, and a common sign of snake-oil. Avoid any vendor that makes unrealistic claims. No algorithm is unbreakable. Even the best algorithms are breakable using "brute force" (trying every possible key), but if the key size is large enough, this is impractical even with vast amounts of computing power. Be wary of marketing gimmicks related to "if you can crack our software" contests. One-Time-Pads ------------- A snake-oil vendor may claim the system uses a one-time-pad (OTP), which is theoretically unbreakable. A OTP system is not an algorithm. It involves generating a random key at least the size of the message and garbling the message with it. When the message is decrypted, the key is destroyed. Only one message is encrypted with a OTP, and it is used only once. They key is random: generated using a real random source, such as specialized hardware, radioctive decay timings, etc., and not from an algorithm or cipher. Anything else is not a one-time-pad. The vendor may confuse random session keys or initialization vectors with OTPs. Algorithm or product XXX is insecure ------------------------------------ Avoid anything that makes claims that particular algorithms or other products are insecure without backing up those claims (or at least siting references to them). Avoid anything that misrepresents 'weaknesses' of other algorithms. (For example, if the product claims it doesn't use public key crypto, citing timing attacks or factoring as reasons.) Keys and Passwords ------------------ The "key" and the "password" are often not the same thing. The "key" generally refers to the actual data used by the cipher algorithm. The "password" refers to the word or phrase the user types in, which the software converts into the key (usually through a process called "hashing" or "key initialization"). The reason this is done is because the characters a user is likely to type in do not cover the full range of possible characters. (Such keys would be more redundant and easier for an attacker to gues s.) By hashing a key can be made from an arbitrary password that covers the full range of possible keys. It also allows one to use longer words, or phrases and whole sentences as a "passphrase", wh ich is more secure. Anything that restricts users passwords to something like 10 or 16 or even 32 characters is foolish. If the actual "password" is the cipher's key (rather than hashing it into a key, as explained abo ve), avoid it. Anything that claims to solve the "key management problem" is also be to avoided. (Key management is an inherent problem with crypto.) Convenience is nice, but be wary of anything that sounds too easy to use. Avoid anything that lets anyone with your copy of the software to access files, data, etc. without having to use some sort of key or passphrase. Avoid anything that doesn't let you generate your own keys (ie, the vendor sends you a key in the mail). Avoid anything by a vendor who does not seem to understand the difference between public-key cryptography and private-key cryptography. Lost keys and passwords ----------------------- If there's a third-party utility that can crack the software, avoid it. If the vendor claims it can recover lost passwords (without using a key-backup or escrow feature), avoid it. Exported from the USA --------------------- If the software is made in North America, can it be exported? If the answer is yes, chances are it's not very strong. Strong cryptography is considered munitions in terms of export from the United States, and requires approval from the State Department. Chances are if the software is exportable, the algorithm is weak or it is crackable (hence it was approved for export). If the vendor is unaware of export restrictions, avoid the software: the vendor is not familiar with the state of the art. Because of export restrictions, some legitimate (not-Snake Oil) products may have a freely exportable version for outside of the USA, which is different from a separate US/Canada-only distribution. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

9 13

Game Theory and its Relevance to Cypherpunks
by tcmay＠got.net 17 Dec '03

17 Dec '03

Game theory is terribly important to Cypherpunks. At 8:11 PM 7/20/96, Perry E. Metzger wrote: >Arun Mehta writes: >> >It may sound "stupid" to you...I suggest you read up on evolutionary game >> >theory. Sometimes one has no choice but to respond to an arms buildup. >> >Unilateral disarmament rarely works. >> >> There are surely alternatives to the extremes of unilateral >> disarmament and an arms race? For instance, slowing down the >> race? > >Don't ask the question as though it is theoretical. Don't try >answering it as though your personal values have any bearing, because >there is indeed an objective answer here. Try doing some game theory >simulations and see how well unilateral disarmament works. > >Oh, and don't give us stuff about how humans are above evolutionary >pressures or nonsense like that, because we aren't any more above such >pressures than we are above the laws of physics. Moreover, folks should pay careful attention to the way the _appearance_ of strength is critical. I don't mean bluffing, thought that sometimes has a place, I mean the "scaring off" of would-be challengers/attackers/intruders. For example, one well-known variant in evolutionary game theory is the "game of chicken," immortalized in the race-to-the-cliff in "Rebel Without a Clue^H^H^H^H^HCause." While such games sound foolish to many--and such a cliff race is not something I'd ever partake in--they are quite common and confer evolutionary advantages to the winners. To put it simply, the leader of a pack, whether dogs, humans, whatever, may face challenges from other pack members. If he can convince them that he'll win, that he's the craziest motherfucker on the planet, the challenges are reduced. A weak-appearing leader is of course attacked more quickly. (These are separate issues from the actual strength of skill of the participants, but it's a basic fact that a leader who can avoid as many challenges as possible will likely last longer.) Seen another way, there is considerable game-theoretic advantage in being seen as "crazy." If the other guy veers off long before impact or going over the cliff, because he think his opponent is crazy enough to ignore "rationality," much is gained by the victor. Avoiding fighting is often the most important consideration, and arms races often accomplish this goal! Even the "MAD" policy of "mutually assured destruction" has game-theoretic justification. (Indeed, this is virtually a truism, given the role game theory and the RAND Corporation played in the devising of the MAD strategy.) While humanists and liberals may cluck at the admittedly horrible consequences of MAD, were it ever implemented, it is solidly grounded in these "games." Fortunately, the goal of MAD was to not have to be used, and it appears now to have worked quite well (albeit at high cost). The application of these ideas to gun ownership is pretty clear, even to those who have not studied or thought much about these topics: a person contemplating a crime will be more likely to do so with an unarmed person. Duh. And less likely against someone he suspects is armed. Still less likely againt a "gun nut." Seeing an "NRA" sticker in the window of a car parked outside is likely to make him think twice, fearing a "gun nut" is inside. Being perceived as a gun nut does have some advantages. Hence the availabilty of signs saying: "Trespassers will be Shot," and, my favorite: "I have a .45 and a shovel; I doubt you'll be missed." (5 points to whomever first identifies the movie this was in) (One of the interesting speculations is what role this thinking played in the development of U.S. paramilitary S.W.A.T. teams, the "black-clad ninjas" we have been talking about recently. Creating a terrifying image, an image of crazed indifference, is a useful thing. Certainly the S.S. understood the power of their frightening uniforms and the "myth" of their bloodthirstiness. (Note: I am not saying their bloodthirstiness was a myth, but that they deliberately cultivated this image. Intimidation works, game-theoretically.) Game theory is at the confluence of economics (costs), psychology (motivations, rewards), evolution (who survives to reproduce), sociobiology (essentially another name for evolutionary game theory), and other fields. All educated persons should know the basics of a bunch of related things: -- "the prisoner's dilemma" (another famous example) -- the iterated forms of this and other games -- the concept of payoff matrices -- the game of chicken -- the nature of arms races -- random reinforcement -- the concept of "defection" -- the ideas of positive-, zero-, and negative-sum games. More advanced stuff, e.g, Nash equilibria, is real useful to know about, but is not part of any ordinary conversations I have seen on the Net in many years of participating. In particular, game theory has a lot of usefullness to crypto and Cypherpunk themes. "All security is economics." Lots of obvious connections. Most Alice-Bob situations are essentially multi-party games, with all the related stuff about spoofing, expectations, reputations, cheating, etc. (Granted, many of these situations are far beyond the formal games that have been analyzed in detail to date. That is, it is not clear how crytpographic protocols affect such games; or at least this is a fertile area for further study.) A good understanding of game theory can be gotten in a few weeks by reading some of the main introductory texts. This will not qualify oneself as an expert, but will provide one with insight into why many of us make the points we make about economics, self-reliance, payoff outcomes, and so on. Useful sources: Axelrod, "The Evolution of Cooperation" --> the best place to start, IMO Hofstadter, various chapters in "Metamagical Themas" Poundstone, "The Prisoner's Dilemma" Kahn, "On Thermonuclear War" And of course various textbooks on game theory. (But read the popular accounts first, else the mathematical rigor will be meaningless and confusing.) The usefullness to cryptography, especially to the more outre stuff we are most interested in, has largely remained unexplored. I get the impression that few academic cryptographers know much about it. I predict that important insights will come as these fields come into more contact. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0