December 2003 - cypherpunks-legacy

Re: NRC Cryptography Report: The Text of the Recommendations
by jim bell 17 Dec '03

17 Dec '03

At 10:42 AM 5/30/96 -0700, John Gilmore wrote: >Recommendation 2: National cryptography policy should be developed by >the executive and legislative branches on the basis of open public >discussion and governed by the rule of law. Why is it that we even need a "national cryptography policy"? We don't have a "national beer policy," do we? A "national furniture policy"? A "national pencil policy"? A "national movie policy"? The very concept of a "national cryptography policy" implies a level of centrally-controlled interest that is unjustified given our constitutution and laws. >Recommendation 3: National cryptography policy affecting the >development and use of commercial cryptography should be more closely >aligned with market forces. Does this mean, "Give people what they want," or merely "suck up to industry"? There is a difference... >Recommendation 4: Export controls on cryptography should be >progressively relaxed but not eliminated. > > 4.1 -- Products providing confidentiality at a level that > meets most general commercial requirements should be easily > exportable. Today, products with encryption capabilities that > incorporate 56-bit DES provide this level of confidentiality > and should be easily exportable. What if "commercial requirements" including security the NSA can't break? > 4.2 -- Products providing stronger confidentiality should be > exportable on an expedited basis to a list of approved > companies if the proposed product user is willing to provide > access to decrypted information upon legally authorized request. Where's the justification for any restrictions at all? We all know that good encryption is going to get out, anyway. No criminals are going to use escrowed encryption, which removes the justification for a restriction. And what is a "legally authorized request"? If a encryption user in another country is given a "legally authorized request" from a US court, in what way is it binding on HIM? > 5.3 -- To better understand how escrowed encryption might > operate, the U.S. government should explore escrowed > encryption for its own uses. To address the critical > international dimensions of escrowed communications, the U.S. > government should work with other nations on this topic. Why are these "critical international dimensions"? Why "critical"? I don't see it as coming even close to being "critical." > 5.4 -- Congress should seriously consider legislation that > would impose criminal penalties on the use of encrypted > communications in interstate commerce with the intent to > commit a federal crime. Gee, I wonder who they're thinking of! What's wrong with just punishing the underlying crime? What about some day, when encrypted telephones are ubiquitous, and we use them without thought? Does that mean we're all guilty of an extra crime or two, just by using that crypto phone? Jim Bell jimbell(a)pacifier.com

2 1

Policy Post 2.21 - Your Privacy Online: CDT Unveils Demo & Clearinghouse
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 21 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 21 May 30, 1996 CONTENTS: (1) Your Privacy Online - CDT Unveils Demonstration and Clearinghouse (2) Join Rep. White Wed 6/5 At HotWired to Discuss the Internet Caucus, the CDA, and other Internet Policy Issues (3) Subscription Information (4) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) Your Privacy Online - CDT Unveils Demonstration & Clearinghouse Many people surf the World Wide Web with an illusion of anonymity, believing that their activities are unobserved and that they can explore the Internet without leaving a trail. In reality, this is not the case. During the normal course of using the Internet, a great deal of personally revealing information is routinely generated, collected, and stored. Most of this information is collected for purposes of system maintenance, billing, or other necessary functions. But a sophisticated marketer, determined hacker, or law enforcement official can put together a detailed profile of your online activities, personal tastes, interests, habits and vices with relative ease. Today, the Center for Democracy and Technology unveiled an interactive privacy demonstration and privacy policy clearinghouse on our World Wide Web site. The demonstration is located at http://www.cdt.org/privacy/ The goals of the demonstration are two fold: 1. To educate the public about the extent to which personal information is automatically revealed online, and 2. To begin to make available examples of privacy and information usage policies that give people greater knowledge of and control over the personal information revealed online. The current focus of this "Privacy Clearinghouse" is centered on commercial online service providers (ie, America Online, CompuServe, Prodigy, Microsoft). Future updates of the clearinghouse will include information on Internet Service Providers, content providers, and web browser software. Future updates will also explore the extent that users can employ various technological solutions to control the collection and disclosure of personal information. FEDERAL TRADE COMMISSION TO HOLD HEARINGS ON ONLINE PRIVACY On June 4 and 5, the Federal Trade Commission (FTC) will hold hearings to explore online privacy issues. The FTC is particularly interested in exploring privacy protecting technologies which empower users to exercise more control over the collection and use of personally identifiable information online. CDT has been invited to present testimony at the hearings. Testimony and other background information on the FTC hearings will be available at CDT's web page at the end of next week. Details on the hearings are available at http://www.ftc.gov/. WHY SHOULD NETIZENS CARE ABOUT THIS ISSUE? Although it may not seem like it, someone is following you through cyberspace. Every time you retrieve a file, view an image, send an email message or jump to a new web site, a record is created somewhere on the Net. While much of this information may never be used, it can be, and you have little control over it. In the hands of a marketer with a powerful computer, or the government, it is possible to build a detailed profile of your tastes and preferences by monitoring your online activities. The information can be used to send you unsolicited email or snail mail, to call you, or to even put you on a list of people likely to support a particular political candidate. A single piece of information about you can support a tremendous range of activities. For example, if your repeated visits to web sites containing information on cigarettes results in free samples, coupons, or even email to you about a new tobacco product, you may not be concerned. However, if your visits to these web sites result in escalating insurance premiums due to categorization as a smoker - now you're beginning to get concerned. HOW PERSONAL INFORMATION IS COLLECTED ONLINE Web sites and Web browsers -------------------------- Your personal information (including your hobbies, political and product interests and ways to contact you, such as your email address) can be collected by web sites in two ways: directly or indirectly. * PASSIVE RECORDING OF TRANSACTIONAL INFORMATION: The transactional information revealed in the normal course of surfing the net reveals a great deal of information about your online activities. When you visit a particular web site, for example, the webmaster can determine what files, pictures, or other information you are most interested in (and what you ignored), how long you examined a particular page, image or file, where you came from, where you went to. Web servers collect transactional information in order to allow the system operator to perform necessary system maintenance, auditing, and other essential system functions. However, when correlated with other sources of personal information, including marketing databases, phone books, voter registration lists, etc, a detailed profile of your online activities can be created without your knowledge or consent. * COOKIES: Additionally, many web browsers contain a feature called "cookies," or client-side persistent information. Cookies allows any web site to store information about your visit to that site on your hard drive. Every time you return to that site, "cookies" will read your hard drive to find out if you've been there before. (The Privacy Demonstration has a link to a site that utilizes cookies.) * DIRECT DISCLOSURE OF PERSONAL INFORMATION: A growing number of web sites offer users the ability to register with the site. In many cases, registration brings real, important benefits, such as access to special areas, timely information, discounts, etc. While registration or other mechanisms by which users divulge personal information to a web site provide some obvious benefits to a users, it also provides the site's operator with a detailed picture of how you use the site. Regardless of how the information is obtained, a great deal of personally identifiable information is revealed in the normal course of surfing the web. Commercial Online Service Providers ----------------------------------- Commercial online service providers are configured in a variety of ways, but generally, little personally identifiable information is revealed to Internet sites visited directly from an online service. If you subscribe to a commercial online service, your service provider has access to lots of information about your online activities. These records are generated in the normal course of using the service, and are important for billing and maintenance purposes. However, not all services treat the use and disclosure of this information the same way. Please visit The Center for Democracy and Technology's Clearinghouse on Privacy Policies (http://www.cdt.org/privacy/) for a detailed description of the information practices of the major commercial online services. Future updates of the clearinghouse will focus on other Internet entities, such as browsers, content providers, and Internet service providers. ------------------------------------------------------------------------ (2) JOIN CONGRESSMAN RICK WHITE (R-WA) LIVE ONLINE TO TALK ABOUT THE INTERNET CAUCUS, THE CDA, AND TAKE YOUR QUESTIONS Congressman Rick White (R-WA) will be live online at HotWired on Wednesday June 5 at 9:00 pm ET to discuss his efforts to encourage better communication between members of Congress and the Internet community, his plans for the Congressional Internet Caucus, and other topics. Representative White will also answer questions from Netizens. DETAILS ON THE EVENT * Wednesday June 5, 9 - 10 pm ET (6 pm Pacific) on HotWired URL: http://www.hotwired.com/wiredside/ To participate, you must be a registered HotWired member (there is no charge for registration). You must also have RealAudio(tm) and a telnet application properly configured to work with your browser. Please visit http://www.hotwired.com/wiredside/ for information on how you can easily register for Hotwired and obtain RealAudio. Wednesday's forum is another in a series of planned events, and is part of a broader project coordinated by CDT and the Voters Telecommunications Watch (VTW) designed to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues. Transcripts from last week's discussion with Senator Leahy are available at http://www.cdt.org/crypto/. Events with other members of Congress working on Internet Policy Issues are currently being planned. Please check http://www.cdt.org/ for announcements of future events ------------------------------------------------------------------------ (3) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (4) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.21 5/30/96 -----------------------------------------------------------------------

2 1

Remailer chain length?
by Jim Choate 17 Dec '03

17 Dec '03

Hi Mark, Forwarded message: > Date: Tue, 28 May 1996 16:21:22 -0400 (EDT) > From: "Mark M." <markm(a)voicenet.com> > Subject: Re: Quickremail v1.0b > > > At 17:28 1996-05-27 EDT, E. ALLEN SMITH wrote: > > >I'm planning on starting up a remailer, probably on Lance's machine (to > > >take advantage of his expertise) sometime this summer. I do want to get PGP > > >for the VAX before then, and the MIT site doesn't appear to have this code. > > > > Why would anyone set up a remailer at Lance's (or Sameer's) machine? > > They have remailers running already. If the thugs break root and obtain > > one remailer key from a machine, they probably get all the keys on that > > machine, compromising all the remailers in one single attack. Or am I > > missing something? Is there any benefit of multiple remailers on a machine > > where root is running his own remailer? > > It's better than nothing. And besides, the more remailers there are, the > more difficult it is to do traffic analysis on remailer traffic. Actually, > its the more remailers people chain messages through, but there are software > packages that can do this easily. The more remailers there are, the longer > remailer chains have the possibility of becoming. If this is strictly true, why not simply run several instances of a remailer on the same machine. Then randomly chain them prior to sending them off site. This would be a lot cheaper and faster than trying to convince hobbyist to set it up or businesses to to use their profit & legal council. Jim Choate

2 1

Statistical analysis of anonymous databases
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

I ran across an interesting problem on the STAT-L mailing list. I came up with an initial solution, but it didn't fully solve the problem. I will summarize: In medical research (this particular application - there are others I am sure) it is desirable to have a large database of individual medical histories available to search for correlations, risk factors, etc. The problem, of course, is that many individuals want their medical histories kept private. It is therefore necessary to maintain a database that is not traceable back to individuals. An additional requirement is that people must be able to add additional information to their records as it becomes available. The researcher who initially posed the question suggested adding random data to "encrypt anonymity". My first cut solution was to hash the individual's name (perhaps including some other info or random info to thwart dictionary attacks) and send the records in under the hashed name. If done correctly, this should protect the anonymity of the record. The problem with this is that with the volume of data available in a medical record, it is very probable that a person could be tied to that record. Does anyone have any insights into this problem? <disclaimer> This is of purely academic interest to me, I don't know the person who asked the intial question (other than through email). It just sounds like a neat problem. </disclaimer> Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

4 4

Audit & Security reviews
by alc 17 Dec '03

17 Dec '03

UNIX and DEC VMS Security Reviews I would like to take this opportunity to tell you about two of our audit software tools, PCUA and PCDA. PCUA and PCDA are PC based software tools designed to review the security of Unix or DEC computers using only the stand-alone PC in your office. There is no need for connections to the system, user-IDs or even a knowledge of computer security. Simply obtain a copy (usually on a floppy disk) of key files from the system under review, load these onto your PC and let our tools do all the work. These packages are ideal for use by auditors, security officers and computer system managers - anyone who takes computer security seriously. The programs produce a wide variety of reports which show the findings, explain the implications of the problems and then make recommendations about how to improve security. Reports range from a full, detailed report which is user-definable to a brief list of the problems found. Both packages are evolving products and we continue to add new tests to them, as well as keeping up to date with the latest releases of the operating systems. If you would like further tests added, we would be pleased to include these in our next release. To obtain more information or demonstration disks then please contact us. Thank you for taking the time to look through this email. Alastair Coxall Technical Director TRILLION SOFTWARE Ltd The Firs, Broadwalk, Cranleigh, Surrey GU6 7LS, England Tel: +44 1483 274001 Fax: +44 1483 274017 Email: alc(a)trillion.demon.co.uk

1 0

Re: Java Crypto API questions
by br＠doppio.Eng.Sun.COM 17 Dec '03

17 Dec '03

|> This is hard. It's probably not going to make it in the first |> release. The simple first pass is to say "code signed by x, |> y, and z" can do whatever it wants. | |Good thing Sun is spending millions pushing a brand-new language down our |throats so we can do nothing we couldn't already do. After all the hype |about security, security models, and sandboxes we get signed applets that can |do anything. What a let-down. Just to clarify a couple of things. We're not pushing anything down your throat. You are still perfectly free to use Visual C++ if that is what you prefer. A statement to the effect of "is probably not going to make it in the first release" means the following things: - If we can, we will make it happen (in some form) in the first release. We're just trying to set expectations realistically. - We think that the ability to let applets have free reign is useful,and since that is easier, we are certain to put it in the first release. - No matter what we do, we must address some very thorny issues of key management and user trust model, so doing this will be useful. |Currently, the only safe way to run untrusted Java code is to not run it. |This probably isn't going to change (see cpunks archives for reasons). If |Sun cannot prevent untrusted code from doing nasty things, how can they |prevent code empowered with certain capabilities from doing things they are |not certified to do? It now seems that all the effort, time, and money to |move towards Java over another OO language was a waste in a way since it no |longer appears to have any security advantages. Ignoring security, Java is |not a bad language at all, but it still has distinct disadvantages over some |of the possible alternatives (mainly immaturity, no dynamic message |invocation, interpreters still not ready for prime-time). The important thing to remember is that we're not going to come out with an implementation and claim to have solved the capabilities model problem. We're taking a first step at using signatures with Java for security purposes, but this is only a first step. We remain fully committed to finer and more powerful security models. Note that an application written to the Java platform will be able to implement security policies based on digital signatures which are not fully permissive. Cheers, -- Benjamin

2 1

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad???
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:30 PM 6/2/96, Martin Minow wrote: >> >>One of the oldest tricks for running a stock up (or down) is >>to put rumor teams on elevators in the financial district of >>major cities. > >It would be more efficient to talk about the rumor on a cellular >phone. Probably make a nice sting scenario, too. An interesting example, but I'm having a hard time figuring out who has committed a crime, even by SEC rules. Namely, are the people "talking up" a stock committing a crime? Even if the SEC forbids this (under defined circumstances and for defined persons, as most of us are not covered by any such laws), how can talking over a "putatively secure" cell phone be construed as talking up a stock? And, how can someone who acts on overheard information--as in the elevator example Sandy cited--be charged with any crime? Unless they are "insiders," covered by SEC rules about trading, they are free to act on essentially anything they hear. "He who hesitates to act on inside information is lost." (To elaborate on this: I was never classified as an "insider" during my time at Intel, and I certainly bought and sold the stock based on what products and news I knew was coming out or what rumors I'd heard. Only a select group of executives and staff in the specific departments generating earnings announcements, auditing, etc., were covered. And senior executives are covered by various rules about trading stocks. And family members and friends may be covered, if they learn of "inside" (in the SEC sense) information. But ordinary people, even employees of a company, are not considered to be "insiders" and hence are not covered by insider trading laws.) So, the only way I can imagine the cell phone case leading to an insider trading charge is if the cell phone users _knew_ that the cell phones were not secure, and _planned_ to have their conversations overheard. The people doing the intercepting could be charged under one of the laws covering unauthorized interception of cell phone conversations, but probably not for insider trading. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

7 15

Re: Why PGP isn't so ubiquitous (was NRC Session Hiss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:59 PM 6/3/96, Deranged Mutant wrote: >On 3 Jun 96 at 11:27, Bruce Baugh wrote: > >> Date: Mon, 03 Jun 1996 11:27:33 -0700 >> At 04:33 AM 6/3/96 +0000, Deranged Mutant wrote: >> does, it will happen only after the passage of more draconian anti-privacy >> laws, and the guys working on it will be forced to include sundry backdoor >> stuff or drop it altogether. > >More likely drop it altogether, or be openly admit they were forced >to include GAK (people will want the source, anyway). I can't imagine _any_ set of circumstances which would cause Zimmermann, Atkins (?), Plumb (?), and anyone else who might still be on the PGP development team to include GAK. After all, those heartwarming stories about Burmese rebels using PGP to communicate using laptops in the jungles would then be replaced by: "16 April 1998, A.P., Rangoon, Burma. Internal Security Minister Bopalong Myanmoon announced today that rebel communications were intercepted and decrypted two weeks ago with the cooperation of the International Key Authority. As a result of this raid, 63 rebels were captured, tried, and executed. Visiting Rangoon at the time, U.S. Attorney General Louis Freeh was said to be satisfied that international key escrow was having such positive effects." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

[NOISE] rec.music.white-power failed 592:33033 FYI
by Rich Graves 17 Dec '03

17 Dec '03

The official result, including the votetaker's explanation for the extraordinary delay (which makes interesting reading), is in news.announce.newgroups, Message-ID <833851386.24895(a)uunet.uu.net>. Or for people who only use Netscape: http://ww2.altavista.digital.com/cgi-bin/news?plain@msg@31323@news%2egroups news:833851386.24895@uunet.uu.net While I think I was one of the people presenting legitimate reasons for voting no (as opposed to all the "VOTE NO ON NAZIS!" -- see news.groups archives), I'm actually disappointed that there were only 592 yes votes. I'd have expected more than the estimated 400 anti-censorship and spam-annoyance reactions. I would urge people NOT to download the 3MB list of votes, as I haven't, because the vast majority of voters had no clue what they were voting on. The majority probably thought it was a secret ballot. The poor votetaker definitely deserves a medal, but PLEASE don't send him appreciative mail; he's getting far too much already. Sent separately to fight-censorship and cypherpunks. Followup discussion, if any, belongs in news.groups ONLY. -rich

1 0

Re: Saw this on CNN: Anonymous Stock tips over IRC as bad??
by Deranged Mutant 17 Dec '03

17 Dec '03

On 3 Jun 96 at 15:18, Jeff Barber wrote: > I trust it won't stun you to find that many, many large and even small > corporations -- including my current employer [*NOT* SecureWare, BTW, > despite the email address] -- actually encourage their employees to buy > stock by offering stock purchase plans as a benefit of employment. They > even make it convenient by deducting purchases from one's paycheck. [..] There's a difference between a) buying stock in your employer's company generally [above example] and b) buying stock in your employer's company because your department is working on something that will raise the stock value etc. etc. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0