December 2003 - cypherpunks-legacy

Re: Denning vs. Gilmore
by Marshall Clow 17 Dec '03

17 Dec '03

>Today, Monday, July 29, Dorothy Denning begins her debate vs. John Gilmore >over The Absolute Right to Privacy on Wired Online's Brain Tennis site. Do >citizens of the world have an "unalienable right" to privacy - or are there >reasons why governments ought to have access to our communications? This >debate will run daily through August 7. Follow along at >http://www.wired.com/braintennis/ > I especially like Dr. Denning's quote: >An encrypted global information infrastructure is without precedent in >world history. It allows individuals and groups, anywhere and any time, >to communicate securely and with total privacy across time and space. Now _there_ is a goal to shoot for! Minor comments: First, a historical question: What percentage of telegraph traffic was encrypted in the 1910s? A global information infrastructure (encrypted or not) is without precedent in world history, is it not? I noticed that she said "allows", not "would allow". That contradicts <<I'm not ready to accept "the cat is out of the bag.">>, doesn't it? -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "We're not gonna take it/Never did and never will We're not gonna take it/Gonna break it, gonna shake it, let's forget it better still" -- The Who, "Tommy"

1 0

Re: Let's Say "No!" to Single, World Versions of Software
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:57 PM 7/30/96, Arun Mehta wrote: >At 15:13 30/07/96 -0700, Timothy C. May wrote: >> >>It is imperative that Netscape, Microsoft, Qualcomm, and the other players >>be pressured/urged/cajoled to commit to introducing strong, unescrowed >>crypto for the *domestic* versions, even if not for export versions. > >I agree. Foreign buyers will look askance at software that is >"second grade" in security terms, just so the US government can >read their mail. This will encourage non-US software companies to >fill the vacuum, and US companies will get pissed off and pull >some strings in Washington. Exactly. Having a U.S. version, without any limits on crypto and without any software key escrow (GAK), and then having a "for export" version, with keylength limits and/or mandatory registration of keys with the U.S. National Security Agency.... Well, what this would do is to basically drive sales of the "NSA" version to near zero. Between customer distaste for an NSA version, I can imagine many foreign governments not being too pleased to see this product being used by its citizens. (We've discussed this many times, since software key escrow came to our attention in 1993. Imagine the reaction of the United States government if American corporations adopted a French software product which automatically gave access to American trade secrets to DGSE ( Direction Generale de Security France Securite Exterieure), their primary spy agency, and RG (Direction de Renseignement), their economic intelligence agency. France is well-known for spying on U.S. businesses (a la the Air France case), and would no doubt be thrilled to have a "French-GAKked" program in wide use in the U.S.) This point has been raised by us many times. And, to be fair, this point is not lost on the NSA/Freeh/Denning/Gorelick crowd, I am sure. That is, they would not countenance the importation into the U.S. of "Iraq-GAKked" and "China-GAKked" programs, for example. So, what's the deal? The resolution of this quandary almost certainly lies in an "international agreement," along the lines of the various key escrow meetings which have been held (Karlsruhe in '93, Washington in '94, etc.). A "New World Order" solution, with complicated reciprocal agreements about whom the trusted key authorities might be, how nations could gain access, etc. (These relationships are too complicated for my brain to handle...how, for example, would one come to an agreement with Libya? What about Cuba, given that many of our nominal allies trade freely with Cuba and chafe when we try to get them to join our boycotts?) Such an international deal would almost certainly mean that even fully-domestic versions of software would have to be GAKked. Hence the need for us to pressure Netscape, Microsoft, Qualcomm, Novell, etc. *not* to play ball on this. This would then "marginalize" the European and Asian customers of a special "NSA-readable" version of their products, and would likely derail the whole thing. ObMartialLaw: Clinton is pushing to have new "anti-terrorist" legislation passed *this week*, according to CNN. He wants "memories to be fresh." Joe Biden wants exanded roving wiretap laws and restrictions on efforts to "circumvent" wiretaps. Feinstein wants bomb instructions banned. And so it goes. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

You know it's getting late when...
by jim bell 17 Dec '03

17 Dec '03

Last night on (as I recall) the CBS evening news, I heard a comment by a reporter that further reinforces my opinion that "they just don't get it." The reporter was talking about terrorism versus the amount of "security" applied, and he was pointing out that Americans know the bombing had occurred in Saudi Arabia "despite the fact that political opposition there is practically illegal." (fairly close quote) Huh? "despite the fact that political opposition there is practically illegal"? "Despite"? Suggesting, apparently, that the more oppressive the rule, the LESS likely violent opposition is expected to be? I suggest a rewording: "the bombing in Saudi Arabia occurred BECAUSE OF the fact that political opposition there is practically illegal." Ostensibly, one of the reasons for having a free and fair political system is so people will not be inclined to throw bombs and plot violent revolution. Grandly ignoring this, that reporter seems to take the diametrically opposite tack: A totalitarian government can best avoid bombings and violence. Where do these people learn their political theory? One frequent line among reporters is that terrorism used to always be something that occurred elsewhere, not in America. Yet another thing that "never" seemed to happen is when nominally patriotic, even conservative people talk of throwing out the government due to oppression. (Such an activity is thought of as primarily the function of the young, usually the liberal, as in the civil rights and anti-war demonstrations of the 1960's.) I wonder when it will occur to these reporters that there may actually be a connection there somewhere! If anyone out there still doubts that the time for my "Assassination Politics" idea will never come, I claim that it's later than you think. Jim Bell jimbell(a)pacifier.com

2 1

RE: Let's Say "No!" to Single, World Versions of Software
by Blanc Weber 17 Dec '03

17 Dec '03

>From: tcmay(a)got.net > >Such an international deal would almost certainly mean that even >fully-domestic versions of software would have to be GAKked. > >Hence the need for us to pressure Netscape, Microsoft, Qualcomm, Novell, >etc. *not* to play ball on this. This would then "marginalize" the European >and Asian customers of a special "NSA-readable" version of their products, >and would likely derail the whole thing. .......................................................... Deja-vu. Not to take away from the importance of this subject or any of the fine points which Tim has made, but it looks like it's time for the CPunk Annual August GAK Discussion on back-door deals, the NSA, and the Big Software Companies. :>) .. >Blanc >

1 0

Re: Terrorists are adult
by pjn＠nworks.com 17 Dec '03

17 Dec '03

In> An interesting theory, which my experience supports. In> I started with model rocketry, and then discovered that it was more In> fun to blow the rockets up, rather than have them come back to earth. In> (You don't have to sweat the construction details as much, either) In> About the time I turned 21, I lost interest in making exploding In> rockets and blowing craters in sand dumes. You may be interested i knowing that Palladin Press sells a book on converting model rockets into SAM and SSM's... P.J. pjn(a)nworks.com ... I am Jesus of Borg. Blessed are they who are assimilated. ___ Blue Wave/QWK v2.20 [NR]

1 0

Smart cards "a giant leap backwards" - Canadian Privacy Commissioner
by Richard Martin 17 Dec '03

17 Dec '03

Very little that might be new or enlightening to the world; attendees of CFP '96 will remember [fuzzily, in my case] the closest thing to Bruce's counterpart in the states admitting that the USA doesn't actually have much of a counterpart to the privacy commissioner. http://www.thestar.com/thestar/editorial/news/960730A01_NA-PRIVACY30.html [This is Canada's commissioner, not Ontario's.] frodo -- Richard Martin [not speaking for a|w] rmartin(a)aw.sgi.com http://reality.sgi.com/rmartin_aw/ Alias|Wavefront - Toronto Office [Co-op Software Developer, Games Team]

1 0

Re: Taxes in the digicash world
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 6:17 7/30/96, Igor Chudov @ home wrote: [...] >Another alternative that I see is property taxes and poll taxes,or >taxes on some commodities such as oil. But incomes seem to be hard to >track. What you also will see is an increase in sales tax. You still got to buy groceries locally. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: Dry Under the Waterfall
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:57 AM 7/30/96 -0700, David Kline wrote: >A question though: What about the 3 million hard-working, reading, >middle-class folks who have been downsized into oblivion the last three >years alone? What about the tens of millions of readers who had the skills >needed for the industrial age, but not for the information age? I mean actual ability to read and write *meaningfully*. Not the official "literacy" handed out in thousands of local institutions designed to produce mental retardation in this country. It is a skill almost are capable of (most had it in 1856 -- we know this because we can read the Lincoln-Douglas debates), but monopoly government institutions can no more make genuine literacy than they can make decent steel. >Well, change means pain, and we'll get to the millennium one way or >another. But we can do it the hard way or the easy way. The hard way >means severe social dislocation, possibly even threats to democracy. The >easy way seems the smarter approach -- no serious effort at reforming >education and at skills retraining has ever been undertaken, and it seems >a better use of our tax dollars than most of the crap it's spent on now. H.L. Mencken (always an optimist) said that a significant improvement in the quality of American education could only be achieved if you dynamited all the schools and shot all the teachers. Whether that is true or not. The governments have had the minds of our children since 1870 or so. If they haven't done a better job than this perhaps it is time to retire them. DCF

1 0

Paranoid Musings
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Sometimes paranoia strikes. Since these musings are crypto related, I thought I would share them. (1) Now everyone knows that 40 bit RC4 is weak, but just how weak is it? We know that a university CS student can break one message in a week using the universities farm of workstations. But, our foremost reputation agency for crypto strength, the ITAR, allows systems with RC4-40 to be exported. What does this mean? I combine the above with Whit Diffie's observation that, while crypto users are interested in the security of *each* message, organizations which monitor communications want to read *every* message. A TLA interested in monitoring communications would need to crack RC4-40 much faster than 1/week. Now expensive specialized cracking equipment can certainly speed up the process, but there may be a better way. If cryptanalysis of RC4 yields techniques which make the process much easier, then it is the ideal cypher to certify for export. The paranoid conclusion is that there is a significant weakness in RC4. (2) What did Microsoft give up to export its crypto API? Well, if you were a TLA, what would you want. I think I would want an agreement to be able to insert my own code in that vendor's products. Then I would be able to have widely distributed Trojan horses signed by the vendor. I would have the opportunity to significantly weaken standardized crypto systems installed world wide. Conspiracy theorists, start your mailers. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

VISA Travel Money
by mpd＠netcom.com 17 Dec '03

17 Dec '03

Happened to browse the VISA Web site last evening to read about the new microprocessor-based VISA Cash Cards that are being accepted in lieu of small change at the Olympics in Atlanta. While there, I noticed a new product that VISA is about to introduce. Called "VISA Travel Money", it is a pre-paid card with a user-selected PIN which one can simply purchase at a participating financial institution, just like Travelers Checks. One can then use it at any of the 250,000 ATMs in 89 countries until the amount one paid for it has been extracted, after which, one presumedly tosses it. Since the card is pre-paid, and does not involve the extension of credit, I would think that a "nym" would have no difficulty in purchasing one. Seems like a convenient way to keep moderate amounts of cash in a form which cannot be easily stolen, nor perused by the Feds. I wonder if an SSN is required at the time of purchase? In any case, http://www.visa.com/ and a few clicks will get you all the available information. VISA Travel Money: No Horseman should leave home without it! :)

1 0