December 2003 - cypherpunks-legacy

Usenet Conference on Security
by frantz＠netcom.com 17 Dec '03

17 Dec '03

Just a few of the highlights: (1) Ron Rivest speaking on SDSI (2) Ian Goldberg et.al's secure environment for running untrusted programs in Solaris. Since it runs Netscape, it may let Perry provide a second layer of containment for Java. (3) Carl Ellison's "Establishing Identity Without Certification Authorities (4) Peter Gutmann's "Secure Deletion of Data from Magnetic and Solid-State Memory". (Bottom line, use thermite for magnetic media.) (5) Don Davis's "Compliance Defects in Public Key Cryptography" (6) Sameer Parekh's description (advertisement for) Community Connexion (7) Derek Atkins' description of the PGP Library API. Other amusements: While the Department of Justice guy (whose name slips my mind) was saying 4 horsemen over and over (really an oversimplification of his position), Data Fellows Ltd., Paivantaite 8, FIN-02210 ESPOO, Finland (http://www.datafellows.com) was in the vendor area offering strong crypto products with the line in one of their handouts, "This is orders of magnitude more security than DES-based or US products that are under the US ITAR export restrictions." In talking with them I didn't smell any snake oil. A BOF on PKI with Ron Rivest (who had already described SDSI) where Matt Blase describing PoliceMaker, and Carl Ellison described SPKI. All three approaches get away from the central certificate hierarchy God. Each one has something to offer that the other do not. (In a spirit of advertising/disclosure, I have been working with Carl on SPKI.) ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

Securing 5% of the Internet against Wiretapping by Christmas
by John Gilmore 17 Dec '03

17 Dec '03

I've been working on a project in secret for a few months, and now am talking about it with everyone so that we can all help it along. Want all the Internet traffic between you and every other privacy-conscious site on the net to automatically be encrypted using Triple-DES, RSA, and Diffie-Hellman? Without changing your hardware or software, except to stick a Linux PC on your network, or install a new version of Linux on your laptop? Want it all by Christmas? Then check out http://www.cygnus.com/~gnu/swan.html

1 0

Hackers on tv alert (for SF area only)
by Martin Minow 17 Dec '03

17 Dec '03

San Francisco TV channel 4 (the NBC affiliate) will broadcast a "news" segment on hackers "they can access your computer and ruin your life" at/around 9:00 PM this evening (Friday, July 26). I'm sure it will be as informative, educational and unbiased, just like the rest of the Olympic coverage. Martin Minow minow(a)apple.com

1 0

Re: Bernstein files for partial summary judgement in crypto case
by jim bell 17 Dec '03

17 Dec '03

At 05:28 PM 7/25/96 -0700, John Gilmore wrote: >Here's the press release on the latest development in the Bernstein >case. >July 26, 1996 Electronic Frontier Foundation >In his 45-page memorandum in support of his motion, Bernstein sets forth >several First Amendment arguments: >* Any legal framework that requires a license for First Amendment >protected speech, which may be granted or withheld at the discretion of a >government official, is a prior restraint on speech. In order for this >framework to be acceptable, the government has the burden of showing that >publication will "surely result in direct, immediate, and irreparable >damage to our Nation or its people" and that the regulation at issue is >necessary to prevent this damage. The government has not met this burden >regarding the ITAR legal framework. Maybe it's just me, but why would even the _certainty_ that a publication will "surely result in direct, immediate, and irreparable damage to our Nation or its people" justify violation of 1st amendment rights? There are, certainly, kinds of "damage" which should not warrant prohibition: If, for instance, a business regularly cheats its customers, my investigation of that behavior and revealing it publicly would certain "damage" that business, but we conclude that's justified if for no other reason than it's the truth. Would digging up an embarrassing revelation about "our Nation or its people" constitute "irreparable damage" sufficient to justify concluding that the 1st amendment didn't apply? Had the fact that we'd slaughtered Indians in the late 1800's been kept secret until today, would its discovery and publication be that "irreparable damage" that regulation could legitimately seek to prohibit? Would the news that the events leading up to the "Gulf of Tonkin resolution" were a fraud cause "irreparable damage"? Would finding out the truth about the Watergate incident cause "irreparable damage"? In a sense, speaking of any of these incidents might cause "irreparable damage" to government and people, but it's "damage" that a person should simply be entitled to do, given the concepts of free speech and the 1st amendment. In short, I don't think Bernstein should give an inch. There may, in fact, be limits on the 1st amendment, but I don't see this as being one of them. Jim Bell jimbell(a)pacifier.com

3 2

Re: www.anonymizer.com
by attila 17 Dec '03

17 Dec '03

Addressed to: Bill Stewart <stewarts(a)ix.netcom.com> Cypherpunks <cypherpunks(a)toad.com> ** Reply to note from Bill Stewart <stewarts(a)ix.netcom.com> 07/25/96 11:38pm -0700 = <<<<>>>> = * Frames, for instance, do bizzare things when anonymized, at least = with Netscape 3.0b5. Frames are, of course, _evil_, and are banned = by the CDA, and anyone who uses them should be flamed mercilessly = and forced to use Lynx on a 24x80 monochrome display until he or she = repents and sees the error of their ways, and if that doesn't work = they should be exiled to AOL with only Microsoft Word Internet Assistant. = But that's a flame for another day.... = <<<<>>>> = I did not realize you were sadistic --or is this possibly latent masochism? my aggravation is the commercial hosts want to know all --we do not wish to give them our all... maybe an easier solution on anonyminity would be to establish a _plausible_ ID for www.anonymizer.com sites. make sure the target receives as much information as, say Netscape, might give them... So what if time, inc. collects 5000 cases of Bill Stewart at some host which anonymizer creates. your point on matching security levels is valid; anonymizer needs to report the difference in security levels to you --you make the decision. --send a very simple response form at connect time showing the parameters, and you make the decision. this, of course, would be a reasonable idea in all cases so you have a solid idea oj just who are connected to --fun if both ends are anonymized! --- Cyberspace is Our Freedom! Fuck Their CDA! Democracy Requires Free Speach & Strong Cryptography

1 0

Schelling points and enthropy of human mind
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hi, Tim May presented an interesting concept of two persons who want to meet in Washington DC but forgot to decide where to meet. He says that they will likely to be in only several places and that such places will be "points of low enthropy". The question is, how do you define "enthropy" in this case? Also, for a while I've been thinking about enthropies of cultures and individuals. I wonder if anyone knows any books or theories that define such things. - Igor.

1 0

Re: Nerds, Dykes, Niggers, Dweebs, Fags, Bimbos, and Geeks
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:13 AM 7/27/96, Igor Chudov @ home wrote: >Timothy C. May wrote: >> >> I just cringe when I meet young programmers at Cypherpunks who mumble "I'm >> just a computer geek." Fine, I write them off as geeks. >> > >OK, I am a foreigner. Can anyone explain me what the word "geek" means >and what are the origins of this word? I thought it was a cool word, >meaning someone orthogonal to the present world but being able to >change it. No, "geek" is not a "cool" word. "geek n. Slang. 1. An odd or ridiculous person. 2. A carnival performer whose show consists of bizarre acts, such as biting the head off a live chicken. (Perhaps alteration of dialectical "geck," fool, from Low German "gek," from Middle Low German." (American Heritage Dictionary of the English Language, Third Edition) And the full Oxford English Dictionary, Second Edition, Magnifying Glass Version, gives essentially the same definition, and cites an 1875 appearance in American slang. It mentions a "dumb sideshow stooge." Until recently, this was the only usage I knew of. One heard girls pointing at "geeky guys" and saying "What a geek!" Still think it's a "cool" word? How programmers came to adopt this as a badge of pride is beyond me. (I guess they don't especially care what the girls think, especially of course if they're one of the oh-so-popular "Geek Queers"--I don't even want to _think_ about what they bite the heads off of.) That foreigners are arriving in the U.S. and calling themselves "geeks," "dweebs," and "nerds" reminds me of those old cruel ploys of teaching foreigners a few words of English, e.g., "I am a very shitty person, fuck you very much!" Sad, real sad. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Why the world needs privay protecting Ecash
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:17 PM 7/26/96, Lucky Green wrote: >>>> S.KOREA PROBES 15,000 PEOPLE OVER CREDIT CARD USE - South Korean >> state prosecutors are probing 15,000 people for excessive use of >> their credit cards overseas in a crackdown on lavish spending, a >> prosecution official said on Thursday. [Reuters, 200 words] > Good to know that the U.S. will cooperate in these investigations. I would hate to see these South Korean's spending "the people's" money in improper ways...oops, am I confusing South Korea with the Benevolent People's Republic of North Korea? Or are they just converging, just as the U.S. is converging with the PRC? Which raises a question about the laws in the U.S. on "structuring" of financial transfers. If Alice uses her U.S. VISA card to make many cash withdrawals at ATMs in Zurich, Lichtenstein, Geneva, London, etc., are there any U.S. requirements that she obtain and fill out reports (in triplicate) on these transactions? Suppose the cumulative ATM transactions hit the magic $10,000 level? I've heard folks describe this as a sure-fire way to transfer funds out of the U.S. to offshore banks, without the risks of carrying cash (*), but I wonder if any laws actually make this fall into the "structuring" penumbra. ("Structuring" refers to, for example, making multiple sub-$10,000 transfers so as to (apparently) evade the intent of the U.S. law on reporting all transactions of $10,000 or more.) (* Traveller's checks, cashier's checks, etc., are other options. One Cypherpunk has some interesting ideas about using traveller's checks to evade the U.S. requirements.) P.S. Do you know that if you save $200 a week out of your paycheck and put under your mattress, that after a year you will have saved $10,000? That's the good news. Now, the bad news. Do you know that if you try to deposit this $10,000 in cash in a bank, or spend it on a car, that an investigation may be triggered? That your money may be taken from you in an "asset seizure"? Unless you can prove where you got the money--rather hard in the mattress example--it may be taken from you and never returned, even if there is never a court case charging you with a crime, much less a conviction. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Freeh Testimony 7/25/96
by jim bell 17 Dec '03

17 Dec '03

At 03:08 PM 7/26/96 -0400, David Lesher wrote: >Further, the more interesting aspects were what Freeh said under >interactive questioning by the Senators. He artfully avoided >many of their direct questions, but found himself on the rocks >on others. > >He seemed rather surprised at the tenor & thrust of the questioning; >He could not have thought this would be a cake-walk but he sure >acted that way. Here's a question I'd like somebody to ask Freeh: "There are some people who believe the development of uncompromised good encryption and easy communication, represented by the Internet, will lead to a world with drastically less _need_ for government, and a world that will be essentially ungovernable by centralized governments. You are a representative of government, first and foremost. Your job and salary and pension may be on the line if these predictions are true. To what extent is your position on key-escrow/GAK designed to resist or prevent such an eventuality?" (He'll probably answer that he doesn't understand the question..." Jim Bell jimbell(a)pacifier.com

1 0

Re: Schelling points and enthropy of human mind
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:05 AM 7/27/96, Igor Chudov @ home wrote: >Hi, > >Tim May presented an interesting concept of two persons who >want to meet in Washington DC but forgot to decide where to meet. >He says that they will likely to be in only several places and >that such places will be "points of low enthropy". > >The question is, how do you define "enthropy" in this case? Well, I used "entropy" in the usual sense of the constellation of definitions: - low entropy means increased predictability (in this case, Alice and Bob are more able to "predict" what the other will decide than if the points were more "random") - low entropy is associated with "less randomness" (randomness is a notoriously controversial subject, discussed here often, so please don't clutter the list with quibbles about randomness) - "random" is related to "unpredictable" is related to "not compressible" is related to "disorderly" - "nonrandom" is related to "predictable" is related to "compressible" is related to "orderly" Schelling points are of course related to the notion of "emergent order," in that order emerges without prior communication between Alice and Bob. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0