December 2003 - cypherpunks-legacy

FW: Online Cyberlaw Workshop
by blanc 17 Dec '03

17 Dec '03

FYI, for anyone here who might be interested..... .. Blanc ---------- From: Dick Moores[SMTP:rdm@netcom.com] Sent: Thursday, February 29, 1996 7:26 AM To: SEASIGI Subject: Online Cyberlaw Workshop (from TOURBUS) CYBERSPACE LAW FOR NONLAWYERS ----------------------------- Three highly respected law school professors (Professor Larry Lessig, University of Chicago Law School; Professor David Post, Georgetown University Law Center; and Professor Eugene Volokh, UCLA School of Law) have written a *FREE*, online cyberlaw workshop called, appropriately, "CYBERSPACE LAW FOR NONLAWYERS." CYBERSPACE LAW is specifically written for lay people like you and me, and the workshop's lessons use easy-to-understand English -- NOT legalese and Latin! YEAH, BUT WILL I *UNDERSTAND* IT? --------------------------------- Actually, yes. The workshop's authors really are writing CYBERSPACE LAW's lessons for educated lay people, *NOT* lawyers. I took a look at an earlier article written by one of the workshop's professors (Eugene Volokh, "Cheap Speech and What It Will Do", 104 Yale L.J.1805 (1995)), and I have to say that I am quite impressed ... although I have to say that I am quite disappointed that Volokh did not have a single Southern word *anywhere* in his article :) WHAT WILL THE WORKSHOP COVER? ----------------------------- CYBERSPACE LAW is going to help you learn the basic principles of -- and unlearn some common myths about -- - copyright law, - free speech law, - libel law, - privacy law, - contract law, and - trademark law as they apply on the Net. Each CYBERSPACE LAW "lesson" should be about the size of an average TOURBUS post (about a page or two), and will e-mailed to you through an e-mail distribution list. The CYBERSPACE LAW workshop will last a couple of weeks, and you'll get two or three letters a week from the authors ... and, best of all, the entire workshop is FREE! THE INSTRUCTORS --------------- Professor Larry Lessig clerked for U.S. Supreme Court Justice Antonin Scalia, and now teaches constitutional law and the law of cyberspace at the University of Chicago Law School. He's written about law and cyberspace for the Yale Law Journal and the University of Chicago Legal Forum (forthcoming). Professor David Post practiced computer law for six years, then clerked for U.S. Supreme Court Justice Ruth Bader Ginsburg. He now teaches constitutional law, copyright law, and the law of cyberspace at the Georgetown University Law Center. He's written about law and cyberspace for the University of Chicago Legal Forum (forthcoming) and the Journal of Online Law, and writes a monthly column on law and technology issues for the American Lawyer. Professor Eugene Volokh worked as a computer programmer for 12 years, and is still partner in a software company that sells the software he wrote for the Hewlett-Packard Series 3000. He clerked for U.S. Supreme Court Justice Sandra Day O'Connor, and now teaches constitutional law and copyright law at the UCLA School of Law. He's written about law and cyberspace for the Yale Law Journal, Stanford Law Review, Michigan Law Review (forthcoming), and the University of Chicago Legal Forum (forthcoming). TO SUBSCRIBE ------------ The CYBERSPACE LAW workshop probably won't start for a month or so, but you should sign up as soon as you can. To subscribe to the workshop (for FREE!) send an e-mail letter to LISTPROC-REQUEST(a)COUNSEL.COM with the command SUBSCRIBE CYBERSPACE-LAW yourfirstname yourlastname in the body of your e-mail letter, replacing "yourfirstname" and "yourlastname" with your first and last names.

1 0

Re: Problems with certificates.
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:35 AM 3/1/96 -0500, "A. Padgett Peterson P.E. Information Security" <PADGETT(a)hobbes.orl.mmc.com> wrote: >Today, each person generates their own PGP key. While it is unlikely that >any two will match, it is likely that at some point some two will match >(see matching birthdays in a bar - number is less than you would think). PGP KeyIDs are 8 hexes long (formerly 6), and there have been some natural collisions and it's easy to manufacture them. On the other hand, the MD5 hash used for key fingerprints is 128 bits long, and cryptographically strong. So birthday-problem collisions occur when you have ~ 2**64 keys around, which is not a problem, and you can't generate collisions on purpose either. A 64-bit hash would be more interesting; you get collisions if you have around 2**32 keys, which could actually happen. >Next rage might well be "vanity" PGP keys. While at the moment it is not known >how to create a specific match key to a sequence, if you generate enough >keys, there will be some interesting sequences found. Possibly some PGP >signatures will even be in violation of the CDA (now that should start a rush 8*). :-) The main problem is the limitations of hex; keyids like 0xdeadbeef are available, but it's tough to really trigger Exonization that way. Using 32 bits as ASCII instead is a bit more flexible. >For some time I have been concerned about the scalability of PGP. It works >well in small groups but after trying once to create a 6,000 member keyring >(took over three days on a 386 & was several meg when done) Yeah - lots of people have been concerned about this. Keyservers simplify the problem a lot, since you no longer need to carry a large number of keys around yourself, but the keyring handling mechanism of PGP wasn't designed to scale. Wouldn't be too hard to redesign, once PGP 3.0 comes out and we've got tools to do it - you could use a database or decently structured ASCII file or files. And DNS or similar distributed keyserver can make it easier to find, for people who are on-line. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

2 1

Re: Truly Random Numbers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:26 PM 3/2/96, Adam Shostack wrote: > My expectation would be that your numbers are not random in a >cryptographic sense, and that this route of attack is much less >efficient than others that would be used. > > I'll note that PGP does NOT take your data entered and convert >it to numbers, but takes timings to choose a hard to predict starting >point for its prime searching. Yes, which is why I said this in my post: "...With a reasonable amount of entropy, such as picking the next digit from several keyboard timings, I expect the 150-decimal-digit number to be *very* random!" > I'd expect this use of timings is better than using the large >random number you entered, but in a theory sense only. Both are >pretty difficult; thats why we like large numbers. :) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: M A F_i o s
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:27 PM 3/1/96 -0500, John Young <jya(a)pipeline.com> wrote: > 3-1-96. TWP: > "Expert Panel Wants Intelligence Director to Hold More Power." > The commission finds that the patchwork of 14 separate > intelligence agencies is functioning well in its current > form. To meet tbe growing threat of worldwide criminal > activity the panel suggested creation of a high-level > policy group run out of the White House, called tbe > Global Crime Committee. But they've already _got_ the Pentagon! The title does remind me somewhat of "Buckaroo Banzai against the World Crime League".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Is there any work on entropy-lowering schemes?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

On Fri, 1 Mar 1996, Mutant Rob wrote: >So it seems possible to create a scheme that given a key will take a >block of n bits and expand it to 1.5n or 2n bits, recoding it in such >a way that determining the key is difficult even if one suspects such >a scheme has been used... but that using the scheme will make the data >look more like the MSBs of graphical data rather than encrypted data. Stealth 1.3 (or is it 1.2?) does that, but it only makes the data look more like the MSBs, and not *exactly* like the MSBs. I think it's available from Adam Back's WWW site (http://dcs.ex.ac.uk/~aba/stealth/) Mark

1 0

Re: Anonymous Web Browsing
by Powers Glenn 17 Dec '03

17 Dec '03

- From: tcmay(a)got.net (Timothy C. May) - At 5:24 AM 3/2/96, dwhite(a)pris.bc.ca wrote: - > My question is this: Would it be possible to create a web site that - >would function along the same lines as remailers do? Something that would - >allow a person to browse anonymously. So lets say I surfed into a - Tim May writes: - Your intuitions are correct, that protection steps are needed. The - technology is developing, but the perceived need (anonymous browsing) is - probably less than the perceived need for anonymous e-mail. simple, not real secure solutions: find a unix host, run the cern httpd server, turn on proxying, turn off logs. (about 10-15 minute setup) if this is not run often, it works well. use netcom (or something similiar) that gives you dynamic ip addresses. as a bonus, netcom doesn't require an actual name or address. (yes, they require a CC#). this allows fairly anonymous access. (prehaps one reason the neeed for web proxies isn't that high) glenn

3 2

Random keys ?
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

> This does not demonstrate that the RSA keys are as well >distributed, but it does generate some confidence that the key >generation methods of PGP are not very broken. Testing for RSA >generation would be more difficult, since there are some practical >difficulties in getting a large sample of RSA private keys. True but do not need private keys, just public ones (one to one relation), should be able to get a large sample (20,000 in one place did I hear ?) of those. Warmly, Padgett

1 0

Re: Anonymous Web Browsing
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:44 PM 3/2/96 +0000, "Mark Grant, M.A. (Oxon)" <mark(a)unicorn.com> wrote: >> These are "web proxies," and searching on this should produce some >> information to answer your questions. >.... hidden mailto: .... even worse with Javascript. > >Note to Netscape people: Is it possible to have an option that will *always* >pop up a mail window and request confirmation before mail is sent out? Or >disable mailto altogether? It would be a lot easier than binary editing >the executable to remove all the mailto strings... At least in the Windows version, you can set the SMTP server you want to use for your outgoing mail. So you could do a proxy email server that listens for SMTP and pops up confirmations for outgoing traffic. For the moment, you'd probably have to write your own, but the new Winsock Remailer probably has the code you need to do most of the work, and you'd only have to add some GUI buttons and whistles. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

2 1

Anonymous Web Browsers
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>I took the JavaScript stuff that was posted and put it in one of my web >pages (http://students.cs.byu.edu/~don/mail2news.html) I had to pick a new >address because support(a)netscape.com is reportedly now just an autoresponder. >I've disabled java, I've changed the mail server to null (from the default >localhost) and none of it stops the JavaScript from sending mail. You did this to the *server* or the *client* ? (the latter is what I was talking about). If the client, then is Netscape/Java acting as its own mail server ? Guess I am going to have to did out a sniffer and see just what is going on... Warmly, Padgett

1 0

Re: Web of Trust vs other models
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:48 AM 3/1/96 -0500, you wrote: >There are a pool of 1 million keys. Each of those keys is signed by between > two and 5 other randomly chosen keys in the pool. > Each signature implies a trust relation between the key and the signer. >Given that, determine mean, min, and max path lengths for purposes of > "certification". >Has anyone done this experiment? Probably been done, though not necessarily in a PGP context. The problem is equivalent to analyzing a randomly selected directed graph, and some Operations Research or CS grad student has probably done it. Meanwhile, Don Kitchen at one point collected all the data off the MIT keyserver for analysis, which is a much different problem than random signatures. I found that the chain from some middle point, such as Phil Zimmermann's or Derek Atkins's key was about 12-14 levels deep, averaging about 6, which compares interestingly with the default PGP depth limit of4. From my key, it was pretty deep, especially since my certification from Phil Karn was from one of his older keys, which is why I asked Derek to sign my key... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0