December 2003 - cypherpunks-legacy

Remailers & liability
by Greg Broiles 17 Dec '03

17 Dec '03

Hello again to list folks. Had to disappear for a bit due to school & work, but am back for a few weeks before the bar. (doh.) I upgraded from Eudora Lite to Eudora Pro before resubscribing and find its filtering makes the cpunks traffic much more manageable. Cheerfully recommended to everyone who's still got cpunks dumping in their regular mailbox and cursing at the lack of mail kill files. Have been following the discussion re remailers & liability. The use of waivers and hold-harmless clauses and ROT13 and all of the rest seems like it might have some potential where the potential plaintiff you're worried about is a message recipient angered or shocked by receiving mail which bothers them. I don't think they'll do much good where the potential plaintiff is a third party whose gripe is that the material was distributed. I'm thinking here of copyright plaintiffs like Newsweek or Brad Templeton/Clarinet or the Church of Scamentology, or a person concerned about invasion of privacy or defamation. A recipient can't waive/disclaim the rights of a third party, and an indemnity clause isn't worth much without assets and an honest intention to back it up. Waivers and disclaimers also aren't likely to be any help against criminal charges, because the aggrieved party is the State, not the "victim". The real key to long-lasting remailers is relatively judgement-proof remailer operators who aren't scared of going to court. (cf. Grady Ward and Arnie Lerma) Remailer operators are first amendment activists who are going to take heat the same way that environmental and anti-abortion activists have. I talked with one woman who was hit with a judgement by a timber company after she & other activists blocked logging equipment, causing the timber company to lose money (_Huffman-Wright v. Wade_, 317 Or 445, 452, 857 P.2d 101 (1993)) - her comment was that she's able to maintain a reasonable but not luxurious life with the roughly $9000 per year income that the judgement creditor can't touch, and that the minimal possessions which can't be seized by the sheriff are enough for her. Remailer operators may have to choose between comfortable living and their commitment to the principle of free speech. Remailers are attempting to do something that the legal system is hostile to - allow action (potentially harm) without corresponding liability. (If the remailer's not liable, and the sender isn't identifiable, there's nobody to sue and nobody to throw in jail.) Some people on the list take the position that sending and receiving electronic data cannot create the sort of harm that the legal system ought to concern itself with. While this might be the case (I'm not convinced yet either way), it's certainly not the law. Lots of tricky lawyers spend lots of time trying to structure relationships so that it's possible to have activity without liability for their clients. As far as I can tell, the way to achieve this result is through public relations and lobbying (e.g., "tort reform"). Unfortunately, remailer operators aren't as sympathetic as big insurance companies, so we may lose out. :( For what it's worth, I'm still planning to run a remailer again when I get settled down somewhere. (I don't think remailers do much good where the operator isn't root, so I'm not bothering with trying to run one on someone else's system.) My debt/asset ratio is bad enough from all of this school that I don't have much for anyone to levy against. Ha, ha. Anyone want some rapidly obsolescing computer and law books? :( -- Greg Broiles |"Post-rotational nystagmus was the subject of gbroiles(a)netbox.com |an in-court demonstration by the People http://www.io.com/~gbroiles |wherein Sgt Page was spun around by Sgt |Studdard." People v. Quinn 580 NYS2d 818,825.

1 0

PILATE SAYETH UNTO HIM...
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 12:30 AM 5/24/96 -0500, Jim Choate wrote: > Sorry but the very fact that I don't agree with you is proof enough that > there is no absolute 'Truth' as you use it. That is unless you are > attempting to claim absolute omnipotence on the point of determination. Say Jim, did you major in sociology literature: Here is Dave Barry on college and truth: After you've been in college for a year or so, you're supposed to choose a major, which is the subject you intend to memorize and forget the most things about. Here is a very important piece of advice: Be sure to choose a major that does not involve Known Facts and Right Answers. This means you must *not* major in mathematics, physics, biology, or chemistry, because these subjects involve actual facts. If, for example, you major in mathematics, you're going to wander into class one day and the professor will say: "Define the cosine integer of the quadrant of a rhomboid binary axis, and extrapolate your result to five significant vertices." If you don't come up with *exactly* the answer the professor has in mind, you fail. The same is true of chemistry: if you write in your exam book that carbon and hydrogen combine to form oak, your professor will flunk you. He wants you to come up with the same answer he and all the other chemists have agreed on. Scientists are extremely snotty about this. So you should major in subjects like English, philosophy, psychology, and sociology -- subjects in which nobody really understands what anybody else is talking about, and which involve virtually no actual facts. I attended classes in all these subjects, so I'll give you a quick overview of each: read little snippets of just before class. Here is a tip on how to get good grades on your English papers: Never say anything about a book that anybody with any common sense would say. For example, suppose you are studying Moby-Dick. Anybody with any common sense would say that Moby-Dick is a big white whale, since the characters in the book refer to it as a big white whale roughly eleven thousand times. So in *your* paper, *you* say Moby-Dick is actually the Republic of Ireland. Your professor, who is sick to death of reading papers and never liked Moby-Dick anyway, will think you are enormously creative. If you can regularly come up with lunatic interpretations of simple stories, you should major in English. PHILOSOPHY: Basically, this involves sitting in a room and deciding there is no such thing as reality and then going to lunch. You should major in philosophy if you plan to take a lot of drugs. PSYCHOLOGY: This involves talking about rats and dreams. Psychologists are *obsessed* with rats and dreams. I once spent an entire semester training a rat to punch little buttons in a certain sequence, then training my roommate to do the same thing. The rat learned much faster. My roommate is now a doctor. If you like rats or dreams, and above all if you dream about rats, you should major in psychology. SOCIOLOGY: For sheer lack of intelligibility, sociology is far and away the number one subject. I sat through hundreds of hours of sociology courses, and read gobs of sociology writing, and I never once heard or read a coherent statement. This is because sociologists want to be considered scientists, so they spend most of their time translating simple, obvious observations into scientific-sounding code. If you plan to major in sociology, you'll have to learn to do the same thing. For example, suppose you have observed that children cry when they fall down. You should write: "Methodological observation of the sociometrical behavior tendencies of prematurated isolates indicates that a casual relationship exists between groundward tropism and lachrimatory, or 'crying,' behavior forms." If you can keep this up for fifty or sixty pages, you will get a large government grant. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Children's Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"bruce(a)aracnet.com" "Bruce Baugh" 25-MAY-1996 09:21:06.18 >I don't see that this is necessarily true for information any more than it >is property. Property can be bought, sold, traded, given away, made...but it >can also be stolen. Just as I have a right to complain if you walk off with >my couch without my permission, so if you walk off with data on my blood >chemistry or credit history without my permission. Certainly, if you were coerced into giving up this information, it would be wrongful - including to knowingly retransmit it. But that's only the case for dealing with governments (and, I would include, other coercive groups such as monopolistic and oglipolistic corporations). You do have a choice in dealing with other entities. I make that choice; I minimize my use of a credit card, for instance. I've had months where my bill was $0.00. Now, if the agency in question is required to collect such information because of coercion, then that's wrongful, and that information shouldn't be retransmitted. -Allen

1 0

Re: Children's Privacy Act
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"llurch(a)networking.stanford.edu" "Rich Graves" 25-MAY-1996 02:09:28.75 >I'm sure you know the law and practice better, but my insurance seems to >have a "preexisting conditions" clause. Knowingly doing the above >constitutes fraud. (Of course lots of people probably get away with it.) And how's the insurance company going to know that something is a preexisting condition when they can't keep records of it? Moreover, partially due to state laws, most preexisting condition exemptions have limits on how long they last; if someone has a 1-year window, and they sign up more than 1 year after when they find out about their having Huntington's, then it will be covered despite their knowing about it. >Moreover, when the insurance company pays out, that ultimately comes out >of premiums. I don't have Huntington's, but I don't mind paying an extra >$X into a risk pool for people with Huntington's because it means I don't >have to submit to genetic screening, either. You don't have to have >something to hide to see it as an invasion of privacy. It's a pool of >consumers establishing preferences, not just individual consumers v. >producers. The meaning of microeconomics changes as it scales. This would be the case if the laws in question didn't exist. If you don't want to get genetic screening - because you have Huntington's or because you don't like genetic screening - it should be perfectly possible for you to make that choice, and pay the higher premiums. But it should also be possible for someone to make the opposite choice; that's what current laws prevent. It is not, at present, consumers establishing preferences - it's the majority dictating its preferences to the minority. >By "fairness" I meant that equal risks should be treated equally. Cost of >disease A = cost of disease B. The detection of predisposition to disease >A is politically feasible, but the same isn't true for disease B. I'd say >you were discriminating against people predisposed to disease A, because >they're paying into the risk pool for B, but B isn't paying into the risk >pool for A. That's an argument against any restrictions on risk. Currently, in most states it is politically feasible to get higher rates for someone addicted to nicotine, even if the person became addicted when they were too young to be responsible for their own actions (generally the case). But in some of those same states, genetic screening is banned. Aren't you being unfair to the smoker? Some people argue for community risk pools, in which everyone in a community gets the same rate. But shouldn't someone who is sicker because of his/her own choices (e.g., chooses to have unprotected sex) pay a higher rate? But such choices are what I'd call even more private than genetics. Whether I've had unprotected sex in the past 5 years is a lot more intrusive a question than whether I have any genetic diseases in my family tree. Quite simply, politically unfeasible means should be removed from the realm of politics. -Allen

1 0

Re: Why does the state still stand:
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"hfinney(a)shell.portal.com" "Hal" 16-MAY-1996 10:21:05.33 >One issue is whether these banking-secrecy countries like Anguilla are >followers of the Berne convention or other international copyright >regulations. Banking secrecy and software piracy don't necessarily go >hand in hand. I hear a lot about copyright violations in China but not >in the Caribbean. So actually it isn't clear that this country is the >right location for a remailer that can post arbitrary material. As I have stated, I am currently working on the second edition of this list. One consideration that I have thought of on using a banking-secrecy country is that it may be possible to set up a local limited-liability corporation there (assuming a remailer requiring an ecash payment), possibly paying into a trust fund with duress provisions. As an example, I might set up an offshore company in Anguilla which was owned by a trust fund; I would be the initial trustee for this trust fund, and Vince Cate might be the backup trustee if I was put under any duress (e.g., legal problems). Since I would have some costs for the initial setup of such an operation, I would deem it perfectly reasonable for the trust fund to owe me some money, which it would then pay me back as interest on this loan. -Allen

1 0

Re: [SCARE]: "If you only knew what we know..."
by jim bell 17 Dec '03

17 Dec '03

At 09:48 PM 5/25/96 -0400, Subir Grewal wrote: >The exception I took to your proposal was that it seemed like a >half-measure to me. From what I understand of it the porposal is that >elected officials who "do wrong" (or violate a particular code of conduct) >should be killed. I would suggest that this is problematic because it >does nothing to solve the ills of the system, simply clears those players >whom a particular set of people do not believe are playing fairly/well. And any successors that take their place, as well. Remember, even a tiny fraction of the population can eject (by forced resignation or worse) an officeholder. The only ones who survive (literally or figuratively) are the ones who don't irritate even a tiny fraction of the public. Those will be the ones who don't do anything, and are not paid by stolen taxes. >I'm not sure I'd accept the claim that millions of offenders (I too find >drug laws stifling, illogical and counter to the liberal ideal) are put in >jail, deprived of their freedom by a particular set of people. Drug laws >are a reflection of the opinions held by many people in this country (and >others), of course we wonder sometimes whether people have really thought >about it or whether the "just say no" jingle was too irresistable, and the >concept of "a war on drugs" another tool to define outsiders against whom >to band against and maintain a cohesive identity. To a great degree, the "public perception" of drugs and drug laws has been a _product_ of the news media, in particular the TV networks and the newspapers, as influenced by the government. Study the matter and you'll find this is true. There is no reason to believe that the community will be as anti-drug as the conventional wisdom says they are. > And the manner in which >Americans (and indeed other peoples) have been whipped into fervour by >the rhetoric that accompanies a war is truly frightening. This "whipping" is quite intentional. It keeps cops, prosecutors, and judges employed. Not to mention politicians. > But I reall >don't think killing a few Presidents or Joint Chiefs of Staff or Prime >Ministers will solve this (or anything). Please understand: While the term "assassination" is usually used to refer to killings of high-level people, I'm using a broader definition to refer to ANY target, including middle and lower-level people. My solution is far more thorough than you've implied. Anyone who exercises force for the state is subject to "recall." Even people who just take a government paycheck are at least nominally at risk. > It seems as if you were trying >to say that AP is acceptable because similar methods are employed by the >state all the time. I will not defend the coercive actions of the state, >but I do not believe they give one the right to coerce others, especially >if they are removed from the actual act. How "removed" do they have to be to be innocent, in your opinion? >:Then you need to learn to be more consistent. While you may, indeed, be a >:pacifist, most of the rest of us see nothing wrong with the concept of >:self-defense. You may argue as to what's really self-defense and what >:isn't, but the reality is that government engages in violence and the >:threat of violence regularly. Are you, by your statements, implicitly >:tolerating violence by government that you wouldn't tolerate from >:individuals? It is easy to fall into such a trap. > >But self-defense is not conductive either. To bring a rather fascinating >example into this, in the 70s a group of students occupied a variety of >buildings at NYU in protest against the Cambodian war. They set a bomb >in our computing center that was defused just before it blew. But if it >had detonated it would have destroyed a rather large computer (used for >pure mathematical problems that the Dept. of Defense wished to >incorporate into its Nuclear program) Nuclear bomb design. Done with funds stolen from taxpayers. Done to protect the leadership of this country, not the public. > and a number of people standing >outside the building. The rationale used was that this was >"self-defense", the people of the world were banding together to protect >each other from the actions of the state. In practice, it probably WAS "self-defense." However, it may not have been a particularly selective example of self-defense. The system I describe is, in fact, vastly more effective than this at getting rid of the bad guys, and far more selective than a planted bomb. > While I sympathize with the >feelings that led the activists to take such measures, I have no respect >for their methods or the reasoning they employed to extend the argument >for self-defense into a situation that had nothing to do with >self-defense. That's why I think my system will be far better. >No, I do not wish to condone the coercive actions of the state (and >certainly not any violent ones), and certainly we all take exception to >one or another act of the government machine. Incidentally, I do not >believe the state has the right to take life in the quest for justice >(aka the death penalty). A war against a foreign threat can be justified >on grounds of self-defense. Notice, however, that the US government fails to use a cleaner method to defeat its opponents (killing the leaders) and in its place puts the lives of thousands of solders at risk. Isn't this illogical, unless you realize that if WE can do that to those foreign leaders, THEY can do the same to OUR leaders? Isn't this more than a bit self-serving on the part of our leaders? And isn't it immoral for George Bush, for instance, to choose a solution that results in the deaths of tens of thousands of comparatively innocent Iraqis, both during and after the Gulf war, rather than bumping off Saddam Hussein? Think about it. Exactly why does he do the former, rather than the latter? >:Why? Isn't it possible that it is not possible to reform a system because >:embedded within it is a fundamental flaw which makes real freedom >:impossible? The current system is heirarchically structured, and results in >:situations where millions die in the place of the very few. I'd say that's >:a serious, systemic flaw that needs fixing. > >- From what I've gathered of AP, it attempts no radical reformation of "the >system", simply adds another set of costs for individuals within the govt. >to take into account. "Another set of costs"? Yikes! Read the essay, governments as we know them can't possibly survive post-AP. >I don't think you're proposing a "true democracy" >or absolute anarchy (without all the conotations of disorder, simply >no-government), but rather a vigilante clause, I may have misunderstood >you though. It may be looked at as an example of vigilante action, but it will be ANONYMOUS vigilantes. > A minimalist state is generally considered desireable as it >provides a framework within which individuals can engage in mutually >beneficial interactions with each other. That's conventional wisdom. Historically, anarchy is considered unstable. Freud though so, but he was wrong. Read part 9. > Our present structures do not >"work" very well (though they have their redeeming factors when compared >to other alternatives) and I'd say we need a greater degree of respect for >personal liberty and individualism than is manifest in our institutions >today, but these changes take place on a level very different from that of >govt. the state is almost powerless when it comes to these metamorphoses >in opinion. Well, I disagree. Until recently, public opinion was almost entirely manufactured. It was a joint project of the government and the news media. > They take place through tradition and the spread of ideas not >through legislation. The alternative I would suggest is an appreciation >for the minimalist state (with the observation that there are some things >the state does do very well, and which are desireable) and the liberty of >the individual. Similarly a respect for life is in order, too often we >think we're absolutely right and believe we should use "any means >necessary" (no reflection on the misunderstood philosophy of Malcolm X) Is there any significant likelihood that the people in power today will relinquish power absent a system such as AP? I'm not optimistic about that. Jim Bell jimbell(a)pacifier.com

2 1

holographic remailing & the scientologists
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

it seems that anonymous remailing has split into two basic areas, each with distinct requirements and demands and problems: 1. private mail, sent to another email address 2. posts to Usenet or other forums such as mailing lists. now, interestingly, apparently most of the extremely heavy political backlash has come against (2), causing Hal Finney for example to advocate or suggest that remailers not be designed for posting but be limited to emailing to individual users somehow. (he didn't mention how mailing lists would be handled, but one might screen out email addresses that are "known mailing list addresses" or something like that) regarding (2), with scientology, I was trying to imagine how one could accomplish the same feature of distributing information anonymously in a "public place", but without giving the scientologists the ability to track a particular origination of the email, even remailers. Chaum's DC net idea is a useful approach. here I'd like to suggest another. some time ago someone had the amusing idea of cutting up the PGP binary code, UUencoded, and putting all the zillions of pieces in peoples signatures. each person would send mail to the signature server to pick up one of the 1/n pieces, and they would put it in their messages. frankly, I think this was a great idea that we could explore some more. in a sense, it stores data "holographically" over all kinds of different people's messages. imagine a system in which the scientology documents are stored in people's signatures, and someone writes software to go and recombine the documents based on finding signatures "out there". this could be applied to one newsgroup by having remailers post only tiny pieces of the material, but with enough on the newsgroup at any time to recombine them all with the software, but far too many pieces for the scientologists to attack all the remailers they are sent through. (people could post them through their regular email addresses). furthermore anyone posting a piece has a sort of minor plausible deniability. ("I just copied the signature from so-and-so as a protest, I have no idea what it refers to") == this all suggests to me the following idea. suppose that some document has been created that someone wants censored. how could net citizens protest this censorship? one scheme would be for everyone to put a tiny piece of the document in their signatures. if you get enough people to do this, it may actually be the case that at any one time, just because of the randomness of all the pieces available, the news server has enough messages archived for a program to scan the message directories and reconstruct the documents from all the pieces that are found. these "pieces" could even be stored solely in the netnews header fields. another idea involves the concept behind "spread spectrum". in this system, little pieces of data are spit out in different places, or channels, and the source and the reciever are scanning the exact same channel at the same time based on exact synchronization. I guess an analogy to usenet would be tiny pieces of data showing up in seemingly random newsgroups, but which are followed or "caught" exactly by the "reconstruction software". some interesting ideas related to steganography that some people might like to play with. == for a model of the scientology problem, it appears that what we have is a set of email addresses (S) and a public forum that essentially reaches some large subset of these people (S2). a person wishes to send out a secret document to S2, but he can't do so by posting to the forum, because then the censors "see" him and shut him down. but what he *can* do is send lots of pieces to a group of people in S, and each of these people individually posts their piece. (the censors have no control over mail sent between individuals, only that posted collectively). possibly, then, there is no single target of "who posted the material" for the censors to clamp down on, and the information eventually can be reconstructed by all S2. == key ways what I am proposing is different than some of the other "cut up the anonymous messages and recombine" proposals out there: 1. the recombination is not done by a remailer. it is done by anyone who can run software on the newsserver (i.e. reading the directories). the scientologists or "censors" cannot tell who is doing this. 2. the messages are not completely comprised of the data to be sent. the data could be stored in headers or the signatures of otherwise "legitimate" messages. note that the same scheme could be applied to web pages. you could store a document "holographically" in which pieces are obtained at all kinds of different URLs. it would be laughable for the censors to try to get court orders against individual pieces. and furthermore, the entire document is not stored anywhere "out there" in particular but recombined by anyone. the scientologists don't know who. note that I am giving the scientologists a lot more credit for their enmity than they deserve. they have mostly lost their war already in many ways, and they aren't a very serious threat to cyberspace in general, imho. they have shown an amazingly unabated aggression & zeal against remailer operators, however, something that could possibly be derailed with a little ingenuity.

2 1

nCognito is Dead..
by Ben Holiday 17 Dec '03

17 Dec '03

Well I have been given my notice to terminate the remailers running at this account. Make a note to remove ncognito from your type2.list, and those running pingers, please remove nCognito as soon as its convenient. Below i've quoted verbatim the request to shutdown that I received. PLEASE note that there is no mention of FBI, NSA, or Co$. :) The request is the result of some errors that mix generated while I was makeing changes, that resulted in the administration at gate.net noticing the remailer. Frankly, I cant blame them given the current legal climate. Although I would have liked to continute operating the remailers, I must admit that I'll sleep better at night now that its gone. BTW: Does anyone know of a few ISP's that accept cash and dont require verification of your identity? :) ----------------------------------------------------------------------------- >From gli(a)gate.net Sat May 25 15:51:35 1996 Date: Sat, 25 May 1996 15:45:19 -0400 (EDT) From: gli(a)gate.net To: Ben Holiday <ncognito(a)gate.net> Subject: Re: Problems with your mail mix program Please note that CyberGate does not support remailer program so please stop running it on gate.net immediately. Repeated violation will cause your login privilege compromised. Your cooperation will be appreciated. Gary Li Systems Administrator CyberGate, Inc. --------------------------------------------------------------------------

3 2

Re: [SCARE]: "If you only knew what we know..."
by jim bell 17 Dec '03

17 Dec '03

At 10:39 AM 5/25/96 -0400, Subir Grewal wrote: >I think an insight your analysis may benefit by is that certain >institutions/societal norms create incetives for "corrupt politicians". >Hayek argues against the "benevolent dictator" concept because he says no >gentle person would ever aspire to be a dictator. The system itself calls >for people who are ruthless to take the reins. A similar argument can be >made for the various functions of a modenr democracy (like the US). It is >rarely that we hear of a considerate IRS auditor, or a principled >politician. The structures themselves call for and promote those who (in >that an individual is more successful if they) are corrupt, power-hungry, >unprincipled and ruthless. Which means that attempting to clean up the system by half-measures is doomed to failure, wouldn't you say? >As for Assasination Politics, I can understand such proposals in jest. Ironically, I originally proposed it to myself in jest. However, I quickly realized that there was far more to it than a joke. I went through most of the objections that were later commonly raised against it, and then concluded that those objections were invalid. I also noted that most people recognized the flaws in those objections after they were explained to them. It has the prospect of enormously changing society. Too many pieces fell into place, like a jigsaw puzzle. This system is NOT an accident; it is fundamental. Admittedly, it is still a bit scary, because of the depth of its changes, but that does not make it wrong! > I too say things to appear controversial. AP was not publicized "to appear controversial." I think it's "controversial" simply because it is so different from the current system, and those in power in that system (and their sympathizers) realize how serious and enormous such a change would be. > As a serious political structure, however, it is reprehensible. Unfortunately, that's not a particularly specific claim. "reprehensible"? I'd call the current system reprehensible. Why should the government be able to put over a million people in prison, most for victimless drug crimes? Why should the government be able to start a war and send millions of people against their will, and thousands to die (as in Vietnam)? Why should their be repeated mass killings (Armenia, Russia, Germany, China, Uganda, Cambodia, Rwanda, etc)? If you could show that the current system had somehow been fixed to prevent these kinds of incident, you might have a point, but you cannot. Your claim is also biased: Everything you think about the term, "political," is based on the kind of systems you know and have known. For you, and most of us, politics is just about defined as that system by which a small number of people manipulate a larger number, ostensibly guided by the wishes of the larger number. > Murder cannot be condoned (as a pacifist, >the argument that politicians create wars and must be killed for that >reason does not hold much water for me) Then you need to learn to be more consistent. While you may, indeed, be a pacifist, most of the rest of us see nothing wrong with the concept of self-defense. You may argue as to what's really self-defense and what isn't, but the reality is that government engages in violence and the threat of violence regularly. Are you, by your statements, implicitly tolerating violence by government that you wouldn't tolerate from individuals? It is easy to fall into such a trap. >and the proponents of such systems >would do well to look more closely at the systemic ills rather than individuals. Why? Isn't it possible that it is not possible to reform a system because embedded within it is a fundamental flaw which makes real freedom impossible? The current system is heirarchically structured, and results in situations where millions die in the place of the very few. I'd say that's a serious, systemic flaw that needs fixing. > The argument that AP is an institutional dis-incentive for >"bad" representatives that offsets other incentives is problematic since I >do not believe the methods are just. I invite you to provide an alternative solution. Jim Bell jimbell(a)pacifier.com

2 1

Where is PGP?
by Michael Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- WHERE TO GET THE PRETTY GOOD PRIVACY PROGRAM (PGP) FAQ Revised 24 May 1996 Disclaimer -- I haven't recently verified all of the information in this file, and much of it is probably out of date. For questions not covered here, please read the documentation that comes with PGP, get one of the books mentioned below, or search for other relevant FAQ documents at rtfm.mit.edu and on the alt.security.pgp news group. A NOTE FROM THE FAQ MAINTAINERS Peter Herngaard <pethern(a)datashopper.dk> is taking over the maintenance of this FAQ until further notice. Some of you sent me (Mike Johnson) corrections and suggestions for this FAQ, and I stored them away on my hard disk to edit from. Then, Windows 95 got indigestion (induced by a sound card) and destroyed all of the data in that partition. If you suggested changes and they aren't in this FAQ, please send them to Peter Herngaard <pethern(a)datashopper.dk>. WHAT IS THE LATEST VERSION OF PGP? Viacrypt PGP (commercial version): 2.7.1 (4.0 is due out Real Soon Now) MIT & Philip Zimmermann (freeware, USA-legal): 2.6.2 Staale Schumacher's International variant: 2.6.3i for non-USA (2.6.3ai source code only); 2.6.3 for USA WHERE CAN I GET VIACRYPT PGP? Just call 800-536-2664 and have your credit card handy. WHERE IS PGP ON THE WORLD WIDE WEB? U.S. only availability: PGP: http://web.mit.edu/network/pgp-form.html PGPfone: http://web.mit.edu/network/pgpfone International availability: PGP and PGPfone: http://www.ifi.uio.no/pgp/ WHERE CAN I FTP PGP IN NORTH AMERICA? If you are in the USA or Canada, you can get PGP by following the instructions in any of: ftp://net-dist.mit.edu/pub/PGP/README ftp://ftp.csn.net/mpj/README.MPJ ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp/ ftp://ftp.gibbon.com/pub/pgp/README.PGP ftp://ftp.wimsey.bc.ca/pub/crypto/software/README WHERE IS PGP ON COMPUSERVE? GO NCSAFORUM. Follow the instructions there to gain access to Library 12: Export Controlled. AOL Go to the AOL software library and search "PGP" or ftp from ftp://ftp.csua.berkeley.edu/pub/cypherpunks/pgp or another site listed above. It is possible to get PGP from ftp sites with hidden directories with the following trick: (1) View the README file with the hidden directory name in it, then quickly (2) Start a new ftp connection, specifiying the hidden directory name with the ftp site's address, like ftp.csn.net/mpj/I_will_not_export/crypto_xxxxxxx (where the xxxxxxx is replaced with the current character string). WHAT BULLETIN BOARD SYSTEMS CARRY PGP? MANY BBS carry PGP. The following carry recent versions of PGP and allow free downloads of PGP. US 303-343-4053 Hacker's Haven, Denver, CO 303-772-1062 Colorado Catacombs BBS, Longmont CO 8 data bits, 1 stop, no parity, up to 28,800 bps. Use ANSI terminal emulation. For free access: log in with your own name, answer the questions. 314-896-9309 The KATN BBS 317-887-9568 Computer Virus Research Center (CVRC) BBS, Indianapolis, IN Login First Name: PGP Last Name: USER Password: PGP 501-791-0124, 501-791-0125 The Ferret BBS, North Little Rock, AR Login name: PGP USER Password: PGP 506-457=0483 Data Intelligence Group Corporation BBS 508-668-4441 Emerald City, Walpole, MA 601-582-5748 CyberGold BBS 612-690-5556, !CyBERteCH SeCURitY BBS! Minneapolis MN 914-667-4567 Exec-Net, New York, NY 915-587-7888, Self-Governor Information Resource, El Paso, Texas GERMANY +49-781-38807 MAUS BBS, Offenburg - angeschlossen an das MausNet +49-521-68000 BIONIC-BBS Login: PGP WHERE CAN I FTP PGP CLOSE TO ME? IT ftp://ftp.dsi.unimi.it/pub/security/crypt/PGP FI ftp://ftp.funet.fi/pub/crypt/pgp/ NL ftp://ftp.nl.net/pub/crypto/pgp ftp.nic.surfnet.nl/surfnet/net-security/encryption/pgp NO ftp://menja.ifi.uio.no/pub/pgp/ NZ ftp://ftphost.vuw.ac.nz SE ftp://leif.thep.lu.se TW ftp://nctuccca.edu.tw/PC/wuarchive/pgp/ UK ftp://ftp.ox.ac.uk/pub/crypto/pgp HOW CAN I GET PGP BY EMAIL? If you have access to email, but not to ftp, send a message saying "help" to ftpmail(a)decwrl.dec.com or mailserv(a)nic.funet.fi WHERE CAN I GET MORE PGP INFORMATION? http://www.csn.net/~mpj http://www.mit.edu:8001/people/warlord/pgp-faq.html http://www.eff.org/pub/EFF/Issues/Crypto/ITAR_export/cryptusa_paper.ps.gz ftp://ds.internic.net/internet-drafts/draft-pgp-pgpformat-00.txt ftp://ds.internic.net/internet-drafts/draft-ietf-pem-mime-08.txt http://www-mitpress.mit.edu/mitp/recent-books/comp/pgp-source.html http://web.cnam.fr/Network/Crypto/(c'est en francais) http://web.cnam.fr/Network/Crypto/survey.html(en anglais) http://www2.hawaii.edu/~phinely/MacPGP-and-AppleScript-FAQ.html http://www.pgp.net/pgp http://www.sydney.sterling.com:8080/~ggr/pgpmoose.html http://www.ifi.uio.no/pgp/ http://inet.uni-c.dk/~pethern/privacy.html WHAT ARE SOME GOOD PGP BOOKS? Protect Your Privacy: A Guide for PGP Users by William Stallings Prentice Hall PTR ISBN 0-13-185596-4 US $19.95 PGP: Pretty Good Privacy by Simson Garfinkel O'Reilly & Associates, Inc. ISBN 1-56592-098-8 US $24.95 E-Mail Security: How to Keep Your Electronic Mail Private "Covers PGP/PEM" by Bruce Schneier Wiley Publishing The Computer Privacy Handbook: A Practical Guide to E-Mail Encryption, Data Protection, and PGP PRivacy Software by André Bacard Peachpit Press ISBN 1-56609-171-3 US $24.95 800-283-9444 or 510-548-4393 THE OFFICIAL PGP USER'S GUIDE by Philip R. Zimmerman MIT Press April 1995 - 216 pp. - paper - US $14.95 - ISBN 0-262-74017-6 ZIMPP Standard PGP documentation neatly typeset and bound. PGP SOURCE CODE AND INTERNALS by Philip R. Zimmerman April 1995 - 804 pp. - US $55.00 - 0-262-24039-4 ZIMPH How to Use PGP, 61 pages, (Pub #121) from the Superior Broadcasting Company, Box 1533-N, Oil City, PA 16301, phone: (814) 678-8801 (about US $10-$13). IS PGP LEGAL? Pretty Good Privacy is legal if you follow these rules: Don't export PGP from the USA except to Canada, or from Canada except to the USA, without a license. If you are in the USA, use either Viacrypt PGP (licensed for commercial use) or MIT PGP using RSAREF (limited to personal, noncommercial use). Outside of the USA, where RSA is not patented, you may prefer to use a version of PGP (2.6.3i) that doesn't use RSAREF to avoid the restrictions of that license. If you are in a country where the IDEA cipher patent holds in software (including the USA, Canada, and some countries in Europe), make sure you are licensed to use the IDEA cipher commercially before using PGP commercially. (No separate license is required to use the freeware PGP for personal, noncommercial use). For direct IDEA licensing, contact Ascom Systec: Erhard Widmer, Ascom Systec AG, Dep't. CMVV Phone +41 64 56 59 83 Peter Hartmann, Ascom Systec AG, Dep't. CMN Phone +41 64 56 59 45 Fax: +41 64 56 59 90 e-mail: IDEA(a)ascom.ch Mail address: Gewerbepark, CH-5506 Maegenwil (Switzerland) Viacrypt has an exclusive marketing agreement for commercial distribution of Philip Zimmermann's copyrighted code. (Selling shareware/freeware disks or connect time is OK). This restriction does not apply to PGP 3.0, since it is a complete rewrite by Colin Plumb. If you modify PGP (other than porting it to another platform, fixing a bug, or adapting it to another compiler), don't call it PGP (TM) or Pretty Good Privacy (TM) without Philip Zimmermann's permission. IMPORTANT: Please note that there is an official distribution site for MIT PGP and another for the International version: WorldWideWeb references: U.S/Canada non-commercial use: http://web.mit.edu/network/pgp-form.html Norway/International non-commercial use: http://www.ifi.uio.no/pgp/ U.S. commercial use: http://www.viacrypt.com WHAT IS PHILIP ZIMMERMANN'S LEGAL STATUS? Philip Zimmermann was under investigation for alleged violation of export regulations, with a grand jury hearing evidence for about 28 months, ending 11 January 1996. The Federal Government chose not to comment on why it decided to not prosecute, nor is it likely to. The Commerce Secretary stated that he would seek relaxed export controls for cryptographic products, since studies show that U. S. industry is being harmed by current regulations. Philip endured some serious threats to his livelihood and freedom, as well as some very real legal expenses, for the sake of your right to electronic privacy. The battle is won, but the war is not over. The regulations that caused him so much grief and which continue to dampen cryptographic development, harm U. S. industry, and do violence to the U. S. National Security by eroding the First Ammendment of the U. S. Constitution and encouraging migration of cryptographic industry outside of the U. S. A. are still on the books. If you are a U. S. Citizen, please write to your U. S. Senators, Congressional Representative, President, and Vice President pleading for a more sane and fair cryptographic policy. WHERE CAN I GET WINDOWS & DOS SHELLS FOR PGP? http://www.dayton.net/~cwgeib ftp://oak.oakland.edu/SimTel/msdos/security/apgp22b.zip http://alpha.netaccess.on.ca/~spowell/crypto/pwf31.zip ftp://ftp.netcom.com/pub/dc/dcosenza/pgpw40.zip ftp://ftp.firstnet.net/pub/windows/winpgp/pgpw40.zip http://www.eskimo.com/~joelm(Private Idaho) ftp://ftp.eskimo.com/~joelm http://www.xs4all.nl/~paulwag/security.htm http://www.LCS.com/winpgp.html http://netaccess.on.ca/~rbarclay/index.html http://netaccess.on.ca/~rbarclay/pgp.html ftp://ftp.leo.org/pub/comp/os/os2/crypt/gcppgp10.zip ftp://ftp.leo.org/pub/comp/os/os2/crypt/pmpgp.zip http://iquest.com/~aegisrcs WHAT OTHER FILE ENCRYPTION (DOS, MAC) TOOLS ARE THERE? PGP can do conventional encryption only of a file (-c) option, but you might want to investigate some of the other alternatives if you do this a lot. Alternatives include Quicrypt and Atbash2 for DOS, DLOCK for DOS & UNIX, Curve Encrypt (for the Mac), HPACK (many platforms), and a few others. Quicrypt is interesting in that it comes in two flavors: shareware exportable and registered secure. Atbash2 is interesting in that it generates ciphertext that can be read over the telephone or sent by Morse code. DLOCK is a no-frills strong encryption program with complete source code. Curve Encrypt has certain user-friendliness advantages. HPACK is an archiver (like ZIP or ARC), but with strong encryption. A couple of starting points for your search are: U.S. only availability: ftp://ftp.csn.net/mpj/qcrypt11.zip ftp://ftp.csn.net/mpj/README ftp://ftp.miyako.dorm.duke.edu/pub/GETTING_ACCESS International availability: ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/file/ ftp://ftp.dsi.unimi.it/pub/crypt/code/ HOW DO I SECURELY DELETE FILES (DOS)? If you have the Norton Utilities, Norton WipeInfo is pretty good. I use DELETE.EXE in del110.zip, which is really good at deleting existing files, but doesn't wipe "unused" space. US ftp://ftp.csn.net/mpj/public/del120.zip NL ftp://utopia.hacktic.nl/pub/replay/pub/security/del120.zip UK ftp://ftp.demon.co.uk/pub/ibmpc/security/realdeal.zip WHAT DO I DO ABOUT THE PASS PHRASE IN MY WINDOWS SWAP FILE? The nature of Windows is that it can swap any memory to disk at any time, meaning that all kinds of interesting things could end up in your swap file. ftp://ftp.firstnet.net/pub/windows/winpgp/wswipe.zip WHERE DO I GET PGPfone(tm)? PGPfone is in beta test for Macintosh and Windows'9 users. The MIT has shut down their ftp distribution of PGPfone <tm> for Macintosh and Windows'95, so within the U.S/Canada you must obtain PGPfone <tm> using a WorldWideWeb browser. U.S. only availability: http://web.mit.edu/network/pgpfone International availability: DK ftp://ftp.datashopper.dk/pub/users/pethern/pgp/ NL ftp://utopia.hacktic.nl/pub/replay/pub/voice/ NO ftp://menja.ifi.uio.no/pub/pgp/mac/ ftp://menja.ifi.uio.no/pub/pgp/windows/ WHERE DO I GET NAUTILUS? Bill Dorsey, Pat Mullarky, and Paul Rubin have come out with a program called Nautilus that enables you to engage in secure voice conversations between people with multimedia PCs and modems capable of at least 7200 bps (but 14.4 kbps is better). See: U.S. only availability: ftp://ripem.msu.edu/pub/crypt/GETTING_ACCESS ftp://ripem.msu.edu/pub/crypt/other/nautilus-phone-0.9.2-source.tar.gz ftp://ftp.csn.net/mpj/README ftp://miyako.dorm.duke.edu/pub/GETTING_ACCESS International availability: ftp://ftp.ox.ac.uk/pub/crypto/misc ftp://utopia.hacktic.nl/pub/replay/pub/voice/ The official Nautilus homepage is at: http://www.lila.com/nautilus/ HOW DO I ENCRYPT MY DISK ON-THE-FLY? Secure File System (SFS) is a DOS device driver that encrypts an entire partition on the fly using SHA in feedback mode. Secure Drive also encrypts an entire DOS partition, using IDEA, which is patented. Secure Device is a DOS device driver that encrypts a virtual, file-hosted volume with IDEA. Cryptographic File System (CFS) is a Unix device driver that uses DES. CryptDisk is a ShareWare package for Macintosh that uses strong IDEA encryption like PGP. U.S. only availability: ftp://ftp.csn.net/mpj/README ftp://miyako.dorm.duke.edu/mpj/crypto/disk/ International availability: http://www.cs.auckland.ac.nz/~pgut01/sfs.html ftp://ftp.informatik.uni-hamburg.de/pub/virus/crypt/disk/ ftp://ftp.nic.surfnet.nl/surfnet/net-security/encryption/disk/ ftp://ftp.ox.ac.uk/pub/crypto/misc/ ftp://menja.ifi.uio.no/pub/pgp/mac/ ftp://utopia.hacktic.nl/pub/replay/pub/disk/ WHERE IS PGP'S COMPETITION? RIPEM is the second most popular freeware email encryption package. I like PGP better for lots of reasons, but if for some reason you want to check or generate a PEM signature, RIPEM is available at ripem.msu.edu. There is also an exportable RIPEM/SIG. U.S. only availability: ftp://ripem.msu.edu/pub/GETTING_ACCESS International availability: ftp://ftp.dsi.unimi.it/pub/crypt/code/ HOW DO I PUBLISH MY PGP PUBLIC KEY? Send mail to one of these addresses with the single word "help" in the subject line to find out how to use them. These servers sychronize keys with each other. There are other key servers, too. pgp-public-keys(a)keys.pgp.net pgp-public-keys(a)keys.de.pgp.net pgp-public-keys(a)keys.no.pgp.net pgp-public-keys(a)keys.uk.pgp.net pgp-public-keys(a)keys.us.pgp.net WWW interface to the key servers: http://www.pgp.net/pgp/www-key.html http://www-swiss.ai.mit.edu/~bal/pks-toplev.html For US $20/year or so, you can have your key officially certified and published in a "clean" key database that is much less susceptible to denial-of-service attacks than the other key servers. Send mail to info-pgp(a)Four11.com for information, or look at http://www.Four11.com/ Of course, you can always send your key directly to the parties you wish to correspond with by whatever means you wish. CAN I COPY AND REDISTRIBUTE THIS FAQ? Yes. Permission is granted to distribute unmodified copies of this FAQ. Please e-mail comments to Peter Herngaard <pethern(a)datashopper.dk> Look for the latest html version of this FAQ at http://inet.uni-c.dk/~pethern/getpgp.html -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQEVAgUBMaftOm+Iqt/O4EnZAQHk8ggAwL5UcRF4Gv1F6eO7NaQcb45Xa+ST3l3S +6sPHN5vFn/LvUsNHO4o9gDBDJB3Bd8S3nDfRxoSolD1ijNtKGOvJzzXtAf2lXFI 95YXCuF+DyhBrghBfwNzFePjuiDZ/92aeXn90oAEpHc5gaUFoSo+o9Gu8sD0TMo7 p3houk0AdVRRQBTTljWDin2yoJcGLzbmY6ewRcdkYnEqmcv2oW9drSKky04bcg2A KGfOKk/5i1Mw3CPKJu/eHy1gi0P4hd5WbH23Jc3cHQVk2BvmR6lLL+ffl4TGjkxt o61fzYYunxuQzLOi4EeQWWhq31+WJwOO0CuW35nA1XzoQXALdBfF8A== =1NGG -----END PGP SIGNATURE-----

1 0