December 2003 - cypherpunks-legacy

Re: fbi, crypto, and defcon
by Stephen Cobb 17 Dec '03

17 Dec '03

At 04:29 AM 7/30/96 -0700, Cerridwyn Llewyellyn <ceridwyn(a)wolfenet.com> wrote: > >At this year's DefCon (last weekend), there were two speakers from the >recently created FBI San Francisco Computer Crime division. they were there >as spokesmen for the FBI, but people could talk to them later and ask any >questions they liked, and "the answers may surprise you". Evidence that >maybe some goons really do have a clue, but are still too afraid to do >anything about it... //cerridwyn// I thought it was pretty cool that they even showed up, and the respect they showed for people with good technical skills was, IMHO, impressive. They were candid about the role they play and stood by the code of behaviour they are sworn to uphold. We simply don't have enough information to judge them. These guys may be campaigning for political change in their spare time. They are enforcing laws passed by a democratically elected government, which is not perfect, but a long way from tyranny. They made the point, several times, that if we don't like the laws we are free to try and get them changed, which some of us are trying to do. Okay, so their boss is part of the law making process, subject to the checks and balances that exist between the three branches of US government. They are in a position to supply their boss with data and I am personally impressed with their grasp of some of that data (it sounds to me like they are telling their boss that hackers like the ones at Defcon are not the problem). All of us who have some understanding of these issues need to do our best to educate the public and the politicians, even if we have to start from the "See Jane hack" level (pun intended). Otherwise dumb laws will be passed and then we will have to engage in mass civil disobedience (which I have personally done in the past). Stopping bad laws from becoming law is a lot easier than overturning them later. Respectfully...Stephen (hacker jeopardy scorekeeper)

1 0

Re: Taxes in the digicash world
by Bill Stewart 17 Dec '03

17 Dec '03

SUMMARY: A: Quotation. B,C,D: usual rehash E: Interesting conclusions A) At 06:17 AM 7/30/96 -0500, ichudov(a)algebra.com (Igor Chudov) wrote: >The question is, how can the government TECHNICALLY collect taxes? .... >Let's say, maybe this tax would work: every time someone verifies that >a piece of digital cash is valid, s/he has to pay the government a little >percentage of the amount. Since digital banks are easier to control than >other participants of the market, this kind of tax legislation is easier to enforce. .. >Another alternative that I see is property taxes and poll taxes, or >taxes on some commodities such as oil. But incomes seem to be hard to track. B) Basically, you can either tax income, consumption, transactions, ownership, and the right to do business. Ownership of land and easily traced tangibles, like houses and cars, still works, but isn't a big enough source of revenue for current government appetites, and taxing consumption (i.e. purchase) of these items is also revenue-limited. US-based corporations are regulated - by taxing profits, they're given an incentive to report all their consumption, generating a recording stream that fingers employees, contractors, and other corporations, making their incomes more visible. Similarly, business licensing raises the visibility of people who might otherwise engage in profitable services (typically in the name of protecting the consumer through quality control), and often creates transaction records such as building permits. C) Taxing bank _transactions_ isn't realistic - it encourages people to use offshore banks, and it's a major change in the way US taxes work. Even with payee-and-payer-anonymous digicash, when the digicash gets stored in an account for translation to treecash, the bank can tell which account, though they can't tell when and from whom you got the digicash, and if they pay interest they must report it, so that tells the IRS your average balance, letting them play the traditional game of "you received $X in your bank account, prove that it wasn't taxable income" (again, unless you're banking offshore.) D) As long as you're buying physical stuff, it's generally either small-volume (e.g. handicrafts and artwork) or made by corporations that are relatively traceable, because they're forced to report their incomes, or else it's material that's purely black-market anyway, like dope. But today's economy is moving away from manufacturing and mostly into services; the low-paid stuff like lawnmowing and babysitting helps support poor people, but isn't a big revenue impact. The interesting problems occur when both your source of income and most of your consumption are communication-based intangibles - consulting, electronic paperwork, writing software, writing entertainment, selling electronically-delivered wares, laundering money, laundering software, laundering entertainment, buying software, buying entertainment, buying consulting for your business. Since the services and payment can both be delivered invisibly, that _can_ let lots of people get under the radar. E) I think the battleground for taxation and control over the digital economy will be fought in two or three areas. One is wiretapping, of course, to protect us from narco-porno-taxevaso-terrorists; attempting to control the key management structure will be a big part of this, since it lets you trace the players as well as the money. (Even if they don't get your private keys, and can only force registering of, say, snail-address along with public keys, that gives them much of the game.) A related push is censorship, probably with mandatory authorship identification ostensibly to enforce content labelling. But the other big push will be for licensing of computer practitioners and software - there's been some attempt at this already, partly from the serious safety folks and partly from the state-level business-licensing meddlers, but I think we'll see far more of it as the government realizes that it's a big hook for retaining tax visibility. Because the software business is extremely portable and geography-independent, much of the tracking will be from the demand side. Software for some reasonably large fraction of use may need to be certified by either a licensed practitioner or a corporation that can be liable. After all, we _need_ to protect the integrity of the National Information Infrastructure to preserve American jobs and protect our kids! # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # Dispel Authority!

2 1

Re: VISA Travel Money
by jim bell 17 Dec '03

17 Dec '03

At 10:55 AM 7/30/96 -0700, Mike Duvos wrote: >Happened to browse the VISA Web site last evening to read about >the new microprocessor-based VISA Cash Cards that are being >accepted in lieu of small change at the Olympics in Atlanta. > >While there, I noticed a new product that VISA is about to >introduce. Called "VISA Travel Money", it is a pre-paid card >with a user-selected PIN which one can simply purchase at a >participating financial institution, just like Travelers Checks. >One can then use it at any of the 250,000 ATMs in 89 countries >until the amount one paid for it has been extracted, after which, >one presumedly tosses it. > >Since the card is pre-paid, and does not involve the extension of >credit, I would think that a "nym" would have no difficulty in >purchasing one. Seems like a convenient way to keep moderate >amounts of cash in a form which cannot be easily stolen, nor >perused by the Feds. > >I wonder if an SSN is required at the time of purchase? Even if not, chances are good that "all" of the transactions can be linked together, even if they can't be directly linked to an identifiable person. Doesn't sound too promising. Jim Bell jimbell(a)pacifier.com

4 4

Nat'l Law Journal and The Independent on CWD and net-filters
by declan＠well.com 17 Dec '03

17 Dec '03

Date: Tue, 30 Jul 1996 16:04:48 -0500 To: fight-censorship-announce(a)vorlon.mit.edu From: declan(a)well.com (Declan McCullagh) Subject: FC: Nat'l Law Journal and The Independent on CWD and net-filters Sender: owner-fight-censorship-announce(a)vorlon.mit.edu Attached are portions of two articles from the National Law Journal and London's The Independent following up on the CyberWire Dispatch that Brock and I put out earlier this month on the rather unusual behavior of net-filtering software. The original CWD is at: http://www.eff.org/pub/Publications/Declan_McCullagh/ http://cyberwerks.com:70/cyberwire/cwd/ (eventually) -Declan =========================================================================== The National Law Journal Monday, August 5, 1996 Page A13 By Ann Davis ...Civil libertarians are demanding to know: since when were the National Organizaton for Women or the Endangered Species Coalition in the same class as devil worshippers? How can photos posted by animal rights groups be categorized as "gross depictions"? Caught in a dragnet of blocking software are web sites on everything from the safe use of fireworks to safe sex, according to a report by the Internet-based news service CyberWire Dispatch. To blocked groups' disappointment, however, Internet legal experts say any lawsuit against private computer censors may be a losing proposition... [Mike Godwin is quoted.] ...A cyber-Deep Throat recently leaked the lists to two Internet investigative reporters, Brock N. Meeks and Declan B. McCullagh. Blacklisted sites include a Silicon Valley council of the National Rifle Association and Cyber High School, whose web address is similar to that of a gay video site... [Snapshot of CyberHigh's web page included] As a lawyer for CompuServe, Inc., Mr. Cunard meets potential legal challenges with skepticism. The free speech angle? Implausible against a private entity, he said. Discrimination claims? Difficult, unless you can prove the Internet is a place of public accomodation. Tortious interferrence? not likely, because most web site operators don't require subscriptions and therefore don't have a duty to those who access their sites. =========================================================================== The Independent (London) Monday, July 22, 1996 By Charles Arthur REAL ALE IS TOO STRONG FOR THE AMERICAN MORALISTS Programs to protect children from Net porn are keeping them out of a vast range of sites, says Charles Arthur [...] Since last July, programs such as Cyber Patrol, NetNanny and Cybersitter have sold thousands of copies. Some have distribution agreements with organisations such as BT and CompuServe. The makers boast that their products "includes a bad site list of thousands of Wed sites that are not suitable for children" and "allow parents to censor what their children access on the Internet." So far, so good - except that many of those "banned" sites include many British sources holding very useful or entirely innocent information. And the morality underlying many of the bannings is very American, and quite unlike that which a British parent might be expected to apply. Among the British sites on the World Wide Web which your child would be unable to access when using the programs are the Campaign for Real Ale (Camra), the Prison Lexicon (which provides information about penal reform), the computing department of Queen Mary and Westfield College, Imperial College, the University of Stirling, the Internet connection companies Demon and Zetnet, and Telephone Information Services - which offers weather and share reports but not sex lines. Between them, the programs prevent access to tens of thousands of sites on the Internet. But they effectively apply an American system of morals - on religion, weapons, drugs, alcohol and sex - to the data which British children might be expected to know about, or could obtain from newspapers. None of the operators of any of the sites mentioned above was aware that they were "blocked", and all were mystified by it. "Which self-selected Mary Whitehouse put us on their list?" asked Iain Lowe, research manager of Camra. In Camra's case, the answer is a team of researchers at Microsystems Software, based in Farmingham, Massachusetts, which has been selling Cyber Patrol since July 1995, and now claims 80 per cent of a fast-growing market. "Camra's site is blocked under our code for beer, alcohol, wine and tobacco," said Dick Gorgens, the company's chief executive. "It was added on June 10 when it was advertising a beer festival." Mr Lowe responded, "We don't promote underage drinking. But pubs in this country are allowed to apply for childrens' certificates: all the family can go. And we have had inquiries to our site from GCSE students doing projects on the economics of the brewing industry." Mr Gorgens denied that the program was imposing American morals onto British users. However, the panel which reviews the banning of sites includes no Britons, although it does include representatives from the National Rifle Association and the right-wing anti-pornography Morality in Media group. [...] "A close look at the actual range of sites blocked by these programs shows they go far beyond just restricting 'pornography'," said Brock Meeks, an Internet journalist and consultant who, with fellow journalist Declan McCullough, obtained a decoded list of the sites banned by the programs earlier this month, July, and revealed their indiscriminate breadth in an Internet mailing list, Cyberwire Dispatch. Steve Robinson-Grindey, who runs the Prison Lexicon site, said "It is effectively an electronic encyclopaedia of everything concerning prisons and penal affairs in England and Wales. It is extensively used by schools and universities for information. Even the People's Republic of China allow access to the site." He thought it might be banned because "obviously they rely on search words for filtering - in which case they would discover the words sex, AIDS, homosexual, and so on. But they failed to realise these words were being used in serious material." [...] ------------------------------------------------------------------------- fight-censorship is archived at http://fight-censorship.dementia.org/top/

1 0

Re: Let's Say "No!" to Single, World Versions of Software
by jim bell 17 Dec '03

17 Dec '03

At 03:02 AM 7/31/96 -0700, Timothy C. May wrote: >Having a U.S. version, without any limits on crypto and without any >software key escrow (GAK), and then having a "for export" version, with >keylength limits and/or mandatory registration of keys with the U.S. >National Security Agency.... > >Well, what this would do is to basically drive sales of the "NSA" version >to near zero. Between customer distaste for an NSA version, I can imagine >many foreign governments not being too pleased to see this product being >used by its citizens. For over a decade, the ham radio community has been familiar with the phenomenon of handheld, microprocessor-drive "rice radios" (because they're usually Japan-built) which contain an internal limitation keeping them from receiving or transmitting out of their band. These radios are built for the world market, and are "programmed" by installing (or not installing) various diodes on a PCB. Removing, adding, or shifting diodes is an easy trick, and restores full functionality to the device. What's to prevent a software writer such as Microsoft (or anyone else, for that matter) from writing two versions of a program (domestic and export), perhaps containing a difference as minor as a two-byte EQUate representing the maximum number of bits that are "allowed" in the key. Everything else is identical. Making a change would be as simple as bringing up a hex editor and changing those bytes. (okay, admittedly that won't seem simple for most people, but a simple single-purpose editor program would probably pop up for the purpose.) Jim Bell jimbell(a)pacifier.com

1 0

Re: fbi, crypto, and defcon
by Chris Adams 17 Dec '03

17 Dec '03

On 30 Jul 96 08:42:26 -0800, ceridwyn(a)wolfenet.com wrote: >making laws). The question was rephrased: "How do you personally feel >about exporting strong crypto", and again they refused to answer on the >grounds that they were there as spokesmen for the FBI, but people could >talk to them later and ask any questions they liked, and "the answers may >surprise you". Evidence that maybe some goons really do have a clue, but ^^^^^ >are still too afraid to do anything about it... //cerridwyn// This probably isn't the most accurate phrase. Generally, goons wouldn't even have said *that* much... I'm really starting to think this is a confirmation of a corollary of the Dilbert Priciple: incompetence rises to the top. // Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! // Automatically receive my resume or PGPKEY by sending email with a subject // of 'send PGPKEY' or 'send resume'. Capitalization counts so be careful!

1 0

Re: Let's Say "No!" to Single, World Versions of Software
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 3:02 7/31/96, Timothy C. May wrote: >This point has been raised by us many times. And, to be fair, this point is >not lost on the NSA/Freeh/Denning/Gorelick crowd, I am sure. That is, they >would not countenance the importation into the U.S. of "Iraq-GAKked" and >"China-GAKked" programs, for example. > >So, what's the deal? The resolution of this quandary almost certainly lies >in an "international agreement," along the lines of the various key escrow >meetings which have been held (Karlsruhe in '93, Washington in '94, etc.). >A "New World Order" solution, with complicated reciprocal agreements about >whom the trusted key authorities might be, how nations could gain access, >etc. (These relationships are too complicated for my brain to handle...how, >for example, would one come to an agreement with Libya? What about Cuba, >given that many of our nominal allies trade freely with Cuba and chafe when >we try to get them to join our boycotts?) I don't see a global agreement on GAK happening anytime soon. But that doesn't mean that a less ambitious agreement can't be reached. Perhaps it will come out of OECD, perhaps it will be limited to G-7. We will see an agreement on GAK amongst the major players, with the exception of Japan. After all, the players are faced with the same dilemma: how to best control the behavior of their citizens. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

G7 Anti-Terrorism Reports [BRIEF]
by karl_marx＠juno.com 17 Dec '03

17 Dec '03

Cypherpunks: At 1735 CDT on Tuesday, July 30, 1996, CNN Atlanta during World News Tonight reported (in a _very_ brief flash) several "resolutions" adopted by the Group of Seven (G7) trade meeting in Paris. At the bottom of the list of resolutions was to "prevent terrorist from using the Internet" (quote from CNN anchorwoman). No further explanation was given in regards to that statement, but methinks that in wake of recent terroristic activities in this country, Pro-CODE in Congress, and Netscape Navigator 3.0b3 in the hot little hands of Americans everywhere, there could be a complete retreat from the "progressive" attitude of legislators in this country towards strong crypto. John Young has already requested further information about the G7 meetings, and it would probably behoove us all to know precisely what it was that was said before such a resolution was agreed upon. Or, better yet, whose idea it was to attempt to "prevent terrorists from using the Internet." Apologies to all if this is redundant information, and apologies to the purists for intruding with this newsflash. ObCrypto: Anyone have any more information on Royal Dutch Shell apparently the first customer of TIS' firewall package with key escrow ? Has such a purchase been confirmed, and if so, does it still entail an agreement with the British government as an escrow agent ? -J. Malcolm +-=-+-=-+-=-+-=-+-=-+-= j malcolm summers / karl_marx(a)juno.com / summersj(a)southwestern.edu ignorance is not bliss +-=-+-=-+-=-+-=-+-=-+-=

1 0

Re: fbi, crypto, and defcon
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Short review of the Fedz show at DefCon. Most of the San Francisco Computer Crime squad was in attendance. SA Black and Butler's presentation was classic good cop/bad cop (respectively). Nice quote by them in the Vegas paper about how all hackers aren't bad. They were even doing recruiting, and had the little hacker puppies eatting out their hands for a mug, t-shirt, or minature badge. It wasn't determined whose surveillance goodies were being installed in the drop ceiling of the conference room at 4:30 AM. The "hotel maintenance" guy certainly hauled ass when one of the official DefCon Goons showed up (classic textbook time for raids, black bag jobs, etc). Tsk, tsk. And me without any TSCM gear. Points to the Fedz for great psy-ops (especially the quote about how the "new" FBI is more sensitive). Points off to quite a few hackers who don't have a historical context of government abuse and are pretty damn easy to manipulate. All in all, probably more entertaining than most shows on the Strip. Obligatory comment on hackers compared to cypherpunks. Zero to no political savvy. Extremely poor organizational and communication skills. Nearly clueless on social issues. These would be the hackers. Yeah, yeah. I know there are exceptions. But all in all, I'd rather hang with C-punks.

1 0

ANNOUNCEMENT: nym.alias.net enters beta testing
by lcs Remailer Administrator 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm pleased to announce that the nym.alias.net pseudonym server has now entered the beta-testing phase, and seems quite stable. Nym.alias.net offers several interesting features: * Public-Key encryption of all received mail. Once mail has gone through nym.alias.net, no one can read it except you--even if you have been sending your mail to a newsgroup and your reply-block and remailers become compromised. * Support for multiple, probabilistically-weighted, reply blocks. These can be used for redundancy or to foil traffic analysis with decoys. * Replay detection. This foils replay attacks, but can also be used for higher reliability if you send redundant copies of a message through different remailer chains. * An option to receive only fixed-length messages (by splitting up large messages and padding small ones with garbage). * An option to sign mail you send with the remailer's public key, so as to give some assurance of authenticity without having to publish your own PGP public key. * Support for finger [pending DNS approval]. You can choose to make your nym's PGP public key available to all who finger its E-mail address. Right now you can test this by fingering at 18.26.0.252. In addition, experimental nym.alias.net support for Premail is now available (in the form of a patch to premail 0.44). With this patch, premail will store your nym's PGP key on encrypted keyrings. This allows you to publish a PGP key for your pseudonym without the danger of your identity being revealed to someone with access to your main PGP keyrings (or a backup copy of them). To obtain more information about nym.alias.net, finger <nymhelp(a)anon.lcs.mit.edu> or send mail to <help(a)nym.alias.net>. To get information about using premail with nym.alias.net, finger <premail-info(a)anon.lcs.mit.edu> or send mail to <premail-info(a)nym.alias.net>. These documents are also available on the new nym.alias.net web page: http://www.cs.berkeley.edu/~raph/n.a.n.html Please report all bugs to <admin(a)nym.alias.net>. I'll also be glad to consider feature requests, particularly from anyone interested in developing any more client software. Enjoy! mix-admin(a)anon.lcs.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMf6dcUTBtHVi58fRAQE4NgP/SoKSqHxobEHuyWl6lXVAHgk9yqNS/WAD jUfKYGodThr93kJZkmreyIHrWgbromJJlXo6MPq9KpZzIh85uHRzBPRSh293hfUo ta8/sdZsW1+uoEkAs8JUWlwAEGo+bfmgRnFswf80pAPClpbGo52DAKyLKfdCaFps kQ+4hoouUvo= =qEWa -----END PGP SIGNATURE-----

1 0