December 2003 - cypherpunks-legacy

Re: Stop the presses -- Anti-terrorism bill not that bad
by Sean Sutherland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hallam-Baker Wrote -- > Date: Sun, 04 Aug 1996 20:20:20 -0400 > I personally think that tagants is an insuffieicent approach to > the problem. Given the number of gun related homicides in the > US it is not unreasonable to require each individual cartridge > to be stamped with a serial number and for gun dealers to be > required to record each individual purchase. That at least > was my advice to the UK govt after Dunblane. There's four major problems with this. First off, a large number of guns used in homicides are revolvers or derringers (anyone got the numbers?). These guns don't spit out the shells. So, it would be utterly useless to do so. The second problem is the number of shells expelled in the US every day. I doubt there's enough room on the butt end of a shell to print that number (it couldn't be printed on the sides, as this would screw up the fit of the shell, and possibly weaken it). And, it'd be almost impossible getting gun manufacturers to pay for the equiptment that it would take to emprint serial numbers. The third number is that cartridges are recycled. Aside from reloading your own, there's a large number of people that sweep up brass from gun ranges to reload themselves. The idea that someone swept up the brass could get almost anyone off. The final problem is the paperwork. Cops today can barly keep up with the paperwork involved with the Brady Bill. Could you imagine if they had to keep track of AMMO purchases? > If people go arround claiming that ownership of guns is necessary > so that people can commit acts of treason against the US govt > then it is inevitable that there will be pressure for greater The provision to give people the means to commit treason against the government are in the Constitution. That's why the second amendment is there -- to empower the people to protect themselves against the government. Then there's the first amendment, which is there partially so that the people can keep the government in check with speech and the press. > regulation. The NRA has been playing a bad hand stupidly. By > raising the militia argument they have played into the hands > of abolitionists. It would be entirely foolish for the crypto The NRA, I'm sorry to say, has screwed up royally. It's about time that they regroup, or else they fall. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMgUWzVZoKRrkPmSJAQGNPQf/TMJdVIPG+znJdWK3DlxmANXyLpz7qs8Z ESHxWo5unmVuDMSGhLGNT15GabdlMozgmatM11iFXmtpzXSBDMwUQOGS29ScgF6l PW3PBJ0AMscr16GFJu7EcaJStXXAKPCb3mIQmd/JEs51uwpPVgz65fMyRhq3LALF 2fSnNybWGpX60QefZfvtxd6ePx5FyO05v5BJD916N9rh5sRcyspO9Bn5gdvqZaEF MjcYiDuV1qMl1oO7FAF41HDpw1x8hVp1BsUyN812aBl2YbYYxTaQwjE+BaEmExM7 wLgwUBLZ809fqBWeXpGw8CBmy4FmM7KwiI4fxGxdbcgnFBvRavTrdQ== =SY5x -----END PGP SIGNATURE----- Sean Sutherland | mailto:maverick@interconnect.net PGP Key ID - e43e6489 | http://www2.interconnect.net/maverick -----BEGIN GEEK CODE BLOCK----- GCS/C d- s+:+ a--- C+++ V--- P L E- W++ N++ K w o O-(++) M-- V PS+ PE++ Y PGP++ t--- 5+++ X++ R b++ DI+ D+ G e- h! !r y -----END GEEK CODE BLOCK-----

4 3

Public report of the EU crack.
by drose＠AZStarNet.com 17 Dec '03

17 Dec '03

Hallam-Baker wrote: >I consider the political dimension of this affair to >be more significant that the technical. This brings the >US and the French into the same category of anti-crypto >government with a habit of poking its nose into other >people business and getting caught. > > Phill Say what? John Young I can understand; this blather? Att: "Doc" Baker/Mr. Hyde, err, Hallam: any rudimentary text on diction/grammer/syntax might be helpful to you. Sheesh! At least Sternlight seemed to be acquainted with the English language.

2 1

Re: Destroying client/server model, anonymous broadcasting.
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:42 AM 8/5/96 -0400, you wrote: >Getting back to the Dining Crypto Problem, is it possible to complete a >round by passing information around the circle of participants (each >individual communicates and maintains a connection with the person on the >left and right) rather than sending the round results to everyone via a >central server that everyone is connected to? In effect no one would be a >server, or everyone would be a server depending on the way you look at it. >A circular linked list would be maintained and kept in sync by every >client so that error recovery could come into play if someone mysteriously >disconnects. Could it work? How would the protocol differ. There's an obvious simple way to do this which appears to be slightly wrong. Somebody (assume it's Alice) announces a round "This is round N, size S bytes, value vvvv....", everybody who receives it does their calculations, XORs them in with the data, and passes it on. Once it gets all the way around (and Alice xors in her real number xor the nonce she started with), it goes around again so everybody can see the message. The catch is that two players can collude to monitor the player between them. Since Eve knows what data she passed (Dr.) Fred, and their random numbers, and Gorby knows what Fred passed him, and their random numbers, they can tell whether Fred added any data of his own. With a server-based system, on the other hand, collusion that Eve and Gorby also find out Fred's output, either by eavesdropping or colluding with the server. (Hmmm - I suppose this also happens with Chaum's NSA dinner? The example essentially used broadcast to exchange all the users' contributions.) Also, to set up a DCnet, you almost need a server of some sort to coordinate who talks to whom. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

1 0

Re: Stop the presses -- Anti-terrorism bill not that bad
by hallam＠Etna.ai.mit.edu 17 Dec '03

17 Dec '03

> First off, a large number of >guns used in homicides are revolvers or derringers (anyone got the >numbers?). These guns don't spit out the shells. So, it would be >utterly useless to do so. The shells are removed sometime or other. Nothing is a 100% solution but anything that gives the criminal an extra thing to worry about improves the chances that a mistake is made. Many people go to jail because of fingerprints on shell cases. >The second problem is the number of shells >expelled in the US every day. I doubt there's enough room on the >butt end of a shell to print that number (it couldn't be printed on >the sides, as this would screw up the fit of the shell, and possibly >weaken it). I doubt that more than 32 bits of info will be required. Thats not that difficult to imprint. >And, it'd be almost impossible getting gun manufacturers to >pay for the equiptment that it would take to emprint serial numbers. Not a problem, that type of machinery is a standard type of industrial machine. Might be expensive to adapt the lines but I doubt it. >The third number is that cartridges >are recycled. Aside from reloading your own, there's a large number >of people that sweep up brass from gun ranges to reload themselves. >The idea that someone swept up the brass could get almost anyone off. Not an issue. A person may have an excuse that explains why the blood is in his car or his fingerprints are on the knife but a conviction depends on more than one piece of evidence. If there is information that gives the police a lead it is usefull. At present the police are investigating the purchase of white powder - checking each purchaser out who fits the Olympic bomber profile. That is a lot of work for a much weaker lead. If a person says that they fired at a range then you have narrowed the search scope to the guys at the range. >The final problem is the paperwork. Cops today can barly keep up >with the paperwork involved with the Brady Bill. Could you imagine >if they had to keep track of AMMO purchases? Not a problem, thats an opportunity. I build very large, very high reliability computer systems. I can build machines that deal with several million transactions a day for less than a million and run them for less than a quarter million a year. That is cheap when one considers the cost of investigation saved. >The provision to give people the means to commit treason against the >government are in the Constitution. That's why the second amendment >is there -- to empower the people to protect themselves against the >government. Making that argument defeats your case. Irespective of the framers of the constitution nobody in Congress or the Administration believes that you have a right to take up arms against the government. In fact they are scared of the militia movement and the NRA. Every time you make that argument you make it harder for people to accept your case. Its like hearing a Marxist spout stuff from Capital to support a civil liberties. Regardless of wether the content makes sense the form of the argument is a complete turn off. I used to side with HCI before I started talking to the talk.politics.guns people. That convinced me that they were a threat to the security of the country - even before McVeigh sent me a mail defending his 2nd ammendment rights that looked very much like yours. Regardless of whether he is guilty or not I still regard him and those that hold his views to be as serious a threat to the USA as the Red Army Faction were in Germany, or the Red Brigades in Italy or the IRA in the UK. If people carelessly justify terrorism they are fueling that fire. Up until now the US has not had a serious terrorist problem. If terrorism becomes widespread then don't imagine the constitution will be a protection. Thomas and Reinquist are not going to stop measures to "protect the nation" even if like the WWII internement of Japaneese nationals they are in gross violation of the constitution. If you think the wiretap bill is bad think on this, all guns of all types banned except where held by special license. Checkpoints at major road intersections. Stop and search patrols in city centers and the army on the street. Its not at all far fetched, the UKgovt took less than a year to introduce such measures in Northern Ireland. Constitution or not, don't expect that the US Congress won't make a similar response. Phill

4 4

Re: Corporate e-mail policy
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:34 PM 8/5/96, James C. Sewell wrote: > Personally I think I would approach it as the privacy we have with the >eontents of our car's trunk. If an officer has probable cause to search >the trunk then he can, otherwise he can't. It's not a perfect system but >it does work better than other alternatives I can think of. This comparison breaks down completely. The police are not involved, so the language of "probable cause" is inappropriate. We may differ in our opinions on whether employers can search mail and car trunks, but the language of "probable cause" suggests a legal/constitutional issue that is probably not there. Imagine Alice operates a courier service and owns and operates several delievery vehicles . Bob, her employee, drives one of her cars. Is he to imagine that the trunk may not be opened by Alice unless she has "probable cause"? Nonsense. It it _her_ car, bought and paid for. To imagine otherwise is to wander into a fever swamp in which owners of property may not even use their own propery. (If anyone suggests that landlords cannot barge into tenant's apartments, this is a different situation. For one thing, there are usually terms and conditions spelled out in a contract about when and under what circumstances a landlord may enter the premises.) Is corporate e-mail more like the courier service example or more like the landlord-tenant example? I suggest the former, as the e-mail is used in the everyday furtherance of business, and illegality/abuse may harm the owner, as with drugs in the trunk of a courier car. (The owner of a property who leases it out is generally not held liable for the misdeeds and crimes of his tenants, except in some special circumstances. Hotel owners are not guilty of the crimes of the residents, which are of course common.) The original question asker, who asked how to help write his corporate e-mail policy, is free to lobby for a different interpretation; this is, after all, a matter of agreed-upon policy, not a matter for the state to stick its nose into. --Tim May P.S. > Just remember, as was said, once you make a policy it becomes precedence >and will stick with you forever... longer if it's a bad one. > Alice the Courier Service is of course perfectly free to announce new policies, so your point is incorrect. --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PGP public key servers are useful! [noise?]
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Aug 05 16:43:42 1996 Over the last couple of weeks, I've noticed a lot of subscribers who PGP clearsign their messages, but who haven't uploaded their keys to any of the public keyservers. Those keys are most useful when they're available to people who might want to use them, so I'm asking those of you who haven't sent them to a keyserver to do so. (The quick version: paste your key in cleartext into a letter, sent to pgp-public-keys(a)pgp.mit.edu with the subject: ADD. If you don't have it in cleartext, do pgp -kxa and follow the prompts.) TIA, dave - ---- David E. Smith POB 324 Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail of 'send pgp-key' subject for my PGP public key "Heard a lot of talk about this Jesus, a man of love, a man of strength; but what a man was two thousand years ago means nothing at all to me today ... " -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automagically signed with Pronto Secure for Windows. iQEVAwUBMgZrGzVTwUKWHSsJAQGRtwf/TPjleUXsqf2GcEsutZNnyYD82bYM2ZT/ NQm0BeUTcNdU+jA/2z5aiy+FRozcL6EeIDPULtCGeMvDYu95vBOjnimIxMjng9J6 mIpFIQzXUN4ZDdE7m1khbn8Vdk/V0kehQL318LzB484SQILWNYvTNrj/cDq6CdKW RMyyOH3+5VH1xRZJjFYvTsKnCszmtZIIvrjOt9+nX/j02bWnZRV7IGbOFjSrCL6p r1TZG/TnU60YGz/TaUhp5OCj0bFlkFQlg+NmcwR9j4rlIza9ujBSuGIcflMRWTG3 ighrCC9cpL1v/qJkHXKy67xdvIZWlq7UiyqTRUEBg7rwjSBca0YgZQ== =rDtm -----END PGP SIGNATURE-----

4 3

Re: fbi, crypto, and defcon
by jim bell 17 Dec '03

17 Dec '03

At 09:40 AM 8/5/96 -0700, Martin Minow wrote: >Arun Mehta <amehta(a)giasdl01.vsnl.net.in> writes: >>True, though even better would be simply to charge you a flat >>rate. If billing is that expensive, why bother? >Tragedy of the Commons. > >Flat rate works only if no single user can use more than >a tiny fraction of the total bandwidth. Using a "Tragedy of the Commons" analysis on telecommunications systems isn't very appropriate. Modern telephone systems have a fairly well-defined instantaneous capacity, do not wear out based on usage, unused capacity doesn't 'store up' for later use, nor do sporadic attempts at excessive use have anything more than a very transitory effect. (fast busy signals.) And in addition, a person doesn't profit in an unlimited fashion by attempting to over-use the telephone: Nobody I know would spend 24 hours per day on the phone if it were free, for example. So there's little motivation to over-use the resource. The Internet is even more "friendly" along these lines than telephone systems: The Internet doesn't "fail hard," denying access when usage is high, it merely slows all access to match the need. There are enough differences that I think Internet deserves an entirely new analysis. Don't worry, it will be also be interesting, from a game-theory perspective, but it will be very distinct from a classic "tragedy of the commons" situation. The current question is how to motivate individuals and companies to invest in improvements to the Internet that will benefit everyone. However, I don't think that will be the limiting factor that it may currently appear to be. Due to the nature of the Internet, there is nothing to prevent a company (such as AOL, Compuserve, or other) from building a shadow version of the Internet, through which all of its customer's traffic will pass until it emerges local to its destination. Customers who appreciate this kind of prompter service will be motivated to pay slightly more and will buy Internet access through that company. So the "commons" won't be quite so "common," and product differentiation will allow choice. Jim Bell jimbell(a)pacifier.com

1 0

Credit Cards over the internet
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

Just read a forwarded message from a merchant who indicated that: <quote> Mastercard in no way authorises the transmission of credit card details via the internet/email due to the possibility of fraud. Supposedly if Mastercard finds that any merchant receives such details via internet/email, they will cancel the merchants agreement/rights immediately. While a lot of work is being done regarding the transmission of secure data it has not been perfected yet. Merchants must have special permission to accept details by phone or fax. </quote> We have no first hand knowledge of this change in the merchant account rules. As a merchant who accepts credit cards via the internet/email, I know that our credit card fraud rate is around 1 in 1403 transactions. In all cases, the card we were given was stolen by conventional means and the charge was authorized before that knowledge filtered through the credit card system. Seems to me that this is a small percentage. I have heard of no one who has had their card stolen while passing it across the internet. Local restaurants and shops and Unix file servers, yes, but via packet sniffing, no. If the above internet/email restriction is true and if we assume that the people at the credit card companies do know what they are doing, then it sounds like someone might be attempting to kill the SSL method of accepting credit card information in favor of some other standard such as SET. I'd be willing to bet that SET will be proclaimed as the perfected method that is suitable for use where other methods such as SSL or PGP would not be allowed. I'd also be willing to bet that even with SET, the fraud rate that I experience will remain the same. Does anyone have real facts on this? <name withheld> Vinnie Moscaritolo "Law - Samoan Style" http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

3 2

Re: Public report of the EU crack.
by jim bell 17 Dec '03

17 Dec '03

At 02:20 PM 8/5/96 -0700, David M. Rose wrote: >Hallam-Baker wrote: > >>I consider the political dimension of this affair to >>be more significant that the technical. This brings the >>US and the French into the same category of anti-crypto >>government with a habit of poking its nose into other >>people business and getting caught. >> >> Phill > >Say what? John Young I can understand; this blather? > >Att: "Doc" Baker/Mr. Hyde, err, Hallam: any rudimentary text on >diction/grammer/syntax might be helpful to you. Have a little toleration. I've heard he's a FOREIGNER! Jim Bell jimbell(a)pacifier.com

1 0

Off topic: Re: viruss'
by Erle Greer 17 Dec '03

17 Dec '03

At 01:38 AM 8/5/96 -0700, you wrote: >Does anyone know where thre is good virus page???? >I know that there is one out there, but dont have the add. >Zero Cool Let your mouse do the walking. http://www.yahoo.com Type "virus", without the quotes. viola! Good luck! Vagab0nd<br> <a href="http://ww2.sd.cybernex.net/~vagab0nd/index.html">Visit web page for public key.</a>

1 0