December 2003 - cypherpunks-legacy

Informal Renegotiation of the Law
by Duncan Frissell 17 Dec '03

17 Dec '03

Many people on this list and in the larger world focus on laws and regulations and sometimes act as if that is the only way that the relative rights and duties of governments and civilians are established. In fact, there is a lot of informal negotiation going on all the time. This is significant because an unenforced law isn't a law at all. For example, you will not read anywhere that compulsory education laws have been repealed -- but they have. When the home schooling movement started in the late 1970s, there were occasional harassment and prosecution of parents. The home schoolers won some and lost some. As time went on, the authorities came to accept home schoolers so that at this point, legal problems are rare. Compulsory education has been effectively repealed by the actions of refusenicks in both the subject population and the enforcement population. This same process will occur more frequently in the future as libertarian memes spread, government enforcement resources shrink, and people's vastly different attitudes as to what should be legal and illegal make a monopoly legal regime impossible to keep in place. Note that unlicensed immigration is against the law. Note that some websites post material that others would like banned. Maybe you can deport a few or ban a few. But how many? If you have three million illegal aliens or 3 million individual ISPs (people with high speed connections running their own sites) you can't deport them or shut them down because it simply takes too much time and too many enforcement resources. The authorities give up. You get de facto open immigration and a de facto unregulated Net. Coercion is expensive and slow. Free exchange is cheap and fast. That's why free exchange wins in the long run. It's not a victory without losses. Some people are busted. Some sites are shut down. You don't go into battle expecting zero casualties. But what counts in the end is who wins. And we've got them outnumbered by far. DCF "So you think you can handle 3 million sites? Wait a few years and you can try to handle 300 million."

2 1

CryptLib CAPI for VB
by Joel McNamara 17 Dec '03

17 Dec '03

Before I do it myself, thought I'd check if anyone has updated Peter Gutmann's CRYPT.BAS file for CryptLib (if not, I'll forward it to Peter when I get finished). The current version is fairly out of date, and I'm looking for a library to use with Visual Basic to implement some secure hashing and 3DES. Thanks in advance... Joel

1 0

ISP-TV Interview with Solveig Bernstein
by ISP-TV Main Contact 17 Dec '03

17 Dec '03

*** ISP-TV Program Announcement: Interview with Solveig Bernstein *** Monday, September 16 9:00 PM ET Solveig Bernstein Assistant Director of Telecommunications & Technology Studies Cato Institute ISP-TV will present an interview with Solveig Bernstein from the Cato Institute. Ms. Bernstein will be discussing legal issues concerning the CDA, the upcoming Supreme Court case, and other telecom legal issues. This video interview can be viewed on the ISP-TV main CU-SeeMe reflector at IP 205.197.247.33, or other ISP-TV affiliate reflectors listed at http://www.digex.net/isptv/members.html See URL http://www.digex.net/isptv for more information about the ISP-TV Network

1 0

Re: What is best policy paper on crypto?
by Hallam-Baker 17 Dec '03

17 Dec '03

Adam Shostack wrote: > > Declan McCullagh wrote: > | I happen to know that an influential Congresspern will be meeting with > | some Cato folks tomorrow morning, so I'm assuming this isn't an idle > | request. > The NAS report, despite a few silly points, does push for > liberalization of the export regime, standardization, a switch to > an 'assume export' stance, states that the debate can be carried out > in public, and that classified information is not needed, and suggests > that crypto can help reduce many threats to Americans. > > It does not suggest abolishing the ITARs, and suggests > consideration of a law criminalizing the criminal use of crypto. I agree that the NAS report is the one to use. Its from an authoratative source and the conclusions are pretty reasonable. Its perhaps not as far as some would like to go but if we got there it would be livable. Given where we are it would make a good first step. Some good lines from the talk included: Re Dennings "If you know what I know argument", basically Lin said that he did know and it made no difference at all to his point of view. Also 13 of the 16 members of the committee got "the briefing" - which is all Dorothy bless her socks got, and the report was unanimous. Re who is behind the anti crypto policy, its Freeh at the FBI and not the NSA. The NSA know crypto and don't really care all that much. Gore credited as guy who is holding Freeh back. Seemed a reasonable enough guy, but a number in the audience were upset that they didn't have someone like Dorothy who we can throw tomatoes at. Phill

1 0

Gaining trust in OCO crypto code
by frantz＠netcom.com 17 Dec '03

17 Dec '03

These thoughts came up at the Mac Crypto conference, but are somewhat more general than the Macintosh, so I am ccing them to cypherpunks. OCO, or Object Code Only, a bad idea whose time has not yet past (although it was part of the reason for the decline of IBM's mainframe operating systems), is the business practice of keeping the source code for a system secret. Some companies are applying the idea to cryptographic software, so the we should think about how we can establish trust in such software. There are three techniques which may work for all OCO software. (1) Trust the designer/implementor. Ron Rivest's RC2 and RC4 algorithms were originally released as OCO algorithms. Rivest's reputation as a cryptographer established trust in them. (2) Trust a third party auditing agency. The US military trusts vendor implementations of cryptographic software because they have been audited by the NSA. (3) Reverse engineer the implementation. While laborious, this process is straight forward. When Netscape started using RC4 in their SSL implementation, a review of its security became important enough that a certain anonymous person(s) reverse engineered the implementation and posted it to the Internet. As a result, the algorithm has undergone peer review. If we can't use the above techniques, we have to think very carefully about what parts of a cryptographic system we can trust by only examining their inputs and outputs. Here is a list of things we can NOT trust in this manner: (1) Random number generation. An error (as occurred in a Netscape implementation), or a deliberate weakness can not be easily detected by examining only the output of a cryptographic random number generator. (2) Key generation. There are published ways to encode an RSA secret key in the corresponding RSA public key. A key generation algorithm which only uses 32 bits of the random number would be hard to detect, but easy to break by one who knew its secret. You have to be able to examine in detail how keys are generated. Now there are some things we might be able to trust based only on an examination of the inputs and outputs. (1) Implementation of a cryptographic algorithm. If we can feed it enough test cases, and compare the output with a public, well vetted implementation, we can come to believe that it is correct. (2) Certain cryptographic protocols. If we can trust one side of a Diffie-Hellman (DH) key exchange, then we can trust the keys generated because both sides contribute to the randomness of those keys. However we can't trust two instances of an OCO DH exchange implementation working with each other, so this trust doesn't seem to cover many practical instances. If the OCO protocol implementation can interoperate with a trusted implementation, then we can start to have some trust in it. However, we will still have to carefully examine the protocol for covert channels. This form of trust may be of real-world use. ------------------------------------------------------------------------- Bill Frantz | "Lone Star" - My personal | Periwinkle -- Consulting (408)356-8506 | choice for best movie of | 16345 Englewood Ave. frantz(a)netcom.com | 1996 | Los Gatos, CA 95032, USA

1 0

common sense
by HipCrime 17 Dec '03

17 Dec '03

> And rather than "dispensing drugs in clinics," why not simply > scrap the drug laws entirely? People have a *right* to do as > they please with their bodies. Let's hear it for common sense. It's the first decent posting I've seen to this list. -- HTTP://www.HIPCRIME.com

3 2

Re: [Long] A history of Netscape/MSIE problems
by Hallam-Baker 17 Dec '03

17 Dec '03

Some comments:- 1) Netscape were using BSafe but Kipp unhooked the ergodicity testing code which is meant to detect inadequate random number generation methods. Netscape got full access to Bsafe in return for 1% of Netscape stock. 2) Most serious concern was not the 40bit part. That was simply the US govt making the security a joke and there was nothing that Kipp or anyone else could do about it. More serious were the structural problems, SSL cannot be used across a firewall (unless the admin is a twit) because it is entirely opaque. SSL is not very good as an authentication only option. There is no facility for escrow of keys - another essential feature if you are to use it inside a corporation. If I am the CIO of IBM I'm not having the company secrets go out the door via some encrypted stream I can't read. Similarly banks and nuclear power stations have a legit need to snoop on their own lans. 3) Microsoft proposed PCT because they wanted to force Netscape to make SSL an open standard rather than one Netscape could tweak as they liked and freeze Microsoft out of the picture. Quite how they would imagine that anyone would want to ever do such a thing... 4) The initial weakness exposed in SSL was that integrity attacks had not been considered at all. It took a while to explain that this was in fact a more pressing concern than confidentiality in many applications. The SSL.v2 integrity was not actually bound to a particular site. Simon Spero produced a rather nice proxy server which allowed one to reroute URLs but keep the key intact. (ie connect to foobar.com and get the netscape home page). There was a long list of security holes in SSL, PCT plugged a good number of them and SSL v3 plugged a few. The overall design never gave me confidence however. Like much Netscape stuff they start with an over-simple view of the problem spec and then try to solve problems by adding extra ornaments. Phill

1 0

Re: Court challenge to AOL junk-mail blocks
by Hallam-Baker 17 Dec '03

17 Dec '03

watson(a)tds.com wrote: > > NetSurfer said: If you know a valid email address on the spammers system you can always > bounce each message back to them. If enough people turned the messages > back on them it might give them the opportunity to experience first hand > what its like to receive tons of mail you don't want or need... > > Doesn't seem to work that well. The "green card lawyers" were reported > to have received hate-mail in the hundreds of thousands. The happily waded > through it all and pulled out a few valid replies who apparently made it > all a net profit for them, apparently. What we really need is to improve > our defensive filtering mechanisms. Someday soon we'll all have our own > personal software agents that will handle all this stuff for us. Balls, the green card lawyers minions ratted on them. The number of responses from interested people was small and the amount of business they obtained even smaller. The cost of going through all the mail, getting new net hosts and such left them with a net loss which is why they are no longer in business. Phill

1 0

EPIC Alert 3.16
by Dave Banisar 17 Dec '03

17 Dec '03

============================================================= @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 3.16 September 12, 1996 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/ ======================================================================= Table of Contents ======================================================================= [1] White House Proposes Screening of all Airline Passengers [2] EPIC Testifies on Children's Privacy Bill [3] House Panel Probes White House Database [4] Crypto Update [5] Anonymous Remailer Shuts Down [6] EPIC Now Accepts First Virtual Contributions [7] EPIC/PI to Sponsor Conference on Surveillance Technologies [8] Upcoming Conferences and Events ======================================================================= [1] White House Panel Endorses Airport "Profiling" System ======================================================================= In the wake of perceived terrorist threats and the mysterious crash of TWA Flight 800 in July, a Presidential advisory panel has proposed an automated system for increased screening and "profiling" of airline passengers for all domestic and international flights. In its interim report sent to President Clinton on September 9, the White House Commission on Aviation Safety and Security provided few specifics, but noted that "[b]ased on information that is already in computer databases, passengers could be separated into a very large majority who present little or no risk, and a small minority who merit additional attention." Details of the profiling system will presumably be withheld from the public on national security grounds -- a substantial portion of the Commission's "public" meeting on September 5 was closed to permit the discussion of "classified" matters. Nonetheless, the proposed system appears to raise substantial privacy issues. The Washington Post recently reported that under the proposal, "the federal government would require creation of a computer profiling system that would examine passengers' bill-paying records, flying habits and much other data to determine which checked baggage should undergo examination by sophisticated explosives detection equipment." The Commission's initial report also calls for FBI and CIA involvement in the development of the profiling database. The theory underlying the profiling proposal appears to be that even seemingly innocuous bits of personal data can raise the suspicions of a law enforcement agency. This point is illustrated by the comments of an unidentified FBI agent recently quoted in a New York Times article. Discussing the Bureau's investigation of the bombing of Pan Am Flight 103 over Scotland, the agent noted that, "Almost everyone on the plane, almost everyone you ever met, has something that can get your imagination going. A recent fight, a divorce, a business deal, an overseas connection -- when you don't know what you're looking for, it's easy to see all kinds of possibilities." EPIC plans to monitor the development of the automated passenger profiling system under the public oversight provisions of the Federal Advisory Committee Act, which governs the proceedings of the White House Commission. More information, including relevant government documents, is available at: http://www.epic.org/privacy/faa/ ======================================================================= [2] EPIC Testifies on Children's' Privacy Bill ======================================================================= EPIC Director Marc Rotenberg testified today before the House Judiciary Committee Subcommittee on Crime in support of the Childrens Privacy Protection and Parental Empowerment Act of 1996. The bill would establish basic privacy standards for organizations that collect personal information on children and curb recent abuses in the marketing industry. The bill is sponsored by Rep. Bob Franks (R-NJ) and has 46 cosponsors in the House of Representatives. A similar measure has been introduced in the Senate by Senator Diane Feinstein (D-CA). Rotenberg said that "current practices pose a substantial threat to the privacy and safety of young people." He described a recent incident where a reporter posing as the murderer of Polly Klaas was able to obtain the ages and address of young children living in the Pasadena area. Rotenberg also cited editorials from USA Today and the Economist favoring privacy legislation as well as public opinion polls which show that 9 out of 10 Americans object to the sale of personal data where explicit consent is not obtained. Recalling the passage of the Family Educational Right to Privacy Act of 1974, which protects the privacy of student records, Rotenberg said there was already Congressional recognition of the need to protect personal information about young children. "No universities have been shut down because of the Act, but the privacy of children's educational records is more secure because Congress did not fail to act when it had the opportunity to establish privacy protection for young people." #011#Also testifying in support of the bill were Rep. Bob Franks, children rights advocate Marc Klaas, and Miriam Bell of Enough is Enough. Marc Klaas also heads the Klaas Foundation for Children which launched the Kids Off Lists campaign. Testifying against the bill were representatives from the Direct Marketing Association, a list broker, a book publisher, and a police officer from San Bernadino. More information on the Childrens Privacy bill and kids privacy may be found at: http://www.epic.org/privacy/kids/ The Klaas Foundation for Children is on the web at: http://www.klaaskids.inter.net/ ======================================================================= [3] House Panel Probes White House Database ======================================================================= The General Accounting Office revealed at a hearing of a subcommittee of the House Committee on Government Reform and Oversight on September 11 that the secret White House database of 200,000 people has inadequate controls on access. The GAO reported that the database, this existence of which, was revealed during the Filegate controversy, does not keep track of what files have been viewed by the 150 White House staffers who are authorized to access the files. The database contains 125 different fields of information for each file. Several thousand files included ethnic and political information. The GAO did not reveal in its testimony what was contained in the other fields. According to news reports, the database was designed to link into other related databases, including the Secret Service and the Democratic National Committee. The White House claims that the database is used for a number of reasons, including, for invite lists for White House events, tracking correspondence, sending out Christmas cards and other matters. Congressional Republicans claim that it is more akin to the Nixon "enemies list." The database was created by PRC Inc., a company that also creates databases for the CIA and other intelligence agencies, among other government agencies. ======================================================================= [4] Crypto Update ======================================================================= As the election approaches and Congress scrambles to complete its agenda before recessing for the year, members are continuing to deal with cryptography-related issues. The Senate Commerce Committee delayed its scheduled vote on S. 1735, the Promotion of Commerce Online in the Digital Era, originally planned for September 12. The Committee is expected to take up the measure next week. Members of the Committee have reported receiving a large number of calls supporting the bill. Individuals interested in supporting the bill should continue calling members of the Committee. The House is planning to hold hearings at the end of September to examine the companion House bill. The hearings were originally scheduled for September 11 but were delayed due to other legislative matters. The White House is also expected to introduce its own legislation next week. According to reporter Brock Meeks, the legislation will offer "sweetheart deals" to limited segments of the industry including financial, health care and insurance sectors who would then agree to support government key escrow systems. The systems would then become de facto mandatory. Internationally, an expert committee of the Organization for Economic Cooperation and Development is meeting on September 26-27 to review draft guidelines on cryptography policy. The US has been pressuring the OECD to adopt its key escrow proposals as an international standard but has been opposed by other countries and business representatives. EPIC will be hosting an international symposium in Paris on September 25, in cooperation with the OECD, to provide an opportunity for cryptographers, human rights advocates, privacy experts and user associations to present public concerns about the development of international privacy guidelines. The event will feature speakers from more than a dozen countries and includes US cryptographers Matt Blaze, Whit Diffie, and Phil Zimmermann. On September 20, oral arguments will be heard in the Daniel Bernstein's challenge to the constitutionality of export controls in federal court in San Francisco. Bernstein is arguing that the controls violate the First Amendment. Judge Marilyn Patel ruled preliminarily in May that software code is speech protected by the First Amendment More information on cryptography is available from: http://www.epic.org/crypto/ ======================================================================= [5] Anonymous Remailer Shuts Down ======================================================================= Johann Helsingius, the operator of the anon.penet.fi anonymous e-mail service has decided to shut down his remailer service because of the unknown legal protections of privacy on the Internet. He had come received requests by the Church of Scientology and the Singapore government demanding to know the identity of some of his users. In a press release, he said that he hoped to bring the server back up once the Finnish government enacted new laws protecting privacy of electronic messages, "I will close down the remailer for the time being because the legal issues governing the Internet in Finland are yet undefined. The legal protection of the users needs to be clarified. At the moment the privacy of Internet messages is judicially unclear." A list of remailers and other tools to protect privacy are available from: http://www.epic.org/privacy/tools.html ======================================================================= [6] EPIC Now Accepts First Virtual Contributions ======================================================================= Individuals interested in donating or purchasing books from EPIC can now use the First Virtual system to transfer money to EPIC. Until the end of 1996, donations of up to $50 will be matched by the Stern Foundation. Your support is appreciated and will help make possible our continued FOIA litigation, privacy advocacy, and web site development. More information about supporting EPIC is available at: http://www.epic.org/epic/donate.html ======================================================================= [7] EPIC/PI to Hold Conference on Surveillance ======================================================================= The new generation of covert surveillance activities of government agencies and private companies will be examined at a conference to be held in Ottawa next week, sponsored by EPIC and Privacy International. The conference will explore the process of planning and implementation of the technologies, their operating conditions, and the people and organizations responsible for instituting them. The conference will also examine possible technical, regulatory and legal responses. A number of former government agents, intelligence experts and surveillance analysts will gather at the Advanced Surveillance Technologies II conference on September 16th to discuss the use of powerful new technologies being used to gather information. Speakers will include Mike Frost, a former intelligence officer for the Canadian Communications Security Establishment and author of the bestseller "Spyworld." He will discuss the surveillance technologies used by the CSE and its American counterpart, the National Security Agency. The Conference will take place at the Citadel Hotel in Ottawa, Canada. More information is available on the conference from the Privacy International Web Page at: http://www.privacy.org/pi/conference/ottawa/ ======================================================================= [8] Upcoming Conferences and Events ======================================================================= "Advanced Surveillance Technologies II." September 16, 1996. Ottawa, Canada. Sponsored by EPIC and Privacy International. Contact: http://www.privacy.org/pi/conference/ottawa/ or email pi(a)privacy.org. "Privacy Beyond Borders", 18th International Privacy and Data Protection Conference. September 18-20, 1996. Ottawa, Canada. Sponsored by the Privacy Commissioner of Canada. Contact: jroy(a)fox.nstn.ca or http://infoweb.magi.com/~privcan/ "Regulation or Private Ordering? The Future of the Internet." September 20, 1996. Washington, DC. Sponsored by the CATO Institute. Contact: R. Scott Wallis, (202) 789-5296. "The Public Voice and the Development of International Cryptography Policy." September 25, 1996. Paris, France. Sponsored by EPIC. Contact: rotenberg(a)epic.org. "The 2nd International Conference & Exhibit on Doing Business Securely on the Information Highway." September 30 - October 1, 1996. Montreal, Quebec, Canada. Contact: http://www.ecworld.org/Conferences/2nd_Security/ menu.html. "Managing Privacy in Cyberspace and Across National Borders." October 8-10, 1996. Washington, DC. Sponsored by Privacy and American Business. Contact: Lorrie Sherwood, (201) 996-1154. "The Information Society: New Risks & Opportunities in Privacy," October 17-18, 1996. Bruxelles, Belgium. Sponsored by the European Parliament. Contact: http://www.droit.fundp.ac.be/privacy96.html "Communications Unleashed - What's at Stake? Who Benefits? How to Get Involved!" October 19-20, 1996. Washington DC. Sponsored by CPSR and Georgetown University. Contact: phyland(a)aol.com. "19th National Information Systems Security Conference." October 22-25, 1996. Baltimore, MD. Sponsored by NSA & NIST. Contact: Tammy Grice (301) 948-2067. "Eurosec'97, the Seventh Annual Forum on Information Systems Quality and Security." March 17-19. 1997. Paris, France. Sponsored by XP Conseil. Contact: http://ourworld.compuserve.com/homepages/eurosec/ (Send calendar submissions to alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send email to epic-news(a)epic.org with the subject: "subscribe" (no quotes). Back issues are available via http://www.epic.org/alert/ ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national id cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, email info(a)epic.org, HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. ---------------------- END EPIC Alert 3.16 -----------------------

1 0

Re: Nonsense, absolute nonsense... [Fwd: HipCrime and Spam]
by Ross Wright 17 Dec '03

17 Dec '03

On Or About: 12 Sep 96 at 17:48, Rabid Wombat wrote: > > > > These people have invited the email, and the associated expense, by placing > > a public email-to: button on their public www page. Correct! > > However, since others may think like you, I guess I'll have to add a line > above my link stating that email not related to the purpose of my site > will be happily proof-read at the rate of $200 per hour, Just great. That sure takes away any anonymity you had about being "on the cutting edge" of the information age. That 1952 "proof-read" crap went out in the 70's. How can you hope to enforce it? It's a joke, right? :) Maybe not, since it's on your sig-line. > > A more acurate analogy, > > and to the point, would be if a business sends you a postage pre-paid > > business reply card, that is blank, and invites your comments on the card. > > They can hardly complain of the expense when people actually send it in, > > even if they don't like the comments. > > No, this b.s. is more like having someone put a dead skunk in my mailbox, > with no return address, trying to prevent me from sending them 100 dead > skunks as a return favor. And about as welcome. > Sorry, Wombat. As much as I hate to agree with this multi level long distance phone company spammer. He is right. A website is an open invitation to comment and e-mail. Better password your site if you want to solve this problem. Then no-one can visit it, and no-one can send out a spider to get your e-mail address. That's what I do, send out a robot to bring back e-mail addresses. Of course I only send to makers of software, and my product applys to their world. If you don't want spam in your mail box: 1. Don't have a website or don't put your e-mail address on your website 2. Don't post to newsgroups 3. Don't post to mailing lists 4. If you post do so anonymously Ross =========== Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

5 5