December 2003 - cypherpunks-legacy

Re: Snake Oil FAQ 0.4 [comments appreciated]
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Sep 16 12:05:17 1996 > (First off, I'd like to thank Matt for doing this.) > > The key length stuff is good, but a common component of snake oil is > that it claims to have very long key sizes. > > | Some ciphers, while currently secure against most attacks, are not > | considered viable in the next few years because of relatively small > keysizes > | and increasing processor speeds (making a brute-force attacks > feasible). The > | tables below should give some general guidelines for making intelligent > | decisions about the key length you need. If the key is too short, the > system > | will be easily broken, even if the cipher is a good one. > | > | In [1] and [2], we're presented with some guidelines for deciding > | appropriate key length. (It is important to note that this is based on > the > | ability to predict computing power 40, 65, and 100 years from now. > Major > | breakthroughs in computing power 30 years from now might render > everything > | on this chart kiddieplay.) > > | * One-Time-Pads > | > | A vendor might claim the system uses a one-time-pad (OTP), which > is > | theoretically unbreakable. That is, snake-oil sellers will try > to > | capitalize on the known strength of a OTP. It is important to > | understand that any variation in the implementation means that it > is > | not an OTP, and has nowhere near the security of an OTP. > | > | A OTP system is not an algorithm. It works by having a "pad" of > random > | bits in the possession of both the sender and recipient. The > message is > | encrypted using the next n bits in the pad as they key, where n > is the > | number of bits in the message. After the bits are used from the > pad, > | they're destroyed, and can never again be used. The bits in the > pad > | must be truly random, generated using a real random source, such > as > | specialized hardware, radioactive decay timings, etc., and not > from an > | algorithm or cipher. Anything else is not a one-time-pad. > > The phrase easy-to-use should not appear in proximity to one > time pad, except in the context 'Easier key management than a one time > pad!" > I would also suggest that the generation of OTP 'pads' for users is *highly* questionable. Who else is getting a copy of them, assuming they're even valid? Dave Merriman - -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- PGP Email welcome, encouraged, and PREFERRED. Visit my web site at http://www.shellback.com/p/merriman for my PGP key and fingerprint "What is the sound of one hand clapping in a forest with no one there to hear it?" I use Pronto Secure (tm) PGP-fluent Email software for Windows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMjzSBMVrTvyYOzAZAQGVwQP+N6vjyniDH0ad3G8dWu1cPHi5yfvksbS7 EJmgpSVTlaLf1Kp7rX2zBULxKvd2bqN3z3tAhj6reeG8la+P3Skw9gPJS8ggYvOn cXwdRsCyRICgHYMcbaEB/91YsJMweYyzWLe2JZazs3NfsafxdNKerGR7kvoQF0bG oBNR169sGlo= =WqlN -----END PGP SIGNATURE-----

2 1

CDT Policy Post 2.31 - Join Rep. Eshoo Online, Tues. 9/16, 8:00 EDT
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 31 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 31 September 16, 1996 CONTENTS: (1) Join Rep. Anna Eshoo (D-CA) Live Online Tuesday Sept 17, 8:00 pm EDT (2) How to Subscribe/Unsubscribe (3) About CDT, contacting us ** This document may be redistributed freely with this banner intact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ** This document looks best when viewed in COURIER font ** ----------------------------------------------------------------------------- (1) Join Rep. Anna Eshoo (D-CA) Live Online Tuesday Sept 17, 8:00 pm EDT Representative Anna Eshoo (D-CA) will be live online on Tuesday September 17 at 8:00 pm EDT (5:00 pm PDT) to discuss her efforts bring privacy and security to the Internet through the reform of US encryption policy. Eshoo will also take questions from Netizens during the discussion. Representative Eshoo, who represents the heart of California's Silicon Valley, is a co-sponsor of HR 3011, the "Security and Freedom through Encryption (SAFE) Act of 1996", a founding member of the Congressional Internet Caucus, and a strong advocate for enlightened Internet policies. Momentum in Congress for real reform of US encryption policy remains strong. The House Judiciary Committee is scheduled to hold a hearing on HR 3011 on Wednesday September 25, 1996, and the Senate Commerce Committee is expected to vote on the Burns/Leahy "Pro-CODE" bill (S. 1726) soon. DETAILS ON HOW TO PARTICIPATE IN THE DISCUSSION: At 8:00 pm EDT (5:00 pm PDT), point your browser to: http://www.hotwired.com/wiredside/ To participate you will need to have RealAudio installed on your computer (available free at http://www.realaudio.com/) You also need to be a registered HotWired member (there is no charge for registration - visit http://www.hotwired.com/ for details). This forum is the 6th in a series of events organized by the Center for Democracy and Technology and the Voters Telecommunications Watch with the purpose of bringing the Internet Community into the debate over critical Internet policy issues. For further information, please visit the following sites: * For Background on the Encryption Issue: The Encryption Policy Resource Page: http://www.crypto.com/ CDT's Encryption Policy Issues Page: http://www.cdt.org/crypto/ * For details on Congress and the Internet: CDT's Congress and the Net Page http://www.cdt.org/net_congress/ Voters Telecommunications Watch: http://www.vtw.org/ HotWired's WiredSide Chat: http://www.hotwired.com/ ----------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by nearly 10,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.31 9/16/96 -----------------------------------------------------------------------

1 0

Re: PRESS RELEASE: GERMANY CENSORS DUTCH WEBSITE WWW.XS4ALL.NL
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"gnu(a)toad.com" "John Gilmore" 16-SEP-1996 10:13:36.24 >While you are at it, you could move just the censored material to a >separate IP address from the rest of the archives, and issue Web >redirects for requests sent to the old address. In fact it might be >interesting to redirect readers to various mirror sites automatically, >at random and in rotation. Thus, when someone connects to your web >site to read censored material, they will be automatically redirected >to one of dozens or hundreds of other places where the material can be >found. The German censors will likely find it impossible to block >access to all those sites (and each such site can also be changing its >IP address periodically). The first part (redirection at random) can be done via a CGI script; this may be useful for those wishing to put in links to a mirror site without having to choose a particular one or host it themselves. Incidentally, speaking of mirror sites, I'd be interested in locating scripts to do the following: A. Automatically redirect someone to an appropriate mirror site based upon closeness to their originating IP address B. Automatically poll (via crontab or similar mechanisms) between mirror sites (and to the anonymizer) to see if they're up, using the first part to redirect accordingly. -Allen

1 0

HipCrime as MetaSPAM
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

The Hippie Of Crime <robert(a)precipice.v-site.net> also asked that remailer operators not block HipCrime SPAM deliveries and all mail to HipCrime because people might be interested in his cool fractals and Java neural net lotto-predicters and anarchist pages. If he wants to advertise to people about his other cool products, he doesn't need to do it anonymously. Furthermore, he doesn't provide any method in his web pages for users to anonymously request information, or to have information delivered anonymously. So blocking him from the remailers won't lose him anything. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Judge Kozinski Responds
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Mon Sep 16 17:18:36 1996 cypherpunks: I have been having a private e-mail conversation with Judge Alex Kozinski of the 9th circuit. Today he said: >Jim: Feel free to clarify my position to your comrades >(excuse the term) if you think it will be useful. I guess >I'll keep thinking about this stuff and may change my mind >on some things. ... In a previous message to me in response to cypherpunks messages mentioning him which I forwarded, he said: >The statement about anonymous remailers was largely >accurate. I'm not sure that the fact that you (or some of >your associates) are willing to block people from getting >anonymous mail is a sufficient safeguard. Some may not be, >and it only takes one or two who do not adhere to the code >to make life miserable for the rest of us. > >We agree about the need for privacy, but I'm not at all sure >why the right to send messages anonymously trumps the >recipient's right to know who's addressing him. Getting an >anonymous message--even one that is not harassing or >threatening--is an invasion of my privacy. As for Me: [Please note, this statement caused me to block his address from WinSock messages, but _NO_ I will not give you his e-mail address, so please do not ask me to unless I _know_ you are a remailer-operator, and you send me a PGPmessage including your key and asking for it for blocking reasons ONLY. So far, nobody has been stupid enough to try to use the remailers to harass him. I DON'T want this man harassed, and having him understand "our" point of view will be a "big cypherpunk win"(tm) IMNSHO, so please trust me to represent you fairly. Thanks.] On with the Judge: >Halloween, it only really works when the people dressed up >are about four feet tall. In the rare instances where there >have been adults at my door that were so disguised you >couldn't tell who they were, I felt threatened--kept my >Glock handy before opening door. > >The quote about morphed children's images was sort of >botched, as was my assessment of the Third Circuit's case. >What I said about children is that morphed images did not >involve normal exploitation of children so it would not >clearly fall in the unprotected category, but that there may >be other harms I'd have to think about before deciding. >As for the Third Circuit's opinion, I said at the outset >they got it right in the bottom line; what I criticized was >their use of analogies to deal with the problem. I find >that much thinking about the net is analogy-driven and that >analogies are inherently imprecise and can be misleading. > >Anyway, thanx for bearing with me. There's a lot of this >stuff I have not made up my mind about and I find talking >about it helps shape my thinking. Folks, we have a chance to win or lose, depending on list.maturity and common sense. If this man is harassed, convincing him will become harder for me, and I will be very annoyed. If you make a coherent comment that covers ground that I have not already covered with him, I will forward it on to him. Alex Kozinski is IMO, by far, the closest thing to a libertarian that Reagan ever appointed, and in both messages he has mentioned having an open mind. Let's try not to give him a reason to close it. Thanks for trusting me, and thanks in advance for behaving nicely and respecting the judge's privacy. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "As govt.s grow arithmetically, corruption grows exponentially." -- Ray's Law of official corruption. Defeat the Duopoly! Stop the Browne out. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ http://www.twr.com/stbo ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 I will generate a new (and bigger) PGP key-pair on election night. <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3ENG1lp8bpvW01AQEOBAP+IExjfTO6DnrBvF8/xNFWLDcYTgIid5tI Gpya0oRKRFIgYm2v3pjw2y649QxC8bGryy15wi72s6p4f1Sf6pqKbOz6ANcHNkOK JoenVAMBxKK4wwoDIzqkxPBBIBmQO/KzJBw5ymfhGMZNN+NN6nwS9JnlSKeDwFtO 94BZLZ2fec4= =IS+5 -----END PGP SIGNATURE-----

1 0

Unsolicited email advertising already illegal in US?
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This piece from RISKS looks interesting. My computer certainly _is_ "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Now, are HipCrime et al. liable for $500 in damages for each piece of spam? If so, where do I sign up? - Ian - ---8<---8<--- Date: Thu, 12 Sep 1996 19:46:42 -0400 From: Dan Franklin <dan(a)copernicus.bbn.com> Subject: Sometimes junk e-mail is already a fax, legally speaking I've been using the following legal information, which I picked up from another mailing list (Keith Bostic's /dev/null list), in my responses to junk e-mail these days. So far I haven't yet received junk e-mail on my home computer while it had a printer attached, but one of these days... Under US Code Title 47, Sec.227(b)(1)(C): "It shall be unlawful for any person within the United States to use any telephone facsimile machine, computer, or other device to send an unsolicited advertisement to a telephone facsimile machine" A "telephone facsimile machine" is defined in Sec.227(a)(2)(B) as: "equipment which has the capacity to transcribe text or images (or both) from an electronic signal received over a regular telephone line onto paper." Under this definition, an e-mail account, modem, computer and printer together constitute a fax machine. The rights of action are as follows. Under Sec.227(b)(3)(B): "A person or entity may, if otherwise permitted by the laws or rules of court of a State, bring in an appropriate court of that State -- (A) an action based on a violation of this subsection or the regulations prescribed under this subsection to enjoin such violation, (B) an action to recover for actual monetary loss from such a violation, or to receive $500 in damages for each such violation, whichever is greater, or (C) both such actions. If the court finds that the defendant willfully or knowingly violated this subsection or the regulations prescribed under this subsection, the court may, in its discretion, increase the amount of the award to an amount equal to not more than 3 times the amount available under subparagraph (B) of this paragraph." For the full legal text USC Title 47, Section 227, see: http://www.law.cornell.edu/uscode/47/227.html Dan Franklin dfranklin(a)bbn.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj3MlEZRiTErSPb1AQFSIgP/SKn68eix0cgOMa2QgOsAJ7IePBZitECs 1KflgL0ziSW9D5JBhYmjAfl3UoFF7UJ1vyROFUV7sgBB1PSXGAvBGycSqrIhciPh Fm/73HUT0pr4foyTAPOndhAOx3ls61+kT497TUx+BecPhtfI41Mu0zTdPaZdWogP vaxfu97SuWw= =OC/R -----END PGP SIGNATURE-----

1 0

RE: Workers Paradise. /Political rant.
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca wrote: > By spreading the risk you minimize the cost. m5(a)tivoli.com wrote: >Yea right. Actually, yes. Canada has a single payer system and we spend about two thirds as much as the U.S. on health care as a percentage of G.N.P. We manage to insure all Canadians while about 35% of people in the U.S. have *no* health insurance. Yes, the insurance premium is not optional. Yes, it *is* cheaper. Ciao, James

1 0

Free RSA chip
by Lucky Green 17 Dec '03

17 Dec '03

I secured a 30 page data sheet for the new NTT (actually NLC, a subsidiary of NTT) RSA accelerator chips. The NLC0048 LSI chip can handle keys up to 1024 bits. The secret key can be stored on-chip. If you want a copy of the data sheet, email me your fax number. Furthermore, I have *one* sample chip that I am willing to loan to somebody in the SF Bay Area with sufficient hardware knowledge to put the chip to good use. If you think you qualify, let me know who you are and why you think that you should get the chip. I apologize in advance to the qualified candidates that do not get the chip. There is only one (that I can loan out). --Lucky

1 0

RE: Workers Paradise. /Political rant.
by jim bell 17 Dec '03

17 Dec '03

At 02:00 AM 9/16/96 -0700, Timothy C. May wrote: >As to the "social safety net," things are far, far beyond a simple safety >net. When 14-year-old pregnant inner city girls are given money to set up >their own households (cf. Charles Murray's "Losing Ground"), this is not a >"safety net," this is subsidized breeding. A friend of mine (who can be just as coarse as I) calls them "Welfare-powered bastard factories." Jim Bell jimbell(a)pacifier.com

1 0

Edited Edupage, 15 Sept 1996
by E. Allen Smith 17 Dec '03

17 Dec '03

From: IN%"educom(a)educom.unc.edu" 16-SEP-1996 10:15:59.50 >To: IN%"edupage(a)elanor.oit.unc.edu" "EDUCOM Edupage Mailing List" >************************************************************ >Edupage, 15 September 1996. Edupage, a summary of news about information >technology, is provided three times a week as a service by Educom, >a Washington, D.C.-based consortium of leading colleges and universities >seeking to transform education through the use of information technology. >************************************************************ >SATELLITE BROADCASTERS MUST PROVIDE EDUCATION, TOO >A federal appeals court in Washington has ruled that any company providing >direct broadcast satellite (DBS) services must "reserve a portion of its >channel capacity, equal to not less than 4 percent nor more than 7 percent, >exclusively for noncommercial programming of an educational or information >nature," in compliance with regulations drafted by the FCC to enforce laws >enacted in 1984 and 1992. The unanimous decision rejected arguments by Time >Warner and other broadcasters that the law interfered with their First >Amendment rights. "It is the right of the viewers and listeners, not the >right of the broadcasters, which is paramount," said the court, quoting a >1969 Supreme Court ruling. (Chronicle of Higher Education 13 Sep 96 A29) Bloody socialist Supreme Court... sell the _full_ rights, then use the money to reduce taxes. >SYSTEM CRACKER GOT RECIPE FROM HACKER MAGAZINE >The person who disabled New York's Panix Internet service probably followed >the line-by-line instructions for doing so that appeared in the latest issue >of 2600 magazine, the Hacker's Quarterly. "We need to educate the community >that it's very, very simple to cause massive mayhem," says 2600's editor, >who defended his editorial judgment. "A lot of companies subscribe to us so >they can learn before they're victimized." Panix's co-owner says he >supports 2600's right to publish such information: "As a matter of >principle I don't think they should have been stopped," but adds that unlike >most other recipes for breaching security published in the magazine, this >one has no known technical defense. (Wall Street Journal 13 Sep 96 B5) Helpful to quote Panix on it. >Edupage is written by John Gehl <gehl(a)educom.edu> & Suzanne Douglas ><douglas(a)educom.edu>. Voice: 404-371-1853, Fax: 404-371-8057. >Technical support is provided by Information Technology Services at the >University of North Carolina at Chapel Hill. >*********************************************************** >Edupage ... is what you've just finished reading. To subscribe to Edupage: >send mail to: listproc(a)educom.unc.edu with the message: subscribe edupage >Henry R. Luce (if your name is Henry R. Luce; otherwise, substitute your >own name). ... To cancel, send a message to: listproc(a)educom.unc.edu with >the message: unsubscribe edupage. (If you have subscription problems, send >mail to manager(a)educom.unc.edu.)

1 0