December 2003 - cypherpunks-legacy

No Subject
by Ben＠explorateur.quaternet.fr 17 Dec '03

17 Dec '03

suscribe me

1 0

Re: Pseudocrypto detector is going wild
by winsock＠c2.net 17 Dec '03

17 Dec '03

Is it just me, or is the snake-oil frequency factor scaling up? We used to get this stuff quarterly, and now it's monthly, if not weekly! slither-squeek I think enquirer must be overloaded with ammo, and I am sure in the mood for it now. me

1 0

SecurID White Paper
by Peiter Z 17 Dec '03

17 Dec '03

SecurID Vulnerabilities White-Paper Due to increased recent interest that has been witnessed on the net about the SecurID token cards and potential vulnerabilities with their use, we offer a white paper on some of the vulnerabilities that we believe have been witnessed and/or speculated upon. This paper is being put forth into the public domain by Secure Networks Incorporated and is available at the following URL : ftp://ftp.secnet.com/pub/papers/securid.ps Topics dealt with in the paper include: . Race attacks based upon fixed length responses (still valid even with the current patch) . Denial of Service attacks based upon server patches . Server - Slave separation and replay attacks . Vulnerabilities in the communications with the ACE Server . A quick analysis of the communications with the ACE Server . Problems with out-of-band authentication We hope this paper provides insight, enlightenment, and is helpful to the security community in general. thanks and enjoy, Secure Networks Inc.

1 0

Re: What is the EFF doing exactly?
by jim bell 17 Dec '03

17 Dec '03

At 03:17 PM 9/3/96 -0700, Jon Lebkowsky wrote: >At 01:22 AM 9/3/96 -0700, James A. Donald wrote: >>At 12:53 PM 9/3/96 -0700, Stanton McCandlish wrote: >>> EFF in generally does not issue extremist position >>> statements, but is careful to examine the risks as well as the benefits, >>> and look for pro-liberty solutions to those risks. >> >>If the right to speak anonymously is an "extremist" position in the eyes >>of the EFF, then they are no friends of liberty. >> >>It is hardly an "extremist" position outside of such countries as Cuba, >>Iran, or China. >> >>It is the overwhelmingly mainstream position, not just among netizens, >>but when last heard, amongst supreme court judges and ordinary people >>in the street. > >Not necessarily. The character of the anonymous speech is decisive. If you >use anonymity to cloak harassment, for instance, the anonymity (which >removes accountability) is a problem. The accountability issue is real and >should be addressed, not evaded. "Addressed", maybe, but that doesn't necessarily mean, "solved." For many decades, people have been able to walk up to a pay telephone at 3:00 AM and make a harassing phone call to somebody, a "problem" which still exists and no solution is being implemented for. I think it's reasonable to come to the conclusion that there is no solution to the anonymity "problem" that isn't worse than the underlying anonymity. And, BTW, I don't consider a pro-anonymity position to be an extremist one. Jim Bell jimbell(a)pacifier.com

5 4

Re: Schelling Points, Rights, and Game Theory--My article
by ddfr＠best.com 17 Dec '03

17 Dec '03

Tim May mentioned my article on this subject. It is: "A Positive Account of Property Rights," Social Philosophy and Policy 11 No. 2 (Summer 1994) pp. 1-16. It can be found from the academic part of my web page: http://www.best.com/~ddfr/Academic/Academic.html David Friedman

1 0

EDyson CPF 95 item
by Stanton McCandlish 17 Dec '03

17 Dec '03

If anyone does did that up, please bounce one my way, so I can add it to the archives. Any other good stuff from that CFP would be of value too. Ditto for CFP96. I think the newest CFP transcripts we have are 94. -- <HTML><A HREF="http://www.eff.org/~mech/"> Stanton McCandlish </A><HR><A HREF="mailto:mech@eff.org"> mech(a)eff.org </A><P><A HREF="http://www.eff.org/"> Electronic Frontier Foundation </A><P> Online Activist </HTML>

1 0

[NOISE^2] Re: Voting Monarchist?
by Jean-Francois Avon 17 Dec '03

17 Dec '03

On 3 Sep 96 at 16:06, David M. Rose wrote: > Dimitri, err, Dr. Vulis, or is that Dr. Nuri?, Well, is astonishlingly sounds the same... Makes me think of a rabbid Det<^h^h^h>Rotweiler. :) jfa

1 0

Re: rc2 export limits..
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 10:33 AM 9/3/96 -0700, you wrote: >Hi, Does anyone know the export limit for RC2 Key size ? As with any other crypto system, the rule is "you need to get the NSA's permission, which they'll give if they feel like", rather than any well-defined rule you can depend on. However, the usual guidelines for systems like RC2 and RC4 is 40-bit keys, and RSA keys up to 512 bits for encrypting session keys and 1024 bits for signatures, plus you have to structure the code so people can't easily modify it or use it to triple-encrypt in ways that make the triple-encrypted version stronger than 40 bits. Also, if you're using Real RC2, you may need permission from RSA Data Systems, Inc.. If you're just using the algorithm that came out on the net that looks suspiciously like RC2, you may or may not. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: What is the EFF doing exactly?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:56 AM 9/4/96, jim bell wrote: >At 03:17 PM 9/3/96 -0700, Jon Lebkowsky wrote: >>Not necessarily. The character of the anonymous speech is decisive. If you >>use anonymity to cloak harassment, for instance, the anonymity (which >>removes accountability) is a problem. The accountability issue is real and >>should be addressed, not evaded. > >"Addressed", maybe, but that doesn't necessarily mean, "solved." For many >decades, people have been able to walk up to a pay telephone at 3:00 AM and >make a harassing phone call to somebody, a "problem" which still exists and >no solution is being implemented for. > >I think it's reasonable to come to the conclusion that there is no solution >to the anonymity "problem" that isn't worse than the underlying anonymity. >And, BTW, I don't consider a pro-anonymity position to be an extremist one. I agree, of course. There is absolutely nothing about "speech" that is tied to "accountability." And various Supreme Court decisions have emphasized this. (Pay special attention to the quote from Greg Broiles I included in my section from my Cyphernomicon I just posted to the list.) Think about it. Anyone may say pretty much anything they wish (modulo the usual exceptions of certain forms of obscenity, shouting "Fire!," etc....and even these are enforced ex post facto). Once a speech act occurs and some criminal prosecution results, the cops can try to catch the speaker. But if they can't, they can't. We don't require that speech only be done in a way that illegal speakers may be held "accountable." The fact that certain classes of speakers are indeed held accountable is more a function of the particular details of the way they spoke and the nature of society than it is that there is a rule that "all speech must involve accountability." We hold the author of an article in "The Washington Post" more liable for insulting speech than we do the guy in the neighborhood gym, even if they both say the same words. The issue is clearly not that "all speech must involve accountability," as many forms of speech are not. (I'd say the meta-issue is "You can drag someone into court if you can catch them. But if you can't catch them, you can't. And we're not going to limit speech just to make it easier to catch speakers you may wish to haul into court.") As Jim and so many others have noted, anonymous phone calls, anonymous postal mail, whispering campaigns, speech in private homes, etc., are all examples where accountability is extremely difficult or impossible to enforce. We even have names for these things: anonymous threats, poison pen letters, ransom demands, gossip, etc. Saying that speech on the Net may need to be restricted so as to ensure "accountability" is a serious step in the direction of requiring credentialling of all speakers, key escrow, and limits on remailers. Given that so many other types of speech are given anonymity protection, why? The reason this is such a hot button for Cypherpunks is that "responsible freedom" and "accountability" are often code words for controlling some very basic freedoms. Placing limits on anonymous speech would involve some very fundamental restrictions on freedoms of various sorts. Even if "safeguards" are built-in, the effect would almost certainly be to illegalize remailers (unless they had "escrow" features!). And a wide array of other freedoms, too numerous for me to write about here. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Anonymity (re: the Esther Dyson issue)
by tcmay＠got.net 17 Dec '03

17 Dec '03

The latest debate about "anonymity" and its hazards is bringing up charges that we Cypherpunks are not taking Esther Dysomn's concerns seriously enough. I strongly disagree. The various downsides of anonymity, pseudonymity/pseudoanonymity, lack of accountability, etc., have been hashed out in literally *thousands* of posts over the past four years! Many of us have written long articles dealing with these issues, and referring in great detail to mechanisms for dealing with "obnoxious speech," "defamatory speech," "anonymous mailbombs," "anonymous threats," etc. Rather than dredge up my own articles, or those of the many others who have addressed most or all of the concerns most often raised, I'll post here one of the subsections from my Cyphernomicon. This is just one of the subsections in the entire _chapter_ devoted to issues of anonymity, mixes, and remailers. (For those not familiar with the style of my Cyphernomicon, I used a powerful outline processor (MORE) to build a skeleton, attach threads and ideas, move things around, clone headings in more than one place, etc. For a large writing project of this sort, an outline processor is almost a necessity. At least for me. The points are often short and are sometimes incomplete; fleshing the whole thing out into well-written expository prose would've taken an additional several months of full-time effort. This form gets the points across.) (A few subsubsections are deleted, to save space.) Cyphernomicon 8.3 Anonymity, Digital Mixes, and Remailers: Anonymity and Digital Pseudonyms 8.3.1. Why is anonymity so important? - It allows escape from past, an often-essential element of straighening out (an important function of the Western frontier, the French Foreign Legion, etc., and something we are losing as the dossiers travel with us wherever we go) - It allows new and diverse types of opinions, as noted below - More basically, anonymity is important because identity is not as important as has been made out in our dossier society. To wit, if Alice wishes to remain anonymous or pseudonymous to Bob, Bob cannot "demand" that she provide here "real" name. It's a matter of negotiation between them. (Identity is not free...it is a credential like any other and cannot be demanded, only negotiated.) - Voting, reading habits, personal behavior...all are examples where privacy (= anonymity, effectively) are critical. The next section gives a long list of reasons for anonymity. 8.3.2. What's the difference between anonymity and pseudonymity? + Not much, at one level...we often use the term "digital pseudonym" in a strong sense, in which the actual identity cannot be deduced easily - this is "anonymity" in a certain sense - But at another level, a pseudonym carries reputations, credentials, etc., and is _not_ "anonymous" - people use pseudonyms sometimes for whimsical reasons (e.g., "From spaceman.spiff(a)calvin.hobbes.org Sep 6, 94 06:10:30"), sometimes to keep different mailing lists separate (different personnas for different groups), etc. 8.3.3. Downsides of anonymity - libel and other similar dangers to reputations + hit-and-runs actions (mostly on the Net) + on the other hand, such rantings can be ignored (KILL file) - positive reputations - accountability based on physical threats and tracking is lost + Practical issue. On the Cypherpunks list, I often take "anonymous" messages less seriously. - They're often more bizarre and inflammatory than ordinary posts, perhaps for good reason, and they're certainly harder to take seriously and respond to. This is to be expected. (I should note that some pseudonyms, such as Black Unicorn and Pr0duct Cypher, have established reputable digital personnas and are well worth replying to.) - repudiation of debts and obligations + infantile flames and run-amok postings - racism, sexism, etc. - like "Rumormonger" at Apple? - but these are reasons for pseudonym to be used, where the reputation of a pseudonym is important + Crimes...murders, bribery, etc. - These are dealt with in more detail in the section on crypto anarchy, as this is a major concern (anonymous markets for such services) 8.3.4. "How will privacy and anonymity be attacked?" - the downsides just listed are often cited as a reason we can't have "anonymity" - like so many other "computer hacker" items, as a tool for the "Four Horsemen": drug-dealers, money-launderers, terrorists, and pedophiles. - as a haven for illegal practices, e.g., espionage, weapons trading, illegal markets, etc. + tax evasion ("We can't tax it if we can't see it.") - same system that makes the IRS a "silent partner" in business transactions and that gives the IRS access to-- and requires--business records + "discrimination" - that it enables discrimination (this _used_ to be OK) - exclusionary communities, old boy networks 8.3.5. "How will random accusations and wild rumors be controlled in anonymous forums?" - First off, random accusations and hearsay statements are the norm in modern life; gossip, tabloids, rumors, etc. We don't worry obsessively about what to do to stop all such hearsay and even false comments. (A disturbing trend has been the tendency to sue, or threaten suits. And increasingly the attitude is that one can express _opinions_, but not make statements "unless they can be proved." That's not what free speech is all about!) - Second, reputations matter. We base our trust in statements on a variety of things, including: past history, what others say about veracity, external facts in our possession, and motives. 8.3.6. "What are the legal views on anonymity?" + Reports that Supreme Court struck down a Southern law requiring pamphlet distributors to identify themselves. 9I don't have a cite on this.) - However, Greg Broiles provided this quote, from _Talley v. State of California_, 362 U.S. 60, 64-65, 80 S.Ct. 536, 538-539 (1960) : "Anonymous pamphlets, leaflets, brochures and even books have played an important role in the progress of mankind. Persecuted groups and sects from time to time throughout history have been able to criticize oppressive practices and laws either anonymously or not at all." Greg adds: "It later says "Even the Federalist Papers, written in favor of the adoption of our Constitution, were published under fictitious names. It is plain that anonymity has sometimes been assumed for the most constructive purposes." [Greg Broiles, 1994-04-12] + And certainly many writers, journalists, and others use pseudonyms, and have faced no legal action. - Provided they don't use it to evade taxes, evade legal judgments, commit fraud, etc. - I have heard (no cites) that "going masked for the purpose of going masked" is illegal in many jurisdictions. Hard to believe, as many other disguises are just as effective and are presumably not outlawed (wigs, mustaches, makeup, etc.). I assume the law has to do with people wearning ski masks and such in "inappropriate" places. Bad law, if real. 8.3.7. Some Other Uses for Anonymous Systems: + Groupware and Anonymous Brainstorming and Voting - systems based on Lotus Notes and designed to encourage wild ideas, comments from the shy or overly polite, etc. - these systems could initially start in meeting and then be extended to remote sites, and eventually to nationwide and international forums - the NSA may have a heart attack over these trends... + "Democracy Wall" for encrypted messages - possibly using time-delayed keys (where even the public key, for reading the plaintext, is not distributed for some time) - under the cover of an electronic newspaper, with all of the constitutional protections that entails: letters to the editor can be anonymous, ads need not be screened for validity, advertising claims are not the responsibility of the paper, etc. + Anonymous reviews and hypertext (for new types of journals) + the advantages - honesty - increased "temperature" of discourse + disadvantages - increased flames - intentional misinformation + Store-and-forward nodes - used to facillitate the anonymous voting and anonymous inquiry (or reading) systems - Chaum's "mix" + telephone forwarding systems, using digital money to pay for the service - and TRMs? ... We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0