December 2003 - cypherpunks-legacy

Denning interview in Wired
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

don't recall anyone mentioning this-- Steven Levy did a lengthy piece on Dorothy Denning for the recent Wired. any reactions? I was personally struck at how Dorothy seems to lack strong convictions that hold up in the face of others. she wrote a paper urging that hackers be studied and worked with by the security community and then backed away from the position quickly after talking to "authorities". I was amazed that Dorothy, after a long time, has failed to confront some very basic issues in her advocation of Clipper: 1. constitutional issues. it would be ok for me if she described why she thinks that privacy is not constitutionally protected, but she fails to mention constitutionality issues in virtually any of her writings. frankly this strikes me as the utmost weasely evasion. is she aware of any court precedent on freedom of speech, freedom to speak in private etc? she never quotes any case law etc. 2. she fails to address the issue of "returns vs. cost" or "cost/benefit" ratio. her argument amounts to an extremely simplistic line, "law authorities have been stymied by crypto. therefore it should be restricted". but this reminds me of speed limit advocates saying, "55 saves lives". well, how many? 35 saves lives over 55. the key issue is that of *compromise*: what is the optimum compromise? we can catch more criminals by adding security cameras everywhere, but what are the costs? such back-and-white thinking has little place in any complex policy issue, yet unfortunately tends to dominate them. it's very bizarre to see an academic like Denning just seem to be vacuously oblivious to such simple concepts such as "tradeoffs". nothing I've read suggests she has ever addressed the issue of *compromise* in regard to catching criminals vs. protecting rights. but amazingly, people like Kallstrom seem to think the same way. paraphrased, "if even one criminal gets away because we didn't have enough funding in the FBI, we need more funding in the FBI" etc. 3. she fails to address the "big brother" issue. why is wiretapping never going to be used by "big brother"? it's inconceivable to me how she can honestly evade this issue as well. she has never addressed the issue of abuse by law authorities from what I can tell. 4. Denning seems to be to be remarkably swayed by "authority figures". she has changed her opinion before based merely on conversations with "authority figures" in the FBI and NSA. it seems maybe she has a bit of "spook envy" or something like that. many of her arguments for me essentially amount to, "people that claim to know what they are doing say we need [x], therefore we need [x]" well, I am not trying to start a new round of Denning-bashing (although that's always fun, hee, hee) but the recent article does give a little new food for thought about Denning's psychology etc. frankly I think that Denning has lost the intellectual battle because she absolutely fails to address some of the above key points. (particularly the total failure to address the constitution is getting more egregious). I suggest that anyone who wants to debunk her line of thinking (which apparently is getting to be awfully easy) just focus on any of the above areas. she apparently has no reponse to these points in anything I have read of hers.

2 3

Re: NSA's Venona Intercepts
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 10:49 AM 8/26/96 -0600, Rick Smith wrote: >One question that I haven't found answered in my perusals of the site is a >definitive statement of the cryptographic technology used by the Soviets. I haven't revisited the site to check, but I distinctly remember a statement to the effect that the system was a one time pad system. However, due to a mistake somewhere in the chain, some of the one time pads were used twice. The resulting two time pad system gave NSA the wedge they needed to recover what they have. ------------------------------------------------------------------------- Bill Frantz | Cave ab homine unius lebri | Periwinkle -- Consulting (408)356-8506 | [Beware the man of one | 16345 Englewood Ave. frantz(a)netcom.com | book] - Anonymous Latin | Los Gatos, CA 95032, USA

2 1

Re: Spamming
by John Deters 17 Dec '03

17 Dec '03

At 12:38 PM 8/25/96 -0500, you wrote: >Vipul Ved Prakash wrote: > >What do cypherpunks think about the following practice or law (I realize >that it may be impossible to implement): each email message should carry >a little digicash check for, say, 20 cents. Mail reading programs should >reject (send back unread) all messages not carrying these digital >checks, unless the senders are in the "friends list". The MUAs should >ask users whether they want to "cash" the digital check or not. I'm all in favor of it. The POP3 client I write to cash those little digital droplets and tell the spammers that I *love* to get their ads, read each one for 45 seconds/page, scroll thru them lovingly, and reply to the specified address for much more information, has the potential to pay for my master's degree. Call it the SpamMonster(tm). ("Spam is for money, that's good enough for me") Therefore, in order to actually make their system work, they'd need to send out their own special mail readers. And I'd disassemble one and SpamMonster(tm) would continue to eat their spam, ad infinitum (pun not intended, but it works really, really well, n'est pa?) I do not believe it is possible to have a secure executable that exists on an uncontrolled user's machine. "Tamperproof" encryption chips still require communications in and out from the user's program. A determined attacker could continue to use the pieces of their code that talk to the encryption chip. Never underestimate the allure of "free money" when you're planning to give it away. >If they do cash the check, the digital bank notifies the senders, so >that they can adjust their behavior and would not send letters to such >individuals. > >The checks should expire very soon to prevent people cashing them later >when they are desperate for money. There can also be public notice >systems that store addresses of individuals who abuse the system (for >example, those who post questions to newsgroups and collect the digital >checks), so that people would not reply to such users in the future. Hmm. Reading ONE message from them puts me on a "Spammer's blacklist"? Without the e-cash incentive, sign me up! >Is there a potential for abuse in this system? Depends on your point of view :-) I certainly think it has potential! John -- J. Deters "Captain's log, stardate 25970-point-5. I am nailed to the hull." +-------------------------------------------------------+ | NET: jad(a)dsddhc.com (work) jad(a)pclink.com (home) | | PSTN: 1 612 375 3116 (work) 1 612 894 8507 (home) | | ICBM: 44^58'36"N by 93^16'27"W Elev. ~=290m (work) | | PGP Key ID: 768 / 15FFA875 | +-------------------------------------------------------+

1 0

Re: Spamming (Good or Bad?)
by James C. Sewell 17 Dec '03

17 Dec '03

At 03:47 AM 8/24/96 -0500, William H. Geiger III wrote: > >No I have to dissagree. Who I send mail to or whom I receive mail from is >no-ones business. I for one have no intention of "signing up" or >"regestering" with any mail server. I most certainally want to be the one to >decide what mail I receive or do not receive, not someone elses idea of what >I should receive. Upon reflection I can say you are right, UNLESS we can put this "signup" thing on the end-user's machine so he can set it in his own privacy and no one else can pilfer it. The ultimate solution is AI mail clients, but that's too far off to wait for, I feel. Jim Sewell - jims(a)tansoft.com Tantalus Incorporated - Key West, FL

2 1

sorry about the mail bounces
by Jim Byrd 17 Dec '03

17 Dec '03

It seems that my address may have caused lots of problems for the list, mailing lists were getting lots of bounces of things sent to me. I haven't heard for sure, but I'm guessing this is the reason the list was taken down yesterday. ACM Network Services tells me they have fixed the problem now. Sorry about that, but I had no idea the problem was happening.

1 0

NSA's Venona Intercepts
by smith＠sctc.com 17 Dec '03

17 Dec '03

The bulk of the material available from NSA's web site is associated with a long time project called Venona to decrypt Soviet message traffic from the 1940s. It's an interesting exhibition of the practical output of cryptanalysis that, incidentally, contains alleged reference to famous Commie spies of that era (Hiss, the Rosenbergs, etc). One question that I haven't found answered in my perusals of the site is a definitive statement of the cryptographic technology used by the Soviets. I was re-reading Kahn's 1967 chapter on Soviet crypto and he claimed that they relied primarily on one time pads. In fact, he was pretty specific about them using OTPs for exactly the type of traffic appearing in the Venona archive. But when I look at the partial decrypts in the Venona archive I don't understand how you'd get such partial decrypts from OTPs. The intercepts seem to indicate the use of ciphers with some codewords weakly layerd on top. Some intercepts show translations based on the phonetic properties of the extracted Russian plaintext. So I don't think the "unrecovered codegroups" are caused by a classic code that substitutes tokens for word meanings. But you're not going to crack only part of a OTP ciphertext -- presumably you'd need a compromised key tape, and that would either decrypt everything or nothing. So they were either really using rotor machines or they were using something else. Any other ideas? Other references? Rick. smith(a)sctc.com secure computing corporation

2 1

Microsoft Explorer security hole (fwd)
by Ben Holiday 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 01:35:07 GMT Subject: Microsoft Explorer security hole (fwd) On Sun, 25 Aug 1996 13:55:30 -0600 (MDT), Carl Nation <carl(a)iserver.com> wrote: To our Resellers/Customers, Our sysadmin received this security alert, and we thought we should pass it along... ------- Forwarded Message Date: Wed, 21 Aug 1996 13:12:59 -0400 From: felten(a)CS.Princeton.EDU (Ed Felten) Subject: Internet Explorer Security Problem We have discovered a security flaw in the current version (3.0) of Microsoft's Internet Explorer browser running under Windows 95. An attacker could exploit the flaw to run any DOS command on the machine of an Explorer user who visits the attacker's page. For example, the attacker could read, modify, or delete the victim's files, or insert a virus or backdoor entrance into the victim's machine. We have verified our discovery by creating a Web page that deletes a file on the machine of any Explorer user who visits the page. The core of the attack is a technique for delivering a document to the victim's browser while bypassing the security checks that would normally be applied to the document. If the document is, for example, a Microsoft Word template, it could contain a macro that executes any DOS command. Normally, before Explorer downloads a dangerous file like a Word document, it displays a dialog box warning that the file might contain a virus or other dangerous content, and asking the user whether to abort the download or to proceed with the download anyway. This gives the user a chance to avoid the risk of a malicious document. However, our technique allows an attacker to deliver a document without triggering the dialog box. Microsoft has been notified and they are working on fixing the problem. Until a remedy is widely available, we will not disclose further details about the flaw. For more information, contact Ed Felten at felten(a)cs.princeton.edu or 609-258-5906. Dirk Balfanz and Ed Felten Dept. of Computer Science, Princeton University http://www.cs.princeton.edu/sip/ ------- End of Forwarded Message

2 1

New type2.list/pubring.mix
by John Perry 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello Everyone, There is a new type2.list/pubring.mix update for Mixmaster on jpunix.com. The update reflects the temporary retirement of the anon Mixmaster remailer. Please update your files accordingly. The files can be obtained by WWW at www.jpunix.com and by anonymous FTP at ftp.jpunix.com. - -- John Perry - perry(a)alpha.jpunix.com - PGP-encrypted e-mail welcome! WWW - http://www.jpunix.com PGP 2.62 key for perry(a)jpunix.com is on the keyservers. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMiIqVlOTpEThrthvAQE4QwQAhFWK/mkfi7ucQq4xdnRJKiezeVr7tuT6 j0RYV+mnmiBjYX7jMtsEA4dSuEoTqG0IzXtihbu91qNk7mTyNfNmIegyIDfneD4M bJh3jpUK6d2zHJ8Bo8+dwVd6e+etZZ+0+CC9AULfuWC0AKUpkoF5ussjWf2L8thB WuSJQTT72UM= =DcDL -----END PGP SIGNATURE-----

2 1

Sen. Leahy's "impeccable cyberspace credentials"
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 26 Aug 1996 12:23:57 -0400 From: Jonah Seiger <jseiger(a)cdt.org> To: Declan McCullagh <declan(a)eff.org> Cc: shabbir(a)vtw.org, fight-censorship(a)vorlon.mit.edu, brock(a)well.com, telstar(a)wired.com Subject: Re: INFO: Democratic convention chats online! Be there! (8/25/96) Declan: What are you thinking?! In a world where we have very few real friends, I simply don't understand what you are trying to accomplish. It's fine (and healthy) to raise concerns about the particular positions a member of Congress takes (hell, I don't agree with everything Leahy does), but to simply dismiss Leahy as a 'no friend of the Net' is naive and counterproductive. Look at the record. Leahy is hands down the strongest supporter of the Net in Congress. Period. No other Member (including our small but growing handful of other friends like Burns, White, Wyden, Cox, Eshoo, etc) has been a more forceful or consistent advocate for your causes for as long as Leahy has. What exactly do you want? Perhaps we should elect you to Congress and see how well you can do. Of course we are not going to agree with our friends on every issue. If Leahy takes a position you don't like, I'd suggest you talk to his office. I have found in my experience that Leahy's staff (and him personally) will take the time to listen when presented with a well presented argument. I'm also confused about another thing: which hat were you wearing when you wrote this? If it is your "advocate" hat I think it must covering your eyes. If it's your "journalist" hat, you need to do a bit better job of checking your facts in the future. Go a head and reject the "Beltway politicians". It's fashionable, sure, but what does it really accomplish? Some of them are dangerous. Others are sympathetic. The fact is that short of armed rebellion they are going to be here for a while. I shudder to think of the wrath our opponents could wage if we all threw up our hands packed up our bags and left town. Face the facts. Members of Congress have a lot of constituencies to deal with, and we are a small and relatively powerless faction. We can do a lot to change the outcomes of policy debates (if I didn't believe that I wouldn't be doing what I do everyday), but we have to be realistic, recognize where we fit in to the process and who are friends are. One thing's for sure - we have A LOT more enemies than we have friends. Most members of Congress don't really understand us or our issues. Many are willing to learn, and some have been real champions for our causes. But none of them are gong to continue reaching out a hand to us if we bark and bite when we don't get 100% of our way. Zealots rarely win (though it sure is fun to throw bombs). Sorry for the public thrashing, but this kind of attitude REALLY gets under my skin. Flames welcome (though response is not guaranteed <g>), Jonah At 6:45 PM 8/25/96, Declan McCullagh wrote: >On Sun, 25 Aug 1996, Voters Telecommunications Watch wrote: >> [Notably missing from this schedule are Senators Patrick J. Leahy (D-VT) >> and Russell Feingold (D-WI) and House member Jerrold Nadler (D-NY). All >> three have impeccable cyberspace credentials and we look forward to seeing >> them online.] > >As Shabbir and Steve know, I'm a huge fan of VTW and congratulate them for >their successful efforts to keep netizens up-to-date on what's happening >in the meatspace body politic. > >But VTW's statement above is, unfortunately, untrue and misleading. > >Even though Sen. Leahy opposed the CDA, his stance on privacy illustrates >that his "cyberspace credentials" are anything but impeccable. His crypto >bill, introduced before Pro-CODE, would liberalize some export controls >but impose new and unprecedented criminal penalties for the use of crypto >associated with a crime. Worse yet, as recently as this month Leahy has >been clamoring to fund the invasive wiretapping legislation ("Digital >Telephony") he shepherded through Congress two years ago. > >Equally distressingly, Leahy demonstrated his "impeccable cyberspace >credentials" by cosponsoring the Senate online copyright bill -- aka the >Hollywood Media Mafia's wet dream. (Yes, these are the same rapacious >folks who are demanding that the Boy Scouts and summer camps pay cash to >sing "God Bless America" and "Puff the Magic Dragon.") Opposed by the >American Library Association, EFF, and teachers' organizations, Leahy's >bill would slam fair use rights online and could make it a crime to >browse the Net without a license. > >When VTW heralds Leahy as a friend of the Net with "impeccable cyberspace >credentials," they do the Net a disservice. Leahy is in no way a true >friend of the Net; I don't know of any Beltway politican who is. > >-Declan > > >// declan(a)eff.org // I do not represent the EFF // declan(a)well.com / ** THE FIGHT FOR FREE SPEECH ONLINE CONTINUES TO THE SUPREME COURT ** It's not too late to be a part of history -- Join the Lawsuit <http://www.cdt.org/ciec> -- <ciec-info(a)cdt.org> -- Jonah Seiger, Policy Analyst Center for Democracy and Technology <jseiger(a)cdt.org> 1634 Eye Street NW, Suite 1100 Washington, DC 20006 PGP Key via finger (v) +1.202.637.9800 http://www.cdt.org/ (f) +1.202.637.0968 http://www.cdt.org/homes/jseiger/

1 0

Re: Cypherpunk voting - ITAR or CDA
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Mon Aug 26 14:32:37 1996 I sent this earlier, but evidently toad.com ate it, so I am sending again, despite Bill Stewart's excellent post on the subject. BTW, Bill is one of the nicest guys you would ever want to meet, and all cypherpunks should try to meet him if they get a chance. Apologies if you get this twice, and I would only add that in any election there are winners and losers, and the sets of losers on cypherpunks if Harry Browne wins or does does well are: 1. Lawyers. If laws are simpler and better-written in something approaching the English language and judges who respect the constitution are selected-for, lawyers and law-professors would feel the economic effects of less demand for their services. 2. Accountants. If the tax laws are simplified and the IRS is eliminated, there will be less need for accountants to figure out what people actually owe in taxes. 3. Offshore dataheaven providers. ;) If the above happens, running businesses from the US will be relatively more attractive than running them from Anguilla, all other things being equal. Vincent Cate wrote: > Dole says he would fix the ITAR problem, but try to keep something like > CDA. He would say anything to get elected. > Clinton is keeping ITAR and signed CDA. But not having the religious > right he might soften on CDA. Lame ducks don't have to soften, on anything. That's what's so fun about being a lame duck. > The courts seem to be throwing out CDA much faster than ITAR (some fast > track to the supreme court built into the law). It also seems like > ITAR > is the more important thing to fix (it is easier to move pornography > etc > out of the US than major software companies). > > So it seems Dole is the better vote. Is this important enough to many > cypherpunks to actually determine their vote? If the Republican candidate had been Forbes, there might have been a "don't let the great be the enemy of the good" argument against voting for a Libertarian. As it stands now, Dole is, at best, arguably the "lesser of 2 evils," which still comes out evil in my book. As the designated partisan Libertarian on the list, I urge all cypherpunks to vote their consciences and pick Harry Browne and Jo Jorgensen. The mere fact that the media is [grudgingly] covering us suggests we are finally doing something right, and Harry is winning many Internet polls despite much fawning, hopeful coverage for the big-eared billionaire hypocrite stealth-candidate, who has no position on much of anything, but certainly would enjoy having the TLAs investigate his enemies. I fully accept that it is likely Dole or Clinton will win, but I think it will fill an important cypherpunk goal if the Libertarian Party candidates get a vote large enough to be the margin of victory, and I will be very proud of my vote, no matter who wins this election. Vote your consciences for your own sake, and the sake of the children who, no matter what, will inherit the debt of the irresponsible statists in power now. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "'Filegate' is starting to make _Ed_ _Meese_ look ethical." -- me Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray C Ross Perot is now on welfare.<sigh> -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMiHtzG1lp8bpvW01AQFxxAP9GW/NizRkEqW0y4b0vGF5npoOGQj4jSVQ wBz8toN78LUY1xKyEj2y0WWqjfl3WQOMk2dCMlRskHZU8C8+nqLS3FgHaWCwrVF+ Th7LA3hvErvoVNKsrRTKAuGUkIm8XFQLfmPi8L6z94OXY5qXXRvVS9exRwlbH/DZ gpwGznNDjw0= =t8M2 -----END PGP SIGNATURE-----

1 0