December 2003 - cypherpunks-legacy

Re: Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 5:53 AM 11/8/1996, Douglas B. Renner wrote: >[snip] >> The key here is that in these cases the practice has become widely >> accepted. By widely accepted, I mean that very significant numbers of >> people believe that there is nothing all that wrong with the practice. >> Those who disagree do not feel it is worth the trouble to put a stop >> to it. >[snip] > While this might be the case, I don't believe it is "key". > Also, I'm not sure why you used this as a counterpoint. Are you saying > that there are not a significant number of people who think there is > nothing wrong with sending truly private messages? I would disagree > with such an assertion based on my own converastions with crypto-ignorant > aquaintances. Most people either trust the gov't implicitly or haven't > thought about it or (erroneously) consider it irrelevant - but deep down > they definitely value their privacy. They also definitely value their safety. Sure, right now there are lots of people who think strong cryptography is a good idea. If the Four Horsemen scenario is correct, that will change very quickly. The reason I used this as a counterpoint is that the premise of my discussion is that it would be possible - maybe even easy - to suppress the use of non-GAKed cryptography were it unpopular. A commonly shared belief among GAKers and Cypherpunks is that strong cryptography is a magic bullet. It isn't. If it's not obviously a disaster, strong cryptography will be widely used. But if it is a disaster and requires GAK, that's a policy option we will always have. Peter Hendrickson ph(a)netcom.com

1 0

Re: Clinton
by jim bell 17 Dec '03

17 Dec '03

Someone asked, >>How the result of the election will affect crypto etc.? Jim Bell jimbell(a)pacifier.com

1 0

Re: Why is cryptoanarchy irreversible?
by jim bell 17 Dec '03

17 Dec '03

At 02:46 PM 11/8/96 +0100, Matts Kallioniemi wrote: >At 17:12 1996-11-07 -0800, jim bell wrote: >>Simple analogy: Suppose you put two people into a room with a deck of >>playing cards and a table, instructing "Person A" to build a house-of-cards, >>and telling "Person B" to stop him from achieving his goal. Who do you >>think will win? Obviously, the latter will win: It's vastly easier to >>knock such a structure down than to build it in the first place, and all >>"Person B" has to do is occasionally take a whack at the structure. > >What if Person A is better armed? Could that change the outcome? Well, okay, I sorta assumed a non-violent scenario. But adding that as a possibility actually strengthens the argument: Generally, it's easier to stop somebody doing something out in the open, than to do it. It's easier to knock down a house of cards than to build it up. But it's also easier to shoot the person doing the knocking down, etc. On the other hand, it's easier to DO something...if it can be done in secret. And it's harder to keep somebody from doing something, if that something can be kept secret. That's why it's so important that good cryptography remain legal. Jim Bell jimbell(a)pacifier.com

1 0

Exon Countdown Clock and farewell messages
by Rich Graves 17 Dec '03

17 Dec '03

Some of you might find this amusing. -rich ---------- Forwarded message ---------- Date: Wed, 6 Nov 96 00:40 EST From: Michael Page - Fade to Black <mpage(a)fadetoblack.com> To: mpage(a)fadetoblack.com Subject: Fade to Black Update The Fade to Black Pages have been updated. This week we started the official Senator Exon Countdown Clock. (Days till retirement on Jan 3 1997). We also made it available for you to submit your own personal message to the Senator. All the messages will be delivered via certified Fed-X on his last days in office. Now you to can send a personal greeting to the Senator allowing him to know how much you appreciated all he has attempted to do for the Internet. We would attempt to send it via a Email, but the respected Senator does not have Email. (The Irony). http://www.fadetoblack.com/exon/ ---------------------------------------------------------------------------- ------------ If you encounter any problems with the pages feel free to drop us a line. f2b(a)fadetoblack.com ---------------------------------------------------------------------------- ------------ Thank you again for your support Michael Page Editor Fade to Black http://www.fadetoblack.com mpage(a)fadetoblack.com

1 0

Re: RICO - (Was: Group order for Secret Power)
by jim bell 17 Dec '03

17 Dec '03

At 03:13 AM 11/8/96 -0500, Black Unicorn wrote: >On Thu, 7 Nov 1996, jim bell wrote: >> But the odd thing is, the one entity we can't seem to attack using RICO is >> the Federal government, and probably most other governments levels. Looked >> at purely objectively, it should be easy to demonstrate that the Federal >> government (and its representatives) have engaged in plenty of crime as a >> pattern of activity, and certainly enough to rise to the level of the >> standards of RICO. (It takes only a few instances of such crime satisfy the >> standards of RICO.) > >Incorrect. Employees of the Federal Government can be, and have been, >prosecuted under RICO. Many political corruption cases involve some RICO >aspects. This should make Mr. Bell a big fan of the statute, unless he >just likes the flash of murdering officials instead. No, I meant the ENTIRE government Not just individual government officials. Remember, RICO is _supposed_ to apply to any organization with a pattern of criminal activity, and has been used (in fact, probably mostly used) against organizations where many of the members are "merely" employees, quite analogous to the Federal government. If RICO applies to anything, it should apply to the Feds, and that means conviction of the entire organization if it or its employees have a pattern of illegal activity. Since RICO only requires a relatively tiny number of criminal acts to meet its standards, it should not be difficult to show enough criminality. Jim Bell jimbell(a)pacifier.com

2 1

Re: Why is cryptoanarchy irreversible?
by jim bell 17 Dec '03

17 Dec '03

At 09:44 PM 11/7/96 -0800, Timothy C. May wrote: >At 5:12 PM -0800 11/7/96, jim bell wrote: >>accessible to the common man? Suppose, say, the approval of one million >>citizens was the only thing necessary to have an assassination legally >>accomplished? Or, more likely in practice, the vote of a million citizens >>was interpreted as a kind of terminal veto over that particular politician >>or government employee, who would have to resign or face the (lethal) >>consquences! In that case, assassinations wouldn't be seen as bad, they'd >>be the natural consequence of a politician who overstays his welcome and >>ignores numerous warnings. > >Nothing in any version of AP I have seen makes any stipulation that the >payment is "one person, one vote." That's because my hypothetical was intended to reflect a very non-AP situation, although maintaining the assassination/resignation angle. The issue was whether people would see political assassination as being desirable or undesirable. Conventional wisdom is that it's undesirable. On the contrary, I speculated that to a great extent, the desirability of it depends somewhat on who is getting killed (or forced to resign) but also whether or not the average citizen has a say in selecting the target.* Unlike AP, which seems (to a few people, at least; not me!) to have a problem that "any" arbitrarily small number of people could buy a hit, the hypothetical alternative I presented at least requires a million people to agree. If we assume there are 180 million adults in the US, for example, and assuming that the votes are limited to adults, letting 1 million people make such a decision is somewhat akin to giving 0.6% of the population veto power over the rest's attempts to manipulate (regulate, tax, etc) them. This isn't as good, in my opinion, as "pure" AP, but it would be far better than what we have now. I contend, but I can't prove, that if you give the ordinary citizen a say in the matter, and also if you ensure that the target always has the option of resignation, at that point this could turn into a very popular system that is seen as being the norm. There would be little sympathy for politicians who resist; just as there is little sympathy now for a politician who, despite losing the election, barricades himself in his office and refuses to turn over power to the winner. "It's just not done!" * A few years ago, I recall reading a study where test subjects were asking to individually perform some task requiring thought and concentration, but were exposed to loud irritating music. One half of the subjects had no control over the music, the other half could turn it off if they wanted to. It turned out that merely having control over the music made people feel better about the situation, EVEN IF they _didn't_ choose to exercise that control by turning the music off! If this effect worked in the political arena, the ability to bump off (or force to resign) an official would make people feel better about the government, even in situations where they didn't exercise this option. This might make you think that nothing might happen, until you realize that the officialdom will have to adjust to the new reality as well, and they'll just have to (in this hypothetical) get used to the fact that one million people could bounce them out on their collective asses...or worse. Jim Bell jimbell(a)pacifier.com

1 0

Leagal Deffinition of Encryption?
by William H. Geiger III 17 Dec '03

17 Dec '03

Is there any law(s) that actully define encryption? At it's very basics encryption is taking a group of 1's & 0's converting them into a different group of 1's & 0's and providing a mecanisim to change them back to the original group of 1's & 0's. >From a legal standpoitnt how is PGP any different than PKZIP? How does the law make a diference between an "encryption" program and a "compression" program other than the fact that the encryption program is advertized as encryption and the compression program is advertized as compression? -- ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting WebExplorer & Java Enhanced!!! Cooking With Warp 4.0 Author of PGPMR2 - PGP Front End for MR/2 Ice Look for MR/2 Tips & Rexx Scripts Get Work Place Shell for Windows!! PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info ----------------------------------------------------------- *MR/2 ICE: Rumour: NT means Not Tested

1 0

Re: The final version of the NRC crypto report is now...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Re: The final version of the NRC crypto report is now available! The Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) is pleased to announce the availability of its cryptography policy study "Cryptography's Role in Securing the Information Society". This report was originally released in pre-publication form on May 30, 1996. The final printed version of this report can be obtained from the National Academy Press, 1-800-624-6242 or Web site http://www.nap.edu/bookstore. The pre-publication version and the final printed copy differ in that the printed copy contains an index and many source documents relevant to the crypto policy debate; of course, editorial corrections have been made as well. An unoffical ASCII version of the prepublication report can be found at http://pwp.usa.pipeline.com/~jya/nrcindex.htm; the official NRC version should become available online in ASCII form in December. In addition, CSTB has been conducting briefings on this report at various sites around the country; if you would like to arrange a briefing in your area, please let us know (cstb(a)nas.edu, 202-334-2605).

1 0

Re: Blocking addresses by default
by Sean Roach 17 Dec '03

17 Dec '03

At 03:25 PM 11/7/96 -0500, you wrote: >Mark M. wrote: >> >> >> With remailer abuse becoming more popular and remailers going down >> because of complaints, there seems to be some interest in remailer >> software that will block all email by default and will only pass >> along email that is explicitly unblocked. >I think this threatens serious security problems for the remailer >network in two ways: > >1. You'd create a list of people interested in anonymous information, > which could potentially be obtained by police or other armed thugs. > However, those armed thugs would come up with a bunch of public keys with no names attached. These keys could be used to check that "person X's" e-mail was h[er,is] own but never know who was attached to that signature. Also, complaints could use that signature to close down the account, so that "person X" could no longer send. Of course, this would not prevent that individual from resubscribing, (what would, if you figure that out, apply it to Dr. Vulis), it would allow for the remailer to be used without the fear of the government confiscating the names of the individuals. The only thing I can think of that I don't have a solution for, note this is just what I've thought of, is the sting, where the government would take over the remailer and let it continue to operate, but logging the return posts. This could work simply for mailing lists, such as this one, where the sender could verify that the message got there in person, and receive h[er,is] responses straight from the same list. For private mail, the person would have to submit to being a part of a group of approximately 100 others, with all of the posts put in a newsgroup which would be downloaded in mass. Anyone watching for downloads would only see that the person was one of one-hundred who might have made that post. All of the posts could be encrypted with the key in plaintext for easy filtering. No need to attempt to decipher everyone's mail just to see what was for you. This would be akin to stopping by a bullitan board in a hospital to find out what the test results were. Anyone could see that you were there, but they wouldn't even know what type of test you were in for, be it a blood-sugar test, a chemical analysis, an X-ray or veneral-desease test. All they would be able to tell was that you're patient number was on that wall somewhere. Persons wanting more security could download the entire contents of several newsgroups straight to the screen while they were going to the fridge for a soda. Akin to visiting several bulletin boards to cover which post you were at. Granted, the second idea is less secure than the mailing list one, but could be made to work. In the hospital, you could send a friend in for the check, on the net, you could have a daemon remail the newsgroups for you and then self destruct. You could always keep a copy of the daemon on your hard drive, and use multiple telnet sites to do the job.

1 0

Kozinski's responses
by tien＠well.com 17 Dec '03

17 Dec '03

Here is my on what Judge Kozinski wrote: > > a. You have anonymous snail-mail and telephone calls--why > not e-mail? The truth is, anonymous snail-mail and > telephone calls are also an invasion of privacy, but there > is not much we can do about them. 1. But do anonymous snail-mail or phone calls invade privacy? Is an anonymous phone call an invasion of privacy in a way that an ordinary phone call is not? Is anonymous snail-mail more invasive of privacy than ordinary junk snail-mail? Is it the anonymity that is objectionable? Many people object to spam even when they know who it's from. It's certainly reasonable to define privacy as including an interest in disattention or not being drawn into communication. But isn't that interest implicated every time someone calls you? And not just when the caller has ID blocking, or doesn't tell you who he or she is? Normally, when I make a phone call, I don't identify myself. If I'm asked, who is this, then we have a decision point. Until I do, isn't the call anonymous? Once I do, it's not - any more - but it was until then. Put slightly differently, in daily life we interact with those we know little about, and we learn more (usually) as the interaction unfolds. Interaction is sequential, involves turn-taking; trust is built, not warranted at the outset. So what is distinctly privacy-invasive in being anonymous? >Someone asked whether I > objected to getting anonymous snail mail if it was not > threatening. The answer is YES, just like getting an > anonymous phone call is objectionable. When the person who > communicates with you insists on retaining anonymity, there > is always an implicit threat--they know who you are, but you > don't--you feel vulnerable, you doubt their motives, you > have difficulty knowing whether to trust their > representations. Anonymous complaints against co-workers > and supervisors was a standard way to get people into big > trouble in Communist Romania when I was growing up. The thrust of his comment seems to be (a) that when the caller is anonymous, there is an imbalance: you know less than the caller. You interact on an unequal footing. This may well be, as he puts it, "objectionable"; but the appeal is to some norm of informational reciprocity, of fair disclosure. What I don't get is how that is a violation of *privacy.* Does "being named" dispel the objectionable quality of the interaction? Don't we often interact with people whom we hardly know? It seems neither necessary nor sufficient. I can feel vulnerable, doubt motives, etc., even when I know someone's name. Isn't he really talking about reputation? To what extent does nymity (I just coined this as the opposite of anonymity) matter? Name may permit you to assess reputation later, but may be of little use at the time.Is that a privacy issue? Does Kozinski assume (b) that the anonymous are more dangerous, that anonymity maps to unaccountability, and unaccountability maps to higher likelihood of threat. Even if that's true, is that a matter of privacy? 2. As for anonymous snail-mail, consider that an anonymous envelope isn't necessarily an anonymous letter. The anonymity is relative to what's exposed. Map that onto e-mail. Isn't that equivalent to anonymizing the header and encrypting the message itself? That the header doesn't reveal sender identity doesn't entail that the message is itself anonymous. The anonymity may merely be against third parties. Kozinski himself says: > 2. I also agree that it should be possible to have mutually > agreed-upon anonymity--i.e. I write to you and you write to > me and we both know who we are, but nobody else does. No > problema--it's nobody else's business. > So from that POV, wouldn't a ban on anonymous remailers, to the extent that they don't preclude nymity w/i the message body, reach too far? Blatant self-promotion: BTW, I recently published an article on anonymity and the McIntyre case in the Oregon Law Review. 75 Or.L.Rev. 117 (1996). Lee

1 0