December 2003 - cypherpunks-legacy

Re: The final version of the NRC crypto report is now...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: Re: The final version of the NRC crypto report is now available! The Computer Science and Telecommunications Board (CSTB) of the National Research Council (NRC) is pleased to announce the availability of its cryptography policy study "Cryptography's Role in Securing the Information Society". This report was originally released in pre-publication form on May 30, 1996. The final printed version of this report can be obtained from the National Academy Press, 1-800-624-6242 or Web site http://www.nap.edu/bookstore. The pre-publication version and the final printed copy differ in that the printed copy contains an index and many source documents relevant to the crypto policy debate; of course, editorial corrections have been made as well. An unoffical ASCII version of the prepublication report can be found at http://pwp.usa.pipeline.com/~jya/nrcindex.htm; the official NRC version should become available online in ASCII form in December. In addition, CSTB has been conducting briefings on this report at various sites around the country; if you would like to arrange a briefing in your area, please let us know (cstb(a)nas.edu, 202-334-2605).

1 0

Re: Blocking addresses by default
by Sean Roach 17 Dec '03

17 Dec '03

At 03:25 PM 11/7/96 -0500, you wrote: >Mark M. wrote: >> >> >> With remailer abuse becoming more popular and remailers going down >> because of complaints, there seems to be some interest in remailer >> software that will block all email by default and will only pass >> along email that is explicitly unblocked. >I think this threatens serious security problems for the remailer >network in two ways: > >1. You'd create a list of people interested in anonymous information, > which could potentially be obtained by police or other armed thugs. > However, those armed thugs would come up with a bunch of public keys with no names attached. These keys could be used to check that "person X's" e-mail was h[er,is] own but never know who was attached to that signature. Also, complaints could use that signature to close down the account, so that "person X" could no longer send. Of course, this would not prevent that individual from resubscribing, (what would, if you figure that out, apply it to Dr. Vulis), it would allow for the remailer to be used without the fear of the government confiscating the names of the individuals. The only thing I can think of that I don't have a solution for, note this is just what I've thought of, is the sting, where the government would take over the remailer and let it continue to operate, but logging the return posts. This could work simply for mailing lists, such as this one, where the sender could verify that the message got there in person, and receive h[er,is] responses straight from the same list. For private mail, the person would have to submit to being a part of a group of approximately 100 others, with all of the posts put in a newsgroup which would be downloaded in mass. Anyone watching for downloads would only see that the person was one of one-hundred who might have made that post. All of the posts could be encrypted with the key in plaintext for easy filtering. No need to attempt to decipher everyone's mail just to see what was for you. This would be akin to stopping by a bullitan board in a hospital to find out what the test results were. Anyone could see that you were there, but they wouldn't even know what type of test you were in for, be it a blood-sugar test, a chemical analysis, an X-ray or veneral-desease test. All they would be able to tell was that you're patient number was on that wall somewhere. Persons wanting more security could download the entire contents of several newsgroups straight to the screen while they were going to the fridge for a soda. Akin to visiting several bulletin boards to cover which post you were at. Granted, the second idea is less secure than the mailing list one, but could be made to work. In the hospital, you could send a friend in for the check, on the net, you could have a daemon remail the newsgroups for you and then self destruct. You could always keep a copy of the daemon on your hard drive, and use multiple telnet sites to do the job.

1 0

Kozinski's responses
by tien＠well.com 17 Dec '03

17 Dec '03

Here is my on what Judge Kozinski wrote: > > a. You have anonymous snail-mail and telephone calls--why > not e-mail? The truth is, anonymous snail-mail and > telephone calls are also an invasion of privacy, but there > is not much we can do about them. 1. But do anonymous snail-mail or phone calls invade privacy? Is an anonymous phone call an invasion of privacy in a way that an ordinary phone call is not? Is anonymous snail-mail more invasive of privacy than ordinary junk snail-mail? Is it the anonymity that is objectionable? Many people object to spam even when they know who it's from. It's certainly reasonable to define privacy as including an interest in disattention or not being drawn into communication. But isn't that interest implicated every time someone calls you? And not just when the caller has ID blocking, or doesn't tell you who he or she is? Normally, when I make a phone call, I don't identify myself. If I'm asked, who is this, then we have a decision point. Until I do, isn't the call anonymous? Once I do, it's not - any more - but it was until then. Put slightly differently, in daily life we interact with those we know little about, and we learn more (usually) as the interaction unfolds. Interaction is sequential, involves turn-taking; trust is built, not warranted at the outset. So what is distinctly privacy-invasive in being anonymous? >Someone asked whether I > objected to getting anonymous snail mail if it was not > threatening. The answer is YES, just like getting an > anonymous phone call is objectionable. When the person who > communicates with you insists on retaining anonymity, there > is always an implicit threat--they know who you are, but you > don't--you feel vulnerable, you doubt their motives, you > have difficulty knowing whether to trust their > representations. Anonymous complaints against co-workers > and supervisors was a standard way to get people into big > trouble in Communist Romania when I was growing up. The thrust of his comment seems to be (a) that when the caller is anonymous, there is an imbalance: you know less than the caller. You interact on an unequal footing. This may well be, as he puts it, "objectionable"; but the appeal is to some norm of informational reciprocity, of fair disclosure. What I don't get is how that is a violation of *privacy.* Does "being named" dispel the objectionable quality of the interaction? Don't we often interact with people whom we hardly know? It seems neither necessary nor sufficient. I can feel vulnerable, doubt motives, etc., even when I know someone's name. Isn't he really talking about reputation? To what extent does nymity (I just coined this as the opposite of anonymity) matter? Name may permit you to assess reputation later, but may be of little use at the time.Is that a privacy issue? Does Kozinski assume (b) that the anonymous are more dangerous, that anonymity maps to unaccountability, and unaccountability maps to higher likelihood of threat. Even if that's true, is that a matter of privacy? 2. As for anonymous snail-mail, consider that an anonymous envelope isn't necessarily an anonymous letter. The anonymity is relative to what's exposed. Map that onto e-mail. Isn't that equivalent to anonymizing the header and encrypting the message itself? That the header doesn't reveal sender identity doesn't entail that the message is itself anonymous. The anonymity may merely be against third parties. Kozinski himself says: > 2. I also agree that it should be possible to have mutually > agreed-upon anonymity--i.e. I write to you and you write to > me and we both know who we are, but nobody else does. No > problema--it's nobody else's business. > So from that POV, wouldn't a ban on anonymous remailers, to the extent that they don't preclude nymity w/i the message body, reach too far? Blatant self-promotion: BTW, I recently published an article on anonymity and the McIntyre case in the Oregon Law Review. 75 Or.L.Rev. 117 (1996). Lee

1 0

Vulis on the remailers
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

Please, remailers, source block Vulis for a week. Remailer Fan

3 3

Re: Judge Patel Background
by jim bell 17 Dec '03

17 Dec '03

At 09:12 PM 11/7/96 -0800, Peter Hendrickson wrote: >Fred Korematsu was a Japanese-American shipyard worker in the >early 1940s. His fiancee was Caucasian. To stay with her, he evaded >the concentration camps for two months, but was caught and convicted >anyway. His conviction was not reversed until 1983 in the court of one >Judge Patel. > >Page 48, "After hearing lawyers on both sides, Judge Marilyn Patel >asked Fred Korematsu to address the court. `As long as my record >stands in federal court,' he quietly stated, `any American citizen >can be held in prison or concentration camps without a trial or >hearing.' Ruling from the bench, Judge Patel labeled the government's >position as `tantamount to a confession of error' and erased Fred's >conviction from the court's records." > >(Judge Patel is presiding over Dan Bernstein's challenge to the ITAR.) However, the fact that it took 40 years to reverse (and didn't, presumably, reverse the convictions of others, and didn't compensate people for lost property) is yet another reason to take a few pieces out of the hide of the SC, as well as a few pounds of flesh nearest the heart. Jim Bell jimbell(a)pacifier.com

1 0

Re: Why is cryptoanarchy irreversible?
by Matthew Ghio 17 Dec '03

17 Dec '03

Well, this is becoming a rather long thread, but I'll just make what I think are the key points: If, as is presumed in this discussion, society will become divided into two somewhat distinct groups of people, the crypto-anonymous group and the traceable-identifiable group, then the predictable outcome is that members of the traceable-identifiable group will become increasingly victimized by members of the crypto-anonymous group. People who are easily identifiable and tracked are easy prey. For example, if you can see when John Doe is logged in at home or logged in at his office, then you can burglarize his home while he is at the office and vice versa. If, as some government agencies would like, all motor vehicle records were online, a criminal could go 'shopping' on the internet, pick out the make and model he wants, look up the owner's address and go steal it. There are lots of other examples, such as seeing how much money is in various people's bank accounts, then target those who have money, etc... (Identifiable people are also likely to be targets of spam and other annoyances, and I suspect the proliferation of spam is encourgaing a great number of people to explore the possibilities for anonymous posting.) This situation is going to put an increasing amount of pressure on those in the traceable-identifiable group to change their ways. They will have two choices: either they start using crypto, remailers, etc to protect their privacy and protect themselves from criminals, or they can demand more identification and restrict their interactions with others such that they only associate with suitably identified persons. The net result of this is that it's easy (and economically desirable) for people in the 'traceable-identifiable' group to join the 'crypto-anonymous' group, but vary hard for anonymous personas to interact with the identified group. As such, the number of people demanding identification of their correspondents will decline. (Another way to look at it, is that crypto-anonymity is a high-entropy, and hence stable, situation, whereas tracable-identifiability is a low-entropy and metastable state, which spontaneously degrades into the former in the absense of a constraining force.) This is why cryptoanarchy is inevitable.

1 0

Re: [rant] Race
by Sean Roach 17 Dec '03

17 Dec '03

At 09:09 AM 11/8/96 -0800, Sandy Sandfort wrote: ... >of the doctrine of Political Correctness. My comment was not a >reference to race, but rather an allusion to an old joke, to wit: ... My apologies to you, Sandy Sandfort, I must admit that this is the first time that I have read this joke.

1 0

WebTV Article...
by Lile Elam 17 Dec '03

17 Dec '03

http://www.sjmercury.com/business/today/biz/007555.htm Web browser classified as weapon New York Times SAN FRANCISCO -- American couch potatoes have become empowered -- too empowered, in the eyes of the government. A $300 television-set-top device for browsing the World Wide Web, which Sony and Philips Electronics began selling recently at chains like Sears, Roebuck and Circuit City Stores, uses computer-security technology so powerful that the government is classifying it as a weapon that will require a special export license before it can be sold overseas. Few industry experts expect such a license to be granted, meaning the companies are unlikely to begin selling current versions of the U.S.-made devices next year in Europe and Japan, as they had planned. The appliances, designed to let consumers surf the Web and transmit e-mail via a standard television set and phone line, have suddenly become the most significant challenge to the Clinton administration's attempt to restrict the export of powerful data-scrambling devices by categorizing them as ``munitions'' requiring a special export license. While the set-top boxes are intended to protect the privacy of users and permit secure on-line sales transactions, administration officials fear such technology could be used by foreign terrorists or criminals to conspire with electronic impunity. ``We're the guinea pig,'' said Steve Perlman, chairman and chief executive of Web TV Networks Inc., designer of the units, which are being manufactured in the United States by Sony Electronics and Philips. ``Can you imagine carrying one of our boxes under your arm and getting arrested at the border?'' NYT-11-07-96 2217EST Posted: Fri Nov 8 05:05:01 PST 1996

1 0

Re: Blocking addresses by default
by Sean Roach 17 Dec '03

17 Dec '03

On Thu, 7 Nov 1996 15:25:07 -0500, Rich Graves wrote: ... > What's wrong with this scheme? Other than the fact that all remailers > would have to change their software at the exact same moment. :-) To which 04:15 PM 11/8/96 +1300, Paul Foley wrote: ... >This is not true, of course. Implement it in two stages. First >recognise and strip the disclaimer, but don't prepend one, then, when >all remailers are doing this, start prepending information. .. You could also maintain a list of remailers to suggest that DO have this feature, rig a random number generator to decide which of these the post should be sent to, up to the number specified, if the sender doesn't explicitly state which to send it to. Also, if you can strip it, and flag that it has been stripped, you can append a new one, but only to posts that you stripped them off of.

1 0

Re: Smart Bombs
by Marshall Clow 17 Dec '03

17 Dec '03

jbugden(a)smtplink.alis.ca wrote: >Smart Use for Smart Cards > >"UBIQ announced that its software has been selected by American Express to >personalize smart cards that will be issued ... for ticketless travel on >American Airlines. ... Airline travelers with these smart card holders will be >able to proceed directly to an airport gate, insert their smart card into a gate >reader, receive seat confirmation, and board the plane without touching a single >piece of paper. > Does this mean that you can fly without showing any identification? It sounds like it. What is to prevent my company from getting a half dozen of these cards, and when someone in the company needs to travel, loading a card with the travel info and giving it to the traveller? Note that (as far as the airline or FCC is concerned) there is no person <<-->> card mapping. Other scenarios: Will travel agents be able to issue these cards? How about airport ticket agencies? Will people be able to buy cards for cash? James wrote: >Of course, not having a card may subject you to greater scrutiny at check-in >time due to the reduced tracking ability. > I think that you have this backwards. There will be less tracking ability for people flying w/o tickets. -- Marshall Marshall Clow Aladdin Systems <mailto:mclow@mailhost2.csusm.edu> "We're not gonna take it/Never did and never will We're not gonna take it/Gonna break it, gonna shake it, let's forget it better still" -- The Who, "Tommy"

1 0