December 2003 - cypherpunks-legacy

Re: Censorship on cypherpunks [RANT]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Mon, 04 Nov 1996 07:20:15 -0800, Dale Thorn wrote: >> > I'm quite upset about this. Up to now I was able to tell >> >people that "there is at least one mailing list on the net that >> >functions in a completely open manner". No more. >> This has been taken far too seriously. Cypherpunks is a *PRIVATE* list. >> There is no obligation to accept anyone. >Isn't this the same argument used by the state whenever they want to differentiate >between your "rights" and your "privileges"? Can they reject one of your privileges >whenever they want to, at their discretion? No. >So if c-punks is really "private", how does it decide (arbitrarily?) who to include >and who to reject? It's a big difference. Can you set up your own mailing list? Yes. Can you go elsewhere? Yes. Can Mr. Vulis send email directly to list-members anyway? Yes. Can you do the same if the government runs it? No. Can you set up your own list/printing press* if the state won't publish your ideas? No. One could apply a similar rationale to socialism - after all, it may seem like an extension of "love your neighbor" to take care of their needs, which is certainly a laudable goal. That's not the problem. The problem is when it becomes mandated *with no alternatives*. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

[NOISE]Re: Dr. Vulis; John was right!
by Derek Bell 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm not happy with the barring of Vulis from the list: sure he was a kook and he posted many ad-hominem messages*, but I feel a mini-FAQ would deal with the matter better. Explain the background to his tantrums** and explain how to filter out messages with various mail packages. * I think Vulis was really unfair to Tim May, even though I find myself disagreeing strongly with what Tim has to say on some matters. At least Tim has posted interesting, thought-provoking, crypto-related material. ** Ok, so `tantrums' is an understatement... Derek Bell PGP key available at: http://www.maths.tcd.ie/~dbell/key.asc -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQCVAgUBMnywVFXdSMogwMcZAQEi2QQAhMWJWTz1RtBvyiYHAyzfkSSxZ+8U8rq7 xF3JD4s78rMcDcfzY0Q/5XRnPTCH/M6YI54cA/EpAEYys0Ws0VWgJoMxdBcbhitI 1zbFdUQJqzrKLlvP/n6KN2jImQeHqYUeSgsnoNgfn4Uo9KpBtxbUjKwEmco9VV8y fxoVHAYPTsg= =yk8t -----END PGP SIGNATURE-----

3 2

Re: Compromise proposal
by Dave Hayes 17 Dec '03

17 Dec '03

> [this goes to cypherpunks(a)toad.com and freedom-knights(a)jetcafe.org. I am > not reading f-k, but I am interested in Dave Hayes's opinion.] What weight can my opinion possibly have? This list is apparently owned by a Mr. John Gilmore. If he's being censorous, that's bad, but it is apparently within his means to execute said censorship. > Many members of cypherpunks list are right when they oppose the forced > unsubscription of Dimitri Vulis from this list. The sorry state of this > list is not the result of his flames alone, there is a large number of > people who discuss things of no cryptographic relevance. Not to speak for the cypherpunks (we all know their reputation) but I should think the cypherpunks are savvy enough to know the subjectivity of the term "on-topic". > I propose the following: > 1) The block on Dimitri Vulis's subscriptions should be removed > 2) We should not impose any limitations on anyone's speech except 3) > 3) Dimitri and everyone else should put prefix "[FLAME]" > into all Subject: header fields of their flame-related > messages. Gee. What a great idea. > This solution will allow anyone with a clue to use appropriate filtering > and improve the signal-noise ratio, and at the same time will not in any > way limit anyone's freedom of speech. Improving signal to noise is a laughable goal at a social event of more than 100 people, why do people insist upon trying it on the net? ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Be wary of strong drink. It can make you shoot at tax collectors and miss

2 1

NRC crypto breifing
by Decius 17 Dec '03

17 Dec '03

"Did the NRC discuss the State Department's GROSS FAILURE to prosecute Phil Zimmermann? (PGP) is military strength, and it's out there!" -- Audience member at NRC crypto briefing Dr. Herb Lin <hlin(a)nas.edu> of the National Research Council's Computer Science and Tecommunications Board gave a briefing this afternoon to address the Council's recent report, Cryptography's Role in Securing the Information Society. The briefing was sponsored by the Georgia Institute of Technology in Atlanta. One of the most striking aspects of the briefing was the diversity of perspectives on the issue. Most of our discussions on cryptography have been with people in the cypherpunk community; this was the first time we had ever come face to face with people on the other side of the fence. It is quite obvious that there is much emotional intensity here and we do not feel that this issue is going to go away soon. However, the NRC seems to be a voice of reason. We are faced a policy problem: the developing information society is vulnerable to security threats. Cryptography can be a powerful tool to thwart these threats, but it is also a dangerous weapon in the hands of criminals. As a result of concentration on the above issues, the cryptography debate has often been framed as a conflict between privacy rights and law enforcement. The NRC feels that the current policy on cryptography discourages its use by the private sector. Lin states that cryptography is a very valuable tool for crime prevention and thus benefits Law Enforcement. Policy makers should promote cryptography because it can help legitimate businesses better secure themselves against would-be attackers. However, cryptography also assists criminals in circumventing surveillance. So there are both positive and negative impacts for Law Enforcement, but Dr. Lin notes an important statement made in the NRC report: "The benefits of the widespread use of cryptography far outweigh the risks." Dr. Lin and the NRC believe that there will be an explosion of interest in computer security in the coming years, and that government should provide guidance and technical input, both to industry and law enforcement. The upcoming debate can (and should) be carried out on an unclassified basis. He said that open standards should be promoted in an effort to reach consensus between government and industry interests. Interested parties should be encouraged to study and understand the algorithms employed by their cryptosystems so that market forces may drive crypto policy to that which best fulfills the needs of US industry. NRC promotes the growth and leadership in the private sector and encourages all organizations to invest in information security. In addition, the NRC supports the use of link-level encryption in public networks, especially the cellular network. In this mode, LEOs can still access plaintext, but it is much more difficult for unauthorized listeners to get it. It should be noted that Cryptography is just one part of a comprehensive information security program. While it is useful to prevent eavesdropping, provide user authentication, and ensure data integrity, it is not particularly effective in overcoming the problems of insecure operating systems, and corruptible employees. One of the more controversial points in the report is the recommendation for domestic cryptography policy. The NRC recommends that no restrictions be placed on the use of domestic cryptography, and that the market should be allowed to choose the best systems. This was met with incredulty by many members of the audience, particularly those representing the government. They seemed to feel that "the people" should not be allowed to make this decision and that many important aspects of cryptography policy are not necessarily reflected in market interests. While NRC recognizes Law Enforcement's growing problem in adapting to new technologies, Dr. Lin said that the FBI could provide not one example of a class three wiretap that had been thwarted by means of encryption. Access to encrypted files seemed to be a bigger issue for LEOs. This takes us naturally to the topic of key escrow. NRC cautions that key escrow is an unproven technology. Of particular concern is the integrity of escrow agents: how it is to be evaluated, and what level of integrity is sufficient in any particular instance? Who is liable if keys are incorrectly disclosed? What are the liability issues if the key escrow system fails to provide LEOs with access? There just isn't enough information at this time to make these judgments. Many audience members commented that the administration had rushed into key escrow without forethought or open discourse. The NRC discourages the hurried passage of new legislation without clear, thorough discussion of the issues involved by those who will be most directly affected by the law. Furthermore, any government supported cryptography system must provide additional value to the end users. The Clipper system does not do this. Dr. Lin mentioned that data recovery might be of significant value to most users. If encryption systems are too strong then users will have a bigger problem with lost keys than they ever had with stolen intellectual property. The NRC recommends that the US government act as a test market for key recovery rather than pushing it out to the public before it is fully developed. The NRC also recommends that Congress consider criminalizing the criminal use of cryptography. This issue has already been discussed at length in academic fora, and the general consensus is that this concept is much easier said than done. We feel that such a policy is not likely to be a serious deterrent unless the additional penalty outweighs the benefits of secure crypto. It is also worth noting that if crypto is the default in system people shouldn't be charged with additional crimes for not turning it off. As for export issues, the NRC recommends that the government allow export of 56-bit DES without special approval, effective immediately. The recommendation also suggested that the allowable key length should be increased over time in order to keep up with improvements in cryptanalysis and computing power. They feel that export controls should be lessened but not fully removed. Law Enforcement needs time to develop the skills and technology necessary to deal with new situations. We would take issue with the NRC's assertion that 56 bit DES is "good enough for most commercial applications," and that algorithms be designed to preclude multiple encryption. It certainly depends on the threat model involved. DES would be an improvement over plaintext networks, but it is certainly not strong enough to defend against industrial espionage efforts. We feel that strong cryptography should be exportable now to defend against such attacks. We feel that legitimate law enforcement interests can get access to the information they require in most cases without even having to employ cryptanalysis, especially if systems are secured at the link level as the NRC recommends. We would also point to the reality that wiretapping is not often used by Law Enforcement, and we don't feel that they have justified any increase in it's use. The NRC briefing was very helpful in understanding the meaning of the report and highlighted many important issues. NRC will have a number of briefings in major cities all over the US, in hopes that this will spark more debate over these issues. Attendance at this briefing was much smaller than we had expected. We would encourage anyone who is interested in cryptography to attend a future briefing. It is a very good opportunity to hear and meet people on all sides of this issue. We would also encourage the cyber-rights crowd to seriously consider the NRC's recommendations. It seems to be a realistic look at these issues, and there is plenty of room here to defend fundamental civil liberties. Tom Cross and Jeremy Mineweaser Electronic Frontiers Georgia

1 0

Protecting Your Data With Crypto
by John Young 17 Dec '03

17 Dec '03

We have put the November UNIX Review article Peter cited in his letter to the editor, "Protecting Your Data With Cryptography," at: http://jya.com/protect.htm ---------- Peter Allan wrote: > >[ I refer to the article starting on p55 > of the Nov 1996 Unix Review. ] > >-----letter to Ed start here------ > >Andrew, > >Congratulations on a welcome crypto article in UR. > >This is an important topic for security, networks, >web-based commerce etc and is only going to increase in >importance as people realise data is money. > >The article did raise my eyebrows a few times though >with some wild statements - about the speed of brute-force >attacks on DES, and about USG 'key escrow' proposals, >patents and key certification. > >Also there are absolutely crucial issues not touched on, >probably for lack of space. Details matter, and if you're >contemplating another article on the subject I'd be happy >to write it [subject to my boss' approval] or review it >before publication. The field moves fast at times, and >it would be good to keep an eye on the subject in a fairly >regular column. > >Strangely, your author didn't mention ftp.ox.ac.uk, >an ftp site for many good crypto tools, which >(as a UK site) is not subject to US export restrictions. > > > -- Peter Allan peter.allan(a)aeat.co.uk

1 0

Re: Censorship on cypherpunks
by Dave Hayes 17 Dec '03

17 Dec '03

Dimitri "Too Hot for Cypherpunks" Vulis writes: > Does saying "The list owner should not kick people off the list for speech" > violate the list owner's right to free speech? That depends on whether plug- > pulling (and mailbombing and ping-storming and other obnoxious behavior) > is speech. The entire, highly recursive question of free speech versus censorship relies almost entirely on the assumption that human beings can be controlled. The observation that certain behavior is obnoxious arises from an inability to control one's own environment at a basic level. Issues such as this have nothing to do with mailing lists or net.protocol, except as vehicles of expression for human conditioning which is already present. Until the fly can be tolerated, removing the shit will only serve to turn one's attention to a new annoyance. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet In a dark alley, a pickpocket tried to snatch Nasrudin's purse. There was a violent struggle, but eventually Nasrudin got the thief pinned on the ground. At this moment, a charitable woman passing called out: "You bully, let the little man up and give him a chance!" "Madam," panted Nasrudin, "you ignore the trouble which I have had getting him down."

1 0

Group order for "Secret Power" ... (San Francisco Bay Area only)
by Ernest Hua 17 Dec '03

17 Dec '03

I'm looking for 19 other people interested in "Secret Power" (Craig Potton Publishers has indicated that there is a discount for 20 or more copies). If you are in the San Francisco Bay Area, please contact me by phone or E-Mail. As usual with these things, I would prefer to see you in person and have a cash or check committed. Also remember that the shipping is quite steep (for the faster methods) ... The US price uses US$0.71 per NZ$1.00. US PRICE 1 Copy NZ$27.50 per copy US$19.53 NZ$19.00 for shipping via air US$13.49 NZ$12.50 for shipping via economy US$ 8.88 NZ$10.00 for shipping via sea US$ 7.10 20 Copies (per copy) NZ$24.75 per copy (10% discount) US$17.57 NZ$ 9.50 for shipping via air US$ 6.75 NZ$ 7.25 for shipping via economy US$ 5.15 NZ$ 5.90 for shipping via sea US$ 4.19 ---- Ernest Hua, Software Sanitation Engineer Chromatic Research, 615 Tasman Drive, Sunnyvale, CA 94089-1707 Phone: 408 752-9375, Fax: 408 752-9301, E-Mail: hua(a)chromatic.com

4 3

Censorship on cypherpunks
by Will French 17 Dec '03

17 Dec '03

Except it's not very effective, is it, since he's still posting flames? In any case, it's an admission on John Gilmore's part that libertarianism can't work without some measure of authoritarianism; the only argument is over _just how much_ authoritarianism we need. I'm quite upset about this. Up to now I was able to tell people that "there is at least one mailing list on the net that functions in a completely open manner". No more. Will French <wfrench(a)interport.net>

12 16

black high heal shoes?
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, I had the strangest dream this morning. I drempt that I had forgotton to vote! As I was heading for the poles, I saw Dole heading into the poles wearing a man's coal grey/black suit and womens' black high heal shoes. It was pretty bazzar.... I wonder what it means? It was pretty scary... Turns out I was too late getting to the poles to vote and I awoke in a panic thinking I had missed it all. I turned to my sleeping babe and after I awoke him, he assured me that voting happens tomorrow. Whew! -lile

2 1

Re: Dr. Vulis is not on cypherpunks any more
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> Well put! I tired a long time ago of Dr. Vulis and several others on this > list. Rather than bitch about it or resort to the same big brother > gestapo-censor bullshit we profess to abhor I simply utilized the extensive > filtering capability of Eudora. > > I don't need "big brother" or big "cypherpunk" censoring my mail for me. > We have become what we fear the most. How prophetic and pathetic. Absolutely, John, if you, and those who support your actions, claim to be libertarians you need to take a good hard look at what you have done. This is a distinctly "big cypherpunkish" move and really cannot be condoned even bearing in mind the inane and wearisome behaviour of Dr. Vulis. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

5 6