December 2003 - cypherpunks-legacy

Anonymous hate mail from John Gilmore, his friends, and lovers
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

More shit from some "cypher punk" asshole: >Received: (from daemon@localhost) by abraham.cs.berkeley.edu (8.7.5/local) id RAA17454 for dlv(a)bwalk.dm.com; Mon, 16 Dec 1996 17:14:06 -0800 >Date: Mon, 16 Dec 1996 17:14:06 -0800 >Message-Id: <199612170114.RAA17454(a)cypherpunks.ca> >To: dlv(a)bwalk.dm.com >From: nobody(a)cypherpunks.ca (John Anonymous MacDonald, a remailer node) >Comments: There is _no way_ to determine the originator of this message. > If you wish to be blocked from receiving all mail from the remailer > network, send your request to the <remailer-operators(a)c2.org> > mailing list. The operator of this particular node can be > reached at <remailer-admin(a)cypherpunks.ca>. >References: <2Js2yD23w165w(a)bwalk.dm.com> > >Could you please stop wasting the time of cypherpunks with your stupid >vendettas? Your posts are consistently a stupid waste of time. "Cypher punks" have no life.

1 0

ElGamal
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Tim May is widely recognized on the net, because of his frequent vitriolic postings, as someone/thing ready to cut off his own penis to spite the testicles, although his friends recognize him better from the rear. __o _ \<_ Tim May (_)/(_)

1 0

RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !!
by Walt Armour 17 Dec '03

17 Dec '03

Security through obscurity is no security at all. As for PnC (actually, the scCryptoEngine beneath it), we get the 40 bits from the 56 bits by nulling out the high nybble of every other byte. walt ---------- From: Peter Trei[SMTP:trei@process.com] Sent: Monday, December 16, 1996 2:02 AM To: walt(a)blarg.net; cypherpunks(a)toad.com Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > From: Walt Armour <walt(a)blarg.net> > To: "'Matthew Ghio'" <ghio(a)myriad.alias.net> > Cc: "cypherpunks(a)toad.com" <cypherpunks(a)toad.com> > Subject: RE: !! Point 'n Crypt -- Win95 Privacy for Everyone !! > Date: Fri, 13 Dec 1996 22:30:23 -0800 > There is no arguing that 40 bits is strong security. I agree with that. [...] Would you mind telling us just how you expand the 40 key to the 56 bits needed for DES? (Security through obscurity has a bad rep on this list). For many methods of doing so, 40bit DES is NOT secure against a motivated individual's attack. Peter Trei trei(a)process.com

1 0

Re: ASM vs portable code [WAS: Re: Java DES breaker?]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sat, 14 Dec 1996 21:28:46 -0800, Dale Thorn wrote: >> Averaging several runs: >> "C": 102,300 crypts/sec >> ASM: 238,000 crypts/sec >Someone on this list should know if it is possible to maximize speed in >a typical 'C' routine, using Register variables (particularly for loops), >inlining everything possible, etc., to get executable code much closer >than a factor of 2x difference. Can it be done on a PC, and how hard >would it be to explain, to cover a representative variety of techniques? A good optimizing compiler comes _close_ to hand coded, especially with the many new concerns on Pentium+ processors (pipeline optimization, fpu tricks, etc). # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

Jim McCoy wrote: > The other problem is that the proposed Authenticode system and other "signed > applet" systems only provide accountability after the fact. This is little > help when your hard drive is toast and the only proof you had was a logfile > which was the first thing erased... No, it's not really the accountability that's the issue. It's the ability to choose before the fact that I 'trust' the software's author. > The illusion that only "trusted software > puslishers" will be given blanket authorization is a pipe dream: users are > sheep who will hit that "OK" dialog box as many times as necessary to get the > tasty treat they are anticipating (and there is actual experimental evidence > to back this up :) Yup, point well taken. <story user=clueless>I popped into an empty users cube last week to borrow the phone. On the monitor was a post-it note from one of his co-workers that read, 'Please write your password here:' and of course the helpful fellow had done just that.</story> With real users I suspect only centrally administered security decisions that they can't override will be effective. Hmm... wonder what I can retrofit into IE to accomplish that. > I expect that the first post-Authenticode ActiveX virus > will be one to modify the signature checking routines or add additional keys > to the registry which makes the second round of the attack appear to be a > valid OS update from Microsoft. Shh... we have enough kool dewds floating around here looking for ideas. > The state of the art was up to it quite a while ago. Check out KeyKOS and > other OSes which use capability semantics for access control. I agree 100%. The intent of my comments was that such security *is* possible, but it's not available in widely deployed mass-market OS's. I'd love to hear feedback to the contrary, but it seems to me that it's extremely difficult to layer that type of security onto an existing system. -Blake (who's thinking about putting crazy glue into one user's floppy drive)

3 2

Hard to Tax Scenario
by Hal Finney 17 Dec '03

17 Dec '03

Robin Hanson, inventor of the Idea Futures prediction market, is a very creative and thoughtful writer who has posted to this list occasionally. He says he sent the message below to the CP list over the weekend, but I didn't see it. I am including it (in bits and pieces) in its entirety for the benefit of others who may also have missed it. Robin Hanson, <hanson(a)hss.caltech.edu>, writes: > Hi. The volume here is too high for me to subscribe regularly, but I > subscribed recently so I could ask the following question: > > How well thought out is the notion that widespread crypto could > allow a large fraction (>30%?) of the economy to avoid taxation? > > I've heard this speculation many times, and just saw it in print in, > in David Friedman's article in the summer '96 issue of Social > Philosophy and Policy. But I have trouble imagining how it could > work. For those who don't know, by the way, David Friedman is the son of Nobel prize winning economist Milton Friedman. Both father and son have libertarian leanings, and David in particular has tackled some of the hardest problems which would be faced by an anarchic society. > Imagine Ann is a doctor who wants to ply her trade without taxation. > Patients go a local high res medical net booth, which Ann runs from > long distance using several real time digital mixes. To do this, Ann > spends most of each day in her expensive home VR room. So we are imagining a future scenario in which medicine is commonly if not universally practiced via these remote means? Or do we have two classes of doctor, the anonymous virtual ones and the identified ones that you go and see in person? I ask because at least some of the difficulties Ann faces seem due to her virtual practice. > Patients pay Ann in untraceable cash, which she uses to pay for > groceries and other net services. Her cover story about why she > spends so much time in her home VR room, and how she pays for > groceries, is that she is a receptionist for some sham company. The need for a cover story raises the question of from whom Ann has to keep her secrets. In a society where (we will stipulate) 30% avoid taxation, the moral significance of not paying taxes will be different than it is today. We had some interesting posts in an earlier discussion on this list describing the situation in Italy, where apparently tax avoidance is raised to a higher degree than in the U.S. It sounded like it has the approximate moral status that speeding does here, a minor infraction which almost everyone does some if not all of the time. In some sub-cultures no doubt the tax avoidance rate would be even higher. In such a society Ann may not have to care that much about keeping her secrets, as long as she doesn't have too high a profile at tax time. > Ann has many collegues which she does business with regularly, > including equipment suppliers, a pharmacist, a nurse practitioner, > emergency substitutes, and various specialists. Ann has never met any > of these people in person, and they all show each other fake faces, > voices, and even rythms of walking and speaking. Ann's social life > outside VR is entirely divorced from her work life. Well, that last part is true for me already; I telecommute to a company 300 miles away and have no social life with my co-workers. For that matter my wife and I have practiced cocooning for several years, and I haven't had a close friend from work since the early 1980's. Being married makes this easier, of course. The other part of this scenario, where Ann interacts with her co-workers via fake faces, does seem disturbing. I could imagine, though, that this might be common in such a culture. Maybe everyone pretties themselves up when on the videophone. If there is widespread understanding that most faces are at least somewhat false, then perhaps going all the way to a completely faked up face would seem more acceptable. But to someone from my generation it will be hard to accept. > To convince patients to trust her, Ann gets bonded by a certification > service. To obtain this certification, Ann must be careful to not > refer to any people who know her "true name", such as her teachers at > the physical school she physically attended. And Ann must somehow > assure the certification service that she will not resell the > certification, allowing others to pretend that they are her. It is possible that we might see a more performance-based certification rather than a recommendation based one. My wife is a physical therapist, and she had to pass a licensure exam given by the state which qualifies her to practice. In an earlier message to me Robin pointed out the crucial role played by recommendations in hiring decisions. Certainly I would be much more likely to hire someone who listed his previous jobs and for whom I could get good recommendations by his earlier supervisors than an applicant who insisted that this information was confidential. Robin also suggested that there could be a selection effect, so that the doctors from good schools with good grades would use these advantages to maximize their income, and so the only anonymous ones would be the ones who didn't have these qualifications. This could lead to a situation where most anonymous service providers were assumed to be inferior to regular ones, so they would get less money even if they were actually just as good. (I apologize to Robin if I missed the point of his earlier discussion or am presenting it incorrectly.) Even with such disadvantages, a doctor like Ann might accept a lower fee at first while she builds up her reputation as an anonymous doctor with talent and ability. After a few years she could hope to have overcome the stigma which (we will suppose) anonymous doctors face and display some strong recommendations based on her successes. In the long run this could be a winning strategy due to the tax savings. (I haven't given the problem of reselling certificates enough thought to discuss it in any detail. There have been some discussions of "is a person" credentials which could apply, but that opens up a big can of worms.) > If Ann ever slips up, revealing her true name to a virtual associate, > failing to convince a physical associate of her sham employment, > or if anyone ever breaks through her realtime digital mixes, Ann > is open to expensive blackmail, she may have to start over with a > new virtual persona, and may have to go to jail for a long time. This is an interesting problem which I haven't seen discussed before in this form. In Vinge's original "True Names" people were afraid of harrassment and physical threats if their identity were discovered, but Robin's example of the danger of being exposed as a tax evader could be very bad as well. If there is this much tax avoidance, we might assume that tax rates are high, and penalties for tax evasion are high as well. On the other hand, if tax evasion is nearly universally practiced, perhaps there are strong cultural pressures against turning someone in. There is also the question of how good the technology is for anonymous communication. At best it would appear to require a widespread infra- structure, and if this is used largely for tax evasion it is hard to see how it could survive. So I think this would be a very significant issue to be faced by the prospective 'nym. > It seems to me that Ann is paying a high price for an ability to > avoid taxation, and at current tax rates it is hard for me to believe > that she wouldn't just rather pay the taxes. What am I missing? > > Robin D. Hanson hanson(a)hss.caltech.edu http://hss.caltech.edu/~hanson/ It is hard to judge how high the various prices are that she pays. The socialization aspect may not be important if she has friends outside work. The risks of being caught will depend on factors we don't know, like the technology and legal system. Rather than assuming that tax rates are the same, it might be more plausible to assume they have gone up in order to keep revenues stable. Another problem which Robin didn't mention is the issue of insurance payments. It is hard to see how Ann's patients can get reimbursed for their expenses if we assume that Ann is in effect a "black market" doctor. This problem may be somewhat specific to the medical scenario, but I suspect that many other professions are going to have trouble switching to a cash basis. Anyone whose customers are businesses, for example, will face the problem that the businesses' books will need to show that an expense is justified in order to deduct it. This will be a major problem for the "anonymous firm" we have discussed occasionally. One difficulty I find with this scenario is its science fictional nature. It is hard for me to consider details about the life of a doctor who works via VR. Also, if we are already in a situation where 30% of people are avoiding taxes there will certainly have been major changes in society, but I don't know what they will be. This makes it hard for me to focus on the issues specific to Ann's anonymity. However I do like Robin's choice of a concrete and vivid example like this. Hal

3 2

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

This thread branch seems to be based on bad assumption. Why would one want to run ActiveX controls in a sandbox? If you need a sandbox, use a Java applet, if you need native code level access to the system use ActiveX. Running code in a sandbox, a la Java applets, is one approach to allowing safe execution of downloaded code. If one has a perfect implementation of the sandbox, which doesn't appear to be the case for Java thus far, this can be a useful solution. There is however a severe limit to the types of applications you can run from inside a sandbox unless you subscribe completely to the 'Network Computer'-type model. Digitally signed code, a la ActiveX, is another approach to the same problem. If the digital signatures and infrastructure around them are sound, which they appear to be for ActiveX, this is also a useful solution. The built-in gotcha with this model is the all or nothing nature, either I trust the software publisher to run arbitrary native code on my machine or I don't run it at all. Specify technical issues follow: > It can be done under 95 but Microsoft will have to write a Sandbox > Virtual Machine (a Virtual x86 session whose API's are filtered to > prevent access to certain things like the file system, and disables > direct I/O.) Not that easy under '95, but it already exists for NT. But of course it's not enough to filter out filesystem calls. The entire windowing system would have to be separated as well. For example a rogue control might watching all edit controls for ones that have the ES_PASSWORD style and grabbing the contents. An equivalent Unix problem would be to allow an open-access guest account with the ability to transfer in and execute arbitrary binaries. While doing this securely may be possible in theory I don't think the state of the art is up to it today. (I sure wouldn't allow it on my system.) > The problem is how to deal with DLL's. You don't know all > features/functions of all DLL's. It may be possible to write a DLL that > runs outside the sandbox and can act as a proxy to the file system, so > it's iffy unless you limit the DLL's and services that ActiveX apps talk > to, and make them all live inside the sandbox. DLL's are by definition mapped into the processes address space, they would have to be inside the sandbox too. It's not a call gate type of thing. regards, -Blake

4 3

RE: The Ebonic Plague
by John Young 17 Dec '03

17 Dec '03

From: Timothy C. May Democracy has run amok in this country. There is no hope for reforming at the ballot box, as democracy only makes things worse. Only a crypto reign of terror can purge this land of the scum. ...................................................... From: Blanc Just how would this take shape in "real life" - what would constitute this reign of terror; how do you envision such an event in action? And which are the scum who would be purged? ...................................................... Follow precedents of the anarchist tradition: Name a target, build a bomb, light a fuse, heave it, run like hell -- into manacles of the provocateur's payers, then to gallows. Wait a generation, repeat.

1 0

Re: Privtool 0.87
by Alex de Joode 17 Dec '03

17 Dec '03

Mark Grant sez: : I've finally released a new version of Privtool -- my PGP-aware X-windows : mailreader for Linux, SunOS, FreeBSD and Solaris. Version 0.86 is : available on utopia.hacktic.nl in the incoming directory (and possibly : elsewhere) and I'll be uploading 0.87 shortly. For more details and : screenshots see http://www.c2.org/~mark/privtool/privtool.html. : Mark It is available from: (utopia.hacktic.nl = ftp.replay.com) ftp.replay.com/pub/replay/pub/pgp/utils/privtool/ ftp.replay.com/pub/replay/pub/pgp/utils/pgptools/ bEST Regards, -- Alex de Joode http://www.replay.com/people/adejoode I have a linux emulator for Win95: it's called "loadlin" ... *g*

1 0

Off topic litter on Cyperpunks
by Lurker 17 Dec '03

17 Dec '03

What has happened to cypherpunks? I joined this mailing list more recently than many others who recieve it, but most reacently it has gone downhill. The descriptions I have read (and I have read many) all state that this list is deadicated to the discussion of cryptography issues. Where the hell is the discussion about cryptography? Three fourths of the messages I have been recieving are off topic (Ebonics and "Slaughter"). If I wanted to read about current events and holocost I would have joined groups that were specified for discussion of those.

4 3