December 2003 - cypherpunks-legacy

Re: Last nail for US crypto export policy?
by Lucky Green 17 Dec '03

17 Dec '03

At 01:41 AM 1/30/97 -0800, Bill Stewart wrote: >I think we do need to get some sort of push going for 3DES as a >replacement for DES - it's strong enough, even though DES is showing >its age, and it's an obvious transition from the current technology. >It's slower and clunkier than IDEA or RC4/128, but still not bad. The migration to 3DES is underway, at least in the banking sector. ANSI X.9, the group that deals with many of the protocols used in the banking industry, has made tremendous progress. 3DES, elliptic curve, and a host of other improvements all are out of committee and should be available as official (for bankers :-) specs soon, if they aren't already. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

RE: Cellular phone triangulation
by Internaut 17 Dec '03

17 Dec '03

Snow wrote: I'd rather become an "arms dealer". You may already be one if the government keeps this ITAR shit up. --Internaut

1 0

Authenticated mail command processor
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Hi, I am wondering if anyone has written a package for remote command processing that has authentication and access control built in. I am looking for the following: 1) PGP Authentication of each incoming message 2) Access control where ability of users to execute commands is finely limited 3) Protection against replay and MITM attacks, encryption 4) Sending back of the results of execution 5) Some form of logging I need it for my cryptorobomoderator bot, to allow moderators to go to vacations and perform other admin tasks w/o logging in. Thank you. - Igor.

1 0

Re: Cats Out of Bags
by sameer 17 Dec '03

17 Dec '03

> > Remember, Aaron is employee of the government. He talks in doublespeak, Aaron is employee of the government. Therefore he must lie. -- Sameer Parekh Voice: 510-986-8770 President FAX: 510-986-8777 C2Net http://www.c2.net/ sameer(a)c2.net

1 0

Re: Last nail for US crypto export policy?
by Jeremiah A Blatz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- "Michael Froomkin - U.Miami School of Law" <froomkin(a)law.miami.edu> writes: <snip> > The above may have been dictated via Dragon Dictate 2.51 voice > recognition. Please be alert for unintentional word substitutions. Stego? Maybe 3 bits per substituted word? Good bye, uhnsufride, hello, "speech recognition." Jer "standing on top of the world/ never knew how you never could/ never knew why you never could live/ innocent life that everyone did" -Wormhole -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMvDlzMkz/YzIV3P5AQExTAL/d5/Bd7hrwi6zWAsHTm+W8j072sQVtVjx kkFbxf5oBYObYScT8h57PZlZcobumV3I8sjAguPVBeBC9uMIiKDd8H0xh5w0Ncr5 EcIsRwmpn/6rXutrUO1IUVTnepCJq6gn =iACw -----END PGP SIGNATURE-----

1 0

Re: Last nail for US crypto export policy?
by Lucky Green 17 Dec '03

17 Dec '03

At 01:41 AM 1/30/97 -0800, Bill Stewart wrote: >I think we do need to get some sort of push going for 3DES as a >replacement for DES - it's strong enough, even though DES is showing >its age, and it's an obvious transition from the current technology. >It's slower and clunkier than IDEA or RC4/128, but still not bad. The migration to 3DES is underway, at least in the banking sector. ANSI X.9, the group that deals with many of the protocols used in the banking industry, has made tremendous progress. 3DES, elliptic curve, and a host of other improvements all are out of committee and should be available as official (for bankers :-) specs soon, if they aren't already. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: Altavista
by Eric Murray 17 Dec '03

17 Dec '03

Leonid S Knyshov writes: [about targeted webvertising using stats gathered by tracking browsers] > I think it is a good idea, no wonder doubleclick.net is one of the > leaders in advertising. You are shown only the ads that will potentially > interest you, search for shopping and you are gonna get one of those ISN > ads etc. > > I think it is a good idea FWIW. > > I wouldn't think that a company such as doubleclick.net will do you any > harm. Probably not. But the practice still bothers me. _I_ want to control what information about me others can have. I do not want the precedent set that on the Net, what you do is trackable by every organization who might care. Sooner or later someone _would_ use that information to hurt me. That's why I wrote cookie jar, a program that lets the user have better control over which 'cookies' if any they release to web servers, and what other information their browser gives out. See http://www.lne.com/ericm/cookie_jar/ for details and code. > >Interestingly, I've just noticed over the last couple of days that the > >in-line > >ads are directly relevant to the search words I enter. I did a search > >yesterday > >on "Quicken" and "security" and all the in-line ads I was shown > >referred to > >security or penetration detection products. This doesn't bother me as much (besides the fucking ads, which I hate... maybe I'll make cookie jar smart enough to nuke them). The reason is that the ads are selected based on what you typed in to the search engine right then- there's no tracking involved like with Doubleclick. -- Eric Murray ericm(a)lne.com ericm(a)motorcycle.com http://www.lne.com/ericm PGP keyid:E03F65E5 fingerprint:50 B0 A2 4C 7D 86 FC 03 92 E8 AC E6 7E 27 29 AF

1 0

Re: Rejection policy of the Cypherpunks mailing list
by jim bell 17 Dec '03

17 Dec '03

At 09:05 PM 1/28/97 -0800, Dale Thorn wrote: >I dare say that the downside of this is much less pleasant than the >virtual anarchy (in the bad sense) we suffer now. If the police get >out of control, A.P. will arrive just in time to plug a few of those >holes, so to speak. Ideally, future robotics should be able to >provide something like Gort (sp?) to take the place of human officers, >given advances in the kind of pattern matching needed to deter >aggression and the like. Those who don't make it past the robots, >well, the rest of us can learn to behave, and we'll be much better >off when we do. Your comparison with the fictional Gort, in the movie "The day the earth stood still" is of course apt. It was only after I'd written most of the essay that I realized that an AP-type system would function much as Gort did. Occasionally we (CP) see a spoof where somebody claims to have developed a software program to "replace the judicial system" or something like that. Well, the problem with such a claim (aside from the obvious and enormous AI-type difficulties) is that the current system contains numerous biases. Writing a program to replace the legal system would presumably require that these biases be measured (and admitted-to!) and implemented into a well-defined system. What we'd discover is that the current system only barely resembles the guarantees in the US Constitution. At that point, there would be an argument between those who will insist that the Constitution be followed, and those who believe that the current de-facto system, however biased, be maintained as-is. Jim Bell jimbell(a)pacifier.com

1 0

Re: Workaround for filtering/cybersitter
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In <199701301527.HAA05667(a)toad.com>, on 01/30/97 at 11:53 AM, Pavel Korensky <pavelk(a)dator3.anet.cz> said: >Nice, but I can see one problem here. >If I (as a censor) will want to block your communication to prohibited sites, I can block >the access to the proxy computers. You will just move the blocking strategy one level up >with your plug-in. The censor will block the web servers AND proxy servers. Because the >list of proxy servers must be available somehow to users, it is very simple to write some >kind of script running on the gateway which is blocking the acccess. The script will >download the list of proxy servers, update the gateway tables and the gateway will be >blocking acccess to all sites on the proxy list. In addition to this I (as a censor) would make it Illegal to access, read, possess the information on these "blocked" sites. Add some keyword monitoring to the gateway along with logging. This will allow me to selectively go after those who try to circumvent my censoring attempts. I would also want to make the ISP's liable for their users accessing this info. That way I can intimidate them into doing all the work for me. (You can see this approach in several areas of US law enforcemant. Arrest bartenders for serving minors, arrest store clerks for selling cigaretts to minors, shut down of BBS for users posting "dirty pictures", going after ISP's for pirated software and other copyright infringments by their users.) Whenever I did decide to prosecute someone I would make it a big public show for everyone to see with very stiff penalties. After several of these trails the "sheep factor" will keep 99% of the population in line (US Crypto policy is a prime example). The point I am trying to make is that for the censor his set-up does not need to be that sophisticated as fear and intimidation will keep 99% of the rank-and-file in line. As for the other 1%, well they already know who they are and new laws will only help take care of that "problem". - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: OS/2: Your brain. Windows: Your brain on drugs. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Registered E-Secure v1.1 0000000 iQCVAwUBMvDsPI9Co1n+aLhhAQFWQgQAsdoDpHejDa46iU2JKtCUvvpI2ee4Ok5z kLkXDWZUc2AkDJpmLYIVkyPUOzz18vNkUiXYlRVnrKzgAgmL/cAydcuyrqfN9czH 1OuujOlJ2t/OwXsSePRptcfDL6XeCQXww5stlS7UXKosG9w0ZWHYOxHvvV9FjDBi UqjkQwFtSVI= =t8Dr -----END PGP SIGNATURE-----

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 01:16 PM 1/28/97 -0800, Sean Roach wrote: >At 10:47 PM 1/27/97 -0800, jim bell wrote: >>In the current political system, in the US for instance, 51% of the >>population is able to screw the remaining 49%, just as long as they can >>maintain the majority. Or, perhaps even more accurately and ominously, a >>tiny fraction of the population (the current leadership class) is able to >>screw the 49%, as long as they have the un-thinking backing of the remaining >>and relatively uninvolved 51%. >> >>AP disables this system. AP turns government into the moral equivalent of a >>pick-up football game: Nobody is being forced to play, and everybody and >>anybody can simply "get up and leave" whenever he wants to. The moment the >>"rules of the game" to make an individual's continued participation >>unsatisfying, he can leave. >> >... >In our society, which, if I remember correctly, 10% of the population >control 90% of the wealth, AP would only lead to 10% of the population being >able to screw the remaining 90%. At least as it is, it takes a simple majority. No, that doesn't work. AP does involve money, that's true, but what "the poor" lack in individual assets they make up for in numbers. And AP implements a sort of "mutual disarmament," by not only preventing that 10% from screwing the 90%, but also prevents the 90% from screwing the 10%. >As for the murder of the rich, here is a scenerio. > >A collection of poor pool their capitol to have a tyrant killed. >The tyrant assembles a counter-wager saying that anyone able to prove thier >ability to kill him without harming him, and who can show they got through >will get 110% of the poor's bid. Question: Where does he get the money for the reward? If he gets it through taxation, he'll anger the people who were taxed and they'll pay to see him die. If he got in through taxation in the past, enough people will STILL be angry enough with him to see him dead. His employees (the ones who probably have the most opportunity to kill him) would be made just about as wealthy by killing him as taking him up on his odd offer. Worse, for him, is that he'd lose money paying off those people if they showed they could have "succeeded." Even if they were not motivated to actually kill him, they'd be motived to SHOW they could kill him, and notice that they'll become just about as rich for KILLING him as merely showing they can! Notice that your idea also assumes that an employee has to become willing to, in effect, plot against his employer in such a way that he can be assured that his actions won't be incorrectly interpretated as a genuine assassination attempt. How can you (or anyone else?) tell the difference until the plan either succeeds or fails?) Moreover, how can the employee trust that his boss will actually honor his promise? I think you're also (falsely) assuming that a deliberately-unsuccessful assassination demonstration immunizes the tyrant from a repeat performance. True, it's often useful to know what kinds of attacks are possible, but that doesn't mean that the system can be fixed to prevent future repetitions... The tyrant, then, either loses his life or a lot of money, and he still can't trust anybody. Jim Bell jimbell(a)pacifier.com

1 0