December 2003 - cypherpunks-legacy

Here we go again
by stevenw＠best.com 17 Dec '03

17 Dec '03

Copyright 1996 Nando.net Copyright 1996 The Associated Press SEOUL, South Korea (Jun 15, 1996 00:41 a.m. EDT) -- For a Canadian university student, creating an Internet site on North Korea was simply opening a small library on the reclusive nation. For South Korean authorities, it was threat to national security. Last week, South Korea declared David Burgess' World Wide Web site subversive and ordered 14 local computer networks with Internet links to block public access to it. The government also said it would punish anyone accessing North Korean web sites, taking its ideological war with its Marxist enemy into cyberspace. ------------------------------------------------------------------------- Steven Weller | Technology (n): | | A substitute for adulthood. stevenw(a)best.com | Popular with middle-aged men.

2 1

Zimmerman/Viacrypt
by Edgar Swank 17 Dec '03

17 Dec '03

Steve Reid recently posted (and sent me an Email copy - thanks Steve), > Phil disagrees with ViaCrypts new "business" version of PGP which > apparently encrypts all messages with an employer-supplied public key > in addition to any specified by the employee. Looking at Denning's critique (pro-escrow rant) of the NCR crypto report, she mentioned that mutant version: [http://www.cosc.georgetown.edu/~denning/crypto/NRC.txt] "Other corporations are similarly adopting products with data recovery capabilities as they integrate encryption into their systems (even PGP comes with data recovery in Viacrypt's Business Edition)." IMHO Phil Zimmerman has good reason to object to the mutant version, if it's going to cause the PGP name to somehow endorse escrow. Denning is being disengenuous (so what's new). There's a big difference between voluntary, not-government-sponsored "escrow" like the type in the "business version" of ViaCrypt, and what Denning and her friends in the government TLA's want. Seems to me an employer has a perfect right to monitor his employee's work product, for which he's being paid a salary and using the employer's equipment (like business PGP). If the employee doesn't like it, he's free to seek employment elsewhere (or start his own business). Or he's free to encrypt all his personal Email at home with a personal copy of ViaCrypt or a copy of free PGP. -- edgar(a)Garg.Campbell.CA.US (Edgar Swank) The Land of Garg BBS -- +1 408 378-5108

1 0

Re: The Elevator Problem
by Bryan L Andrews 17 Dec '03

17 Dec '03

Text item: Rob wrote: >This may be old hat, but an earlier post (around the time the Kocher >RSA-timing attack came out) to the list asked about the "Elevator >Problem", where two parties who think they share the same secret want >to confirm it on an open channel. I came up with an idea for a >protocol but never got around to posting it, and dropped off the list >briefly... so pardon me if this is already touched upon. ............ >Comments? This reminds me of the discussions I've seen over the last few months regarding oblivious transfers/zero-based transactions. Good article in Scientific American on it a few months ago. Bryan. Text item:

1 0

Proposal: PGPmail Plugin for Netscape/Mosaic
by modemac＠netcom.com 17 Dec '03

17 Dec '03

I don't know C, unfortunately, otherwise I'd program this myself. So instead I'm putting it up for debate, and to encourage any cypherpunk to give it a shot if he/she thinks it's a good idea. The idea behind this utility is to encourage the use of PGP for sending email. Currently, using PGP with email requires you to compose the message, get the recipient's public key, encrypt the message, upload it to your system (or transfer it over using the clipboard), and email it. It would be much easier if sending a PGP email message was as simple as clicking a mouse. This, this idea for a PGP plugin. It goes like this: You create a small text file containing an email address and a PGP public key. Your own email address and key would be the best choice, of course, but it doesn't have to be yours. Place that file on your Web page with a unique extension, such as public_key.key. Include a link to this text file on your page, with a standard anchor like this: <li>Click here to send me a PGP email message When your Web browser reads a .key file, it invokes the PGPmail plugin utility. This utility calls up a window that allows you to compose your email message (just like a standard email form). When you have finished composing the message, you click the "Send" button as usual. The utility then does the following: - Reads the public key from the .key file. - PGP-encrypts the message with that public key, using the PGP -eat option. - Emails that PGP-encrypted message to the address given in the .key file. The major advantage of this utility is that it would allow you to send an email message to anyone who puts their public key onto their Web page in this fashion, without having to go through the rigamarole of getting the public key, saving it to a file, encrypting the message, emailing the message, and then deleting the public key again (to keep from bloating your keyring, especially if it's not someone you plan to have a regular conversation with). It would also ensure security on your part, because the PGP encryption would take place entirely on your own system. You wouldn't have to depend on a CGI script and someone else's copy of PGP, because the email process doesn't take place until *after* you have encrypted the email message. The ability to send a PGP-encrypted email message with one click of the mouse would result in an explosion of PGP use over the Web. It would allow safe transactions of private information, such as people already do with PGP - but it would be so EASY that anyone with a Web browser could do it.

1 0

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

I have noted a clear change in the tenor of comments regarding the Hackerpunks mailing list. Initially, there was a mocking tone; recently, however, information and ideas are being shared which may be of mutual benefit regarding privacy and the freedom to express oneself as s/he chooses. Refreshing!

1 0

Dead as a Dollar
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-15-96. NYP Mag: "Dead as a Dollar." For everyone who uses cash, everyone who stores it and everyone who regulates it, a challenge is nearing. The challenge will be to make choices. Some kinds of electronic currency will protect privacy, and some will violate privacy. Some will make crime easier, and some will make it extraordinarily difficult. Some will tax commerce parasitically, and some will catalyze it. The new minters of money will have enormous power to choose -- unless consumers, on the one hand, and Government officials, on the other, decide to make their own choices. In the "current climate," as those in Washington tend to say, anything that smacks of an expanded role for the Government is anathema. Policy makers at the Treasury are reluctant even to talk about electronic money on the record. "It's easy to go in and say, 'Oh, we're going to regulate everything,' without knowing what everything is," says a senior Treasury official. "We want to know what everything is." He adds: "There are very serious policy issues -- seigniorage, money laundering, financial- stability issues, consumer issues that are genuinely important that we must address and look hard at. It may be sensible for the Government to issue a card -- that's conceivable -- but what if you issue it and nobody uses it?" As money enters a new age, so does counterfeiting. The ultimate threat is the perfect copy -- the virtual coin that proves mathematically identical to the real thing. If money is a string of bits, then someone, some where, can make a perfect copy, and another and another. An arms race is already raging between those working to armor-plate digital cash with doubly and triply secure cryptography and those working to pierce the armor. Security experts assume that nefarious characters, in search of an unending stream of money, are already investing millions in the next stages of research and development. For every new idea in tamper resistance, there is a new idea in tampering.... "At least you can cause people to have to spend a lot of money," says Eric Hughes, a cryptography expert. "But doing the second chip is far, far less money than the first. And if you could make a master chip that spoke the right protocol, you could make a little money mint for yourself." "Information warfare is going to make people very worried downstream," says Crook at Citicorp. "We have an immense paranoia about how dangerous it's going to be. I think that the security requirements in our industry are going to be more severe than at the Department of Defense." Cryptography is as close as modern mathematics comes to magic. It's simply a design choice. Smart cards, or their on-line equivalents, could function as blindly as raw cash. They could be even less traceable than in Chaum's system. That is a frightening prospect to law- enforcement authorities. Having finally made life difficult for drug smugglers with heavy cash suitcases, they will not casually allow the manufacture of half- ounce chips that could make possible blind transfers of hundreds of millions of dollars, a money launderer's dream. Even if the Government takes no other action in the electronic-money arena, it will surely move to extend its restrictions on cash to cover digital equivalents. And so far, the large institutions entering the electronic-money arena are leaning toward less-anonymous, less-private approaches than Chaum's, betting that most of us will be willing to sacrifice more pieces of privacy for, say, convenience. Chaum could prove right, but only if the marketplace is willing to cast its votes for privacy. [With many remarks by Kawika Daguio.] http://pwp.usa.pipeline.com/~jya/deaddoll.txt (48 kb) ----- Or, if http fails, DED_dol to <jya(a)pipeline.com> Thanks to JG and NYPaper.

1 0

No Subject
by Michael Camp 17 Dec '03

17 Dec '03

I just subscribed and what the hey is pgp. Pretty good privacy? -Think global, act local, recycle! Michael Camp a037716t(a)bcfreenet.seflin.lib.fl.us

1 0

Re: Comments on MicroPayments and the Web
by Bruce Baugh 17 Dec '03

17 Dec '03

At 10:54 AM 6/15/96 -0400, Perry E. Metzger wrote: >> Just like commercial crypto, servers, news clients, and the like are all >> superior to the free versions? > >Software and hardware follow different rules. This is true enough. On the other hand, it's true that money by itself is not (in my experience) the deciding factor on the quality of a service provider. I moved some months ago from the biggest ISP in town to one with a much smaller resource base but greatly superior service in the areas that mattered to me (fast news, reliable mail, etc). The guy in charge is making better use of what he's got. On the gripping hand, if my current provider had the other provider's bucks, things could _really_ fly. -- Bruce Baugh bruce(a)aracnet.com http://www.aracnet.com/~bruce

1 0

Re: doubleclick monitoring web browsing habits
by Deranged Mutant 17 Dec '03

17 Dec '03

On 14 Jun 96 at 14:26, Hal wrote: > When I run lynx (2.3.7 beta) to <URL: > http://www.anonymizer.com/cgi-bin/snoop.pl >, it says: > > Here's a sampling of the kind of information that a site can collect > on you (please wait a moment): > Your computer is a Unix box. > Your Internet browser is Lynx. > You are coming from jobe.shell.portal.com. > You just visited the Anonymizer Home Page. > > No user name here. I visited there from Netscape. Didn't give my user name but apparently said "You are affiliated with ASB Internet, Inc. ..." and then displayed a bunch of advertising info by ISP puts out. An amusing thought: fill the personal info fields with business advertisements. Perhaps people who surf the web regularly can sell advertising space. (insert smiling emoticon here) > Also, when I follow a mailto: link it asks me to input the email address > I want the mail to be from! So I don't think it is using local user name > information, although certainly that is potentially available to it. Have you tried mailing yourself by putting something else in there? I remember trying that and seeing from the headers that I sent it (the usual "Received by ..." username -> machine paths.) Of course that was on a University's computer system, so they may have patched the sources. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: doubleclick monitoring web browsing habits
by Deranged Mutant 17 Dec '03

17 Dec '03

On 14 Jun 96 at 18:06, Mark M. wrote: [..] > but it is not enough to satisfy my paranoia. I would be truely satisfied if > Netscape would prompt for an e-mail address whenever it sends mail or post to > usenet. When I used to read the list over hks.net (still down, eh?) I would change my name (and sometimes address, for quasi-anonymity) with no problems... you just have to do that *before* you try to reply. (Free)Agent newsreader will let you do that as part of the reply as well. It'll still show the path and machine that sent news, but it allows you to change From:, Reply-To: and Sender: fields. Rob. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0