December 2003 - cypherpunks-legacy

NYU's PGP Key-Signing Seminar - a critique
by Sergey Goldgaber 17 Dec '03

17 Dec '03

I am writing regarding the PGP Seminar to be held on the 27th of March. Your informative session is laudible. And, I would like to take full advantage of the key-signing session to follow. However, there is a certain concern which it would be prudent to address first. http://www.nyu.edu/pages/advocacy/awareness/pgp.html provides instructions for the session, which state: "8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them." This conflicts with the guidelines for hosting pgp key signing sessions as presented in the alt.security.pgp FAQ (a relevant excerpt is attached to this message). The FAQ states: "6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have." ~~~~~~~~ The concern I have is that this discrepancy undermines the web of trust model for PGP. The participants of the NYU session will not have the opportunity for verifying the identity of the owners of the keys that they are signing. They must rely on a central authority ("Tim and Ilya"). I realize that this may be a simpler, and perhaps a more convenient method of conducting a key-signing session, perhaps ideally suited to a session aimed at novices. However, I feel that the security provided by PGP is thereby undermined. We must not forget that security is the whole reason that even the novices at your session are using PGP for in the first place. I hope this issue can be addressed before the session begins. ............................................................................ . Sergey Goldgaber <sergey(a)el.net> System Administrator el Net . ............................................................................ . To him who does not know the world is on fire, I have nothing to say . . - Bertholt Brecht . ............................................................................ 6.8. How do I organize a key signing party? Though the idea is simple, actually doing it is a bit complex, because you don't want to compromise other people's private keys or spread viruses (which is a risk whenever floppies are swapped willy-nilly). Usually, these parties involve meeting everyone at the party, verifying their identity and getting key fingerprints from them, and signing their key at home. Derek Atkins <warlord(a)mit.edu> has recommended this method: _________________________________________________________________ There are many ways to hold a key-signing session. Many viable suggestions have been given. And, just to add more signal to this newsgroup, I will suggest another one which seems to work very well and also solves the N-squared problem of distributing and signing keys. Here is the process: 1. You announce the keysinging session, and ask everyone who plans to come to send you (or some single person who *will* be there) their public key. The RSVP also allows for a count of the number of people for step 3. 2. You compile the public keys into a single keyring, run "pgp -kvc" on that keyring, and save the output to a file. 3. Print out N copies of the "pgp -kvc" file onto hardcopy, and bring this and the keyring on media to the meeting. 4. At the meeting, distribute the printouts, and provide a site to retreive the keyring (an ftp site works, or you can make floppy copies, or whatever -- it doesn't matter). 5. When you are all in the room, each person stands up, and people vouch for this person (e.g., "Yes, this really is Derek Atkins -- I went to school with him for 6 years, and lived with him for 2"). 6. Each person securely obtains their own fingerprint, and after being vouched for, they then read out their fingerprint out loud so everyone can verify it on the printout they have. 7. After everyone finishes this protocol, they can go home, obtain the keyring, run "pgp -kvc" on it themselves, and re-verify the bits, and sign the keys at their own leisure. 8. To save load on the keyservers, you can optionally send all signatures to the original person, who can coalate them again into a single keyring and propagate that single keyring to the keyservers and to each individual. This seems to work well -- it worked well at the IETF meeting last month in Toronto, and I plan to try it at future dates. http://www.nyu.edu/pages/advocacy/awareness/pgp.html Awareness Week 1997 Pretty Good Privacy Seminar Thursday, March 27 at 12:00 pm Warren Weaver Hall, Room 313 [INLINE] This is a Blue-Ribbon event, CANYU will distribute Blue Ribbons to participants This seminar sponsored by the Computer Advocacy @ NYU and the Academic Computing Facility. The seminar will explore the need for use of cryptography for communications in every day life, and demonstrate how PGP (Pretty Good Privacy) can be used at NYU. This workshop is a part was preceded by another seminar titled "Encryption: Padlocks for the digital age". Speakers: * Tim O'Connor * Ilya Slavin A key signing session will follow the seminar. The instructions follow: 1. If you have already created your key, skip to the following step. + You can create your new key on one of the IS machines (and, most likely, many other computers at NYU) by following the steps outlined in the following document. 2. Once your key is generated and signed by yourself, extract your public key from the key ring by typing pgp -kxat userid keyfile.asc where keyfile.asc is a name of the file you want to copy your key to. 3. Send this file with your name and a mention of the seminar to slavin(a)acf2.nyu.edu before 7:00 PM on March 26, 1997. 4. Ilya will compile a master keyring with all the keys before the seminar starts. 5. Please write down (or print out) the output of the following command: pgp -kvc where <userid> is your name or e-mail address that appears in your key. 6. Ilya will have printouts of userids and fingerprints of all keys sent to him. 7. Bring two photo IDs (either a passport or other respectable form of ID) to the seminar so that we can verify your identity. 8. At the seminar Tim and Ilya will confirm the identity of all participants and the participants will identify their own keys. 9. After the seminar Ilya will e-mail all the participants the keyring with all the keys, along with the instructions on how to sign them. 10. Once the keys are signed, the participants will e-mail their signed keyrings to Ilya, who will add their signatures to the master keyring. 11. As soon as Ilya receives all the signed keys, he will e-mail the complete keyring to all the participants, who can add the new signatures to their own keyrings. ______________________________________________________________________ Computer Awareness Week '97 / Ilya Slavin / Last Modified: 3/6/97

2 2

Re: UK govt. to ban PGP (was Re: UK TTP Paper)
by John Young 17 Dec '03

17 Dec '03

>: In Grey's words, ``All over Europe, the lights are going out'' >: >: Ross There does appear to be a coordinated global action to issue policies on TTP, GAK and the like at this time. OECD is due to shortly release its crypto policy, as is the USG according to BXA. The FBI issued its wiretap payment plan yesterday. Herson publically admitted the EU-FBI wiretap pact. All are apparently guided by The Wassenaar Arrangement amongst two dozen or so countries to act in concert, and to go public with dual-use controls in unison. So, Clint Brooks' comment at CFP about a new policy coming out for stronger crypto is a surely a harbinger of global GAK, in the guise of TTP or Key Recovery, as was speculated here, and as Rensch's statement to the House yesterday affirms. It's a policy sure to appeal to nationalists and chauvinists: strong protection for a nation's interest and commerce with GAK; without it no protection from predatory (rogue) nations (and criminals). But, as the Crypto AG engineer asked, "Who will protect us from NSA?" And its predatory clients and contractors, the Germans and French and others are asking, now that they are suffering the unilateral spying of their highest tech "friends."

3 2

"why privacy" revisited
by Wei Dai 17 Dec '03

17 Dec '03

The question "why privacy" has at least two different meanings. The first one, "why do you value privacy for yourself" has a fairly obvious answer. Privacy implies control over one's personal information, and more control is clearly preferable to less. But the question also has a second meaning, "why do you think everyone should have more privacy?" The answer to this question is not so obvious. Just because each individual wants more privacy for himself, it doesn't follow that everyone will be better off when everyone has more privacy. Cypherpunks accept the idea that the widespread deployment of cryptography will increase privacy for everyone (or at least everyone who owns a computer and an Internet link). They also argue that this is a good thing. The reason most often cited is that privacy serves as a barrier for coercion. But privacy is also a barrier to almost every other kind of social relationship. For example, economists recognize that many market failures/inefficiencies are caused by information asymmetries (i.e., the fact that in a potential exchange one party has more information about the exchange than the other. The canonical example for this is the used car market.) Increased privacy would seem to only exacerbate these problems. What arguments can be made that the benefits of increased privacy outweigh its costs, considered for society as a whole?

1 0

Re: Dorothy and the four Horseman
by Toto 17 Dec '03

17 Dec '03

Douglas Barnes wrote: > > Aldrich Ames is actually a great example of why Key Escrow is > NOT a good idea. Any measure that concentrates keys in one or > several locations creates a tempting target for spies, > criminals and corporate espionage types. How much better do the > GAK proponents plan to protect keys than, say, the names of all > our agents in the former Soviet Union? > > Doug

1 0

Re: "why privacy" revisited
by Jonathan Gaw 17 Dec '03

17 Dec '03

when i talk to people like the Direct Marketer's Assn., they honestly don't understand what the fuss is about. Their attitude is, quite literally, "What's the harm being done here?" what do you think the community interested in privacy protection can do to best illustrate to the general public the "harm" in the collection of personal information? Jonathan Gaw At 09:28 AM 3/22/97 -0800, Timothy C. May wrote: > >Much as I agree with the point that privacy is desirable, I find the >"market efficiency" arguments unpersuasive, at least as presented below: > >At 1:01 PM +0000 3/22/97, Adam Back wrote: > >>You requested an argument couched market economic terms as to why >>reduced privacy might be a bad idea for the market efficiency. >>Consider: >> >>Less privacy is a bad thing in market economics terms, because as >>privacy takes a downwards spiral, which leads to ever increasing >>government intervention, increasing sizes of governments, fascism, >>etc. the free market economy will go to hell. Poverty, and food >>shortages will result, a la the former USSR, which is slowly >>recovering from the decline caused by statist, facist policies. We on >>the other hand, absent pressure from outside government, law >>enforcement and secret services circles are collectively headed into >>that fascist driven downward spiral.in economics. > >Or, since we all understand perfectly well that *credit cards* and *checks* >and other forms of *electronic payment* are not private in the way cash is, >Adam's argument could read as follows: > >"Using credit cards and checks is a bad thing in market economics terms, >because as privacy takes a downwards spiral, which leads to ever increasing >government intervention, increasing sizes of governments, fascism, etc. the >free market economy will go to hell. Poverty, and food shortages will >result, a la the former USSR, which is slowly recovering from the decline >caused by statist, facist policies. We on the other hand, absent pressure >from outside government, law enforcement and secret services circles are >collectively headed into that fascist driven downward spiral.in economics." > >In other words, I submit the fallacy of this comment, that traceable >payment schemes such as credit cards and checks have _not_ destroyed the >U.S. and Western economies as evidence that Adam's thesis is incorrect. > >(One might point to the correlation between increased credit and check >instruments over the past 50 years and the rise of government spending, but >such a correlation would not, in any reasonable view, be causative. I'll >elaborate on this if there's real interest.) > > >--Tim May > >(I'm not arguing against privacy. I just don't see the validity of some of >the attempts to "prove" that privacy enhances markets (whatever that means) >and that non-privacy undermines markets. Such arguments are mostly >unpersuasive and depend strongly on assumptions and interpretations and >selective admission of facts.) > >Just say "No" to "Big Brother Inside" >We got computers, we're tapping phone lines, I know that that ain't allowed. >---------:---------:---------:---------:---------:---------:---------:---- >Timothy C. May | Crypto Anarchy: encryption, digital money, >tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero >W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, >Higher Power: 2^1398269 | black markets, collapse of governments. >"National borders aren't even speed bumps on the information superhighway." > > > > > ****************************************************** Jonathan Gaw The Star Tribune Minneapolis, Minnesota jonathan(a)gaw.net *********Wasting Digital Bandwidth Since 1986*********

3 2

Cypherpunks Bottleneck [was Cypherpunks & Ecash]
by camcc＠abraxis.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 05:04 PM 3/21/97 -0800, you wrote: |[Hmmmhhhh...after noticing that a message I sent off this morning at 9 had |not gone out as of late this afternoon, I looked to see if other messages |I've sent off have gone out. I found that a message I sent out last night, |23 hours ago, has not arrived at my site, nor have I seen any followups by |others to it. So I am sending it again. I will go back through my messages |and look for other such non-sends. I suggest others do the same. I don't |know what the problem is, but it's worse in this respect than the problems |with toad.com.] | Tim: Last Thursday night I got word of Perry's shut down from the PGP Users List; I had not seen it posted during the day so I forwarded it to the cypherpunks list. It showed up at my location 5 minutes ago. I have the consolation of knowing mine was not the only one delayed. I seem to have noticed messages being repeated this afternoon. Alec -----BEGIN PGP SIGNATURE----- Version: 4.5 iQCVAgUBMzNAMiKJGkNBIH7lAQFDEQQAj1RSJBtJ+vNv/iwPFTTcs6RNBpqq93tN H0j3toYnuFwuAThR5uI4qyuCto0dVhygl17cgZpLjo85CXDLe3SswN05fTZvhKCB 5E2Doq5OHo01S9cOzUigr6Q5oRR/ZEqGUTZSJmKzw1l0NzA+hDLvs+/zK4wb8yiX Zb//53oBjIg= =INC3 -----END PGP SIGNATURE-----

2 1

Re: Market Failures, Monocultures, and Dead Kids (Oh My!)
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

BELIEVE the children! Vulis wrote: > Out in the hobbsian wild, if the parents abuse their offsprings (kill them, > fail to train them), then the offsprings won't reproduce and the parent's > genes won't perpetuate. Do we really need a more coersive system of > punishing "child abuse"? We don't (yet) live in the "hobbsian wild". Children do what they are taught. If the are taught to react to the slightest provocation with violence, then they will, when they grow up (notice I didn't say mature), react similarly. If we wish to live in a society of reasonable people, our children need to be raised respond reasonably to provocation. This means get violent when, and only when necessary. So, yes. I would say we need a fairly coersive system for punishing child abuse. We also need a clear defination of what child abuse really is. BELIEVE the children!

1 0

Re: "why privacy" revisited
by Wei Dai 17 Dec '03

17 Dec '03

On Fri, 21 Mar 1997, Timothy C. May wrote: > The best arguments are not those couched in terms of "benefits" to > society/markets, but in terms of "lowest common denominators." I favor the > "Schelling point" view, and have espoused it here often. > > In most Western systems, a reasonable Schelling point is that various > actors agree not to try to enter the "private spaces" of others. For > example, my neighbors and I agree not to enter each other's houses to pry > and inspect. > > (The Schelling point is that this "boundary" point is essentially agreed > upon even though my neighbors and I have never formally negotiated it...as > with animals and their "territories," certain equilibrium points are > reached.) > > In Western systems, it is recognized that the _costs_ of coercively > entering another's home and/or private space are too high, and so we > declare there to be a "right of privacy." In reality, what we mean is that > we accept a private domain as a Schelling point. I think you're answering the third meaning of "why privacy", "why DOES privacy exist?" This is a positive rather than a normative question (which is what I was asking). I agree with you that most likely privacy exist because in some sense it is an equilibrium in the game of life. But what I'm asking is whether it is a desirable equilibrium, and whether a new equilibrium involving more privacy is better than what we have now. > I reject the argument Wei Dai mentions, that market benefits could obtain > if society rejected privacy, for two reason. First, because in an important > sense rights are not the slaves of corporate or personal business > interests. (E.g., my interest in Alice's television viewing habits does not > trump her right to keep me out of her house.). Second, because so-called > "market efficiency" is largely an illusion anyway. Certainly no real market is perfectly efficient, but some markets are relativly more efficient than others, and most markets are more efficient than alternative forms of economic organization (e.g., socialism) so I don't see how you can call "market efficiency" an illusion. The inefficiencies I was talking about were relative to the case where both parties have the same information. Also, I don't quite understand your first argument. It seems to suggest that privacy should exist for no reason in particular. If this is the case then it doesn't make sense to argue about the costs/benefits of privacy. But it is my understanding that most cypherpunks believe more privacy benefits everyone, and therefore work to making more privacy for everyone. What I'm looking for are arguments that support this belief.

4 3

Re: Report from Supreme Court on CDA arguments
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > Nothing I have seen in the interpretations of the CDA would "excuse" me > from saying "Fuck" (or worse) in a forum if I knew readers under 18 might > see it. (Some of the pro-CDA folks talk about possible exceptions for, say, > two 17-year-olds discussing sexual problems between themselves). > > This was the main reason I did "Tim's Vernacular Translation of the Bible" > as an alternate .sig. (Included below, by the way.) > -- > [This Bible excerpt awaiting review under the U.S. Communications Decency > Act of 1996] > And then Lot said, "I have some mighty fine young virgin daughters. Why > don't you boys just come on in and fuck them right here in my house - I'll > just watch!"....Later, up in the mountains, the younger daughter said: > "Dad's getting old. I say we should fuck him before he's too old to fuck." > So the two daughters got him drunk and screwed him all that night. Sure > enough, Dad got them pregnant, and had an incestuous bastard son....Onan > really hated the idea of doing his brother's wife and getting her pregnant > while his brother got all the credit, so he pulled out before he > came....Remember, it's not a good idea to have sex with your sister, your > brother, your parents, your pet dog, or the farm animals, unless of course > God tells you to. [excerpts from the Old Testament, Modern Vernacular > Translation, TCM, 1996] Perhaps this sig could be used in all replies to government agencies in regard to CDA and other censorship matters. Is it in the public domain? -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: FBI Visits JPUNIX
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

jim bell wrote: > > At 10:35 PM 3/20/97 -0500, John Perry wrote: > > Apparently some high-ranking > >official has been receiving anonymous email coming from my site that > >is of a threatening nature. This official has decided to call in the > >FBI as I was visited by said organization. I am shutting down remailer > >operations immediately. > I think you should name the "high-ranking official" involved. If there actually is one. > We (and you) might also point out that as far as you know, these threatening > notes could have been send by GOVERNMENT people, in an attempt to shut down > the system. Perhaps there was no threatening note. Perhaps there was no visit from the FBI. The attempt to destroy the cypherpunks list failed. The next logical target would be the remailers. Two remailers go down in the same week, both being tenacles of C2Net. Greg Broiles once again happens upon the scene of the accident, and predictably warns everyone of the grave dangers and liabilities facing remailer operators. How long until he publicly calls for the remailers to be "killed," as he did with the cypherpunks list? Instead of solutions to the problems facing small remailers, we have schills coming out of the woodwork to proclaim that remailers are only feasible for Big Business to operate. Corporate takeover of the list failed, now corporate takeover of the remailers seems to be the new agenda. I suggest that, instead of wasting time on a new battle, we simply resurrect all of the arguments over list control and re-post them as arguments over remailer control, simply substituting the word "remailer" everywhere that the word "list" occurs. Truthmonger Cindy ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

4 3