December 2003 - cypherpunks-legacy

Re: Key Security Question
by Toto 17 Dec '03

17 Dec '03

Paul Foley wrote: > On Fri, 31 Jan 1997 17:51:47 -0800, Toto wrote: >> If the repairman has your pubring and secring files, you can now >> consider them in the same light as a 'busted flush'. > > The secret key is encrypted using the same IDEA algorithm that PGP > uses to encrypt your files. If you trust IDEA, your key is as safe as > your passphrase (not at all if you have no passphrase, not much if > it's easily guessable, etc.) Send me your secring file. I have a new password-buster I'd like to try out on it. > If your computer repairman has the capability to crack strong 128-bit > ciphers, I'd be rather worried :-) He doesn't have to crack the cipher, he only needs to find the password. > On the other hand, there's always the possibility of your passphrase > being on the disk, say in a swap file, somewhere. Same goes for > plaintext of any encrypted files/messages. I doubt anyone's gonna go > hunting through your swap file, "empty" sectors, etc., looking for it, > though, unless you've done something to really piss him off lately :-) Or if he's a member of the CypherPunks list, read the message, and now considers it to be a personal challenge. Toto

1 0

Re: Libel & the 1st Amendment
by Peter J. Capelli 17 Dec '03

17 Dec '03

Mark M. wrote: > On Thu, 30 Jan 1997, Jim Choate wrote: > > > > * Many 1st Amendment experts don't believe in the legal concept of libel. > > > It is, they say, a rich man's game > > > > Exactly, instead of equal protection under the law we have a specieocracy. > > Anyone can afford a contingency-free attorney as long as the plaintiff has a > good chance of being awarded damages. This has the benefit that the legal > system doesn't get overcrowded with frivolous cases. You mean to say, rich people can overcrowd the courts as much as they like, while others are restricted by contigency-only lawyers ( Call 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to control a poor one with many frivolous lawsuits ... while they can afford to file lawsuit after lawsuit, the poor person cannot defend himself. -- Pete Capelli, CNE UB Networks, Inc. pcapelli(a)ub.com ****** Finger pete(a)idaho.ubisg.com for my PGP Public key! ****** They that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety. - Benjamin Franklin, 1759

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Crypto in New Zealand - an update
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

This is a continuation of the article I posted here a few weeks ago. You can find the whole thing at http://jya.com/nsazeal.htm. Peter. -- Snip -- On the 17th January significant parts of this story appeared on the front page of the National Business Review (NBR), a fairly influential paper read by (apparently) half the NZ business world. The GCSB declined to comment on anything except to acknowledge that there had been a meeting between a GCSB person and the manager of Orion Systems. The story also confirms (from talking to some of the people involved) the GCSB - MFAT and GCSB - DSD connections. The following week Andrew Mayo wrote a letter to the editor of the NBR containing an eloquent defense of the use of encryption to protect personal privacy. MFAT replied to say that they were only following orders, and were required by the Wassenaar agreement to restrict crypto exports: "Export permits normally were required only if the encryption was 40-bit or stronger, so most commercial encryption would not be affected". I wonder where the 40-bit limit suddenly came from? Note also the phrasing "40-bit or stronger". This means that anything including 40 bits is restricted. If they're going to try to blindly parrot US policy then they should at least get their facts straight. A few days later I found someone who knew what to ask for in order to get a copy of the NZ export regulations. I called MFAT and talked to a gentleman by the name of John Borrie, who had recently taken over responsibility for this affair from someone else who, to put it mildly, had been annoying to deal with. I suggested to him that the GCSB were feeding him just the information they wanted him to know and no more, and that perhaps he should avail himself of alternate sources of advice. He didn't see it quite that way. The export regulations are identical to the Australian regulations, even down to the layout style. A few of the fonts differ, but that may be due to different systems/printers/whatever. There are several obvious holes in these regulations, but I won't mention them now because they'll probably be used in court fairly soon. The following week the story was again on the front page of the NBR. This time the story covered the financial difficulties that Cyphercom had been plunged into. Because MFAT had stopped them from having any access to their product for nine months, the company was considering filing for bankruptcy. MFAT spokesperson Caroline Forsyth commented: "US controls on the export of strategic goods are at least as strict as those of New Zealand... an export permit would normally only be required for encryption if it was 40-bit or stronger. Most commercial encryption is well below 40-bit strength. Almost all New Zealand exporters of software are unaffected". The confused and nonsensical nature of these statements presents a scary picture. MFAT are a government department who (in this area) have no idea what they're doing, but don't know that they have no idea. Combined with the sterling advice they seem to be getting from the GCSB, this could make them a tough nut to crack. In anticipation of what MFAT would say, I wrote a letter to the NBR editor (which won the "Letter of the Week" award :-) which refuted their claims. The letter ended with: It appears that MFAT's position is based on an antiquated outlook which regards software to secure electronic commerce as some form of special military technology, a position which might have been reasonable a few decades ago but is totally out of touch with the modern use of computers and electronic communications. In their October 1996 "Business File", MFAT claim that "New Zealand... is helping to limit the spread of increasingly sophisticated military technology and weapons of mass destruction". Whether mass-market commercial software which protects financial transactions and medical records counts as "sophisticated military technology" or "weapons of mass destruction" is unclear (I suppose it's possible to beat someone to death with a floppy disk if you were very determined, but that hardly qualifies as "mass destruction"). Finally, one of the goals of the Wassenaar agreement was to "not impede bona fide civil transactions", which MFAT have certainly done, and are continuing to do. In the meantime anyone with a credit card and phone, or the ability to walk into a software store, can buy the same software overseas. Stopping New Zealand companies from exporting widely available mass-market computer software of this kind "because terrorists might use it" makes about as much sense as stopping farmers from exporting beef and lamb "because terrorists might eat it". The issue of Management Technology Briefing included with last weeks NBR reports on page 22 that there will be "a US$186 billion market in global transactions by the year 2000", along with a comment that securing these transactions - one of the goals cryptlib was designed for - remains a problem area. Within the next few years the push towards electronic commerce will become a veritable steamroller. By needlessly blocking the export of the technology required to secure this market, MFAT is helping ensure that New Zealand becomes part of the roadkill. MFAT's parting shot was: "People trying to export encryption without clearance can be prosecuted under the Customs and Excise Act". I should certainly hope so! It's going to be difficult creating a test case to get this nonsense thrown out if they refuse to prosecute me. Stay tuned, this is going to get entertaining...

1 0

Re: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. I'm still waiting for you to explain what you believe to be the "problem" for which we are searching a solution. Is the problem that there is slavery? Or do you think the only problem is that the slaves are unhappy? Jim Bell jimbell(a)pacifier.com

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:26 PM 1/30/97 -0800, Sean Roach wrote: >At 11:15 AM 1/30/97 -0800, jim bell wrote: >>What you're presented (included in its entirety below) is what I've come to >>call an "AP story problem." I've worked through many of those myself; >>their main problem is that they don't carefully describe why _each_ person >>in the "play" you've described would be motivated to do what it's claim he >>does, and why he DOES NOT do other things to fix the situation he's in. >>Remember, I'm not merely talking about the main character, but also the ones >>who are (apparently?) incidental. >> >>For just one example, you said: "conventional bodyguards could be >>included, ones with no real pay but with the fore knowledgethat they will be >>buried with the tyrant." >> >>What motivates these people? Are they hostages? If they're hostages, then >>presumably that means they're motivated to seek the death of anyone who is >>holding them. What about their relatives; don't they have any sympathy for >>those who are taken? Why don't they donate to AP to see the lead guy dead? > >As I stated in the bottom, the children would be privaledged. Who says? What if the public doesn't agree? Might it not be better to sacrifice a few children to keep other children alive? > They would >merely be told that it is a great honor. It could very well be. Assuming >that the tyrant did not die, these children would live in comparable luxery. How much would this cost? Who would pay? Where would the money come from? Is this "solution" practical for everybody, or just the top guy? >They would be at risk only if the tyrant was. By keeping the children at >hand, the parents would balk at taking action against the tyrant, not only >their own action, but also that of others. The children would merely be >there to thwart the attempts of others. Suppose that didn't work. Who would kill the kids if the tyrant died? Who would risk death himself to do this? Etc. Hint: Unfortunately, you don't seem to be pursuing the implications of what you are hypothesizing. This is typical. Go back and do what I originally suggested: Look at the motivations of EACH person in the "play" and decide why he will play along with the game. This includes not merely the people you want to focus on, but also anyone else. Jim Bell jimbell(a)pacifier.com

1 0

Re: Libel & the 1st Amendment
by Mark M. 17 Dec '03

17 Dec '03

On Sat, 1 Feb 1997, Peter J. Capelli wrote: > You mean to say, rich people can overcrowd the courts as much as they > like, while others are restricted by contigency-only lawyers ( Call > 1-800-AMBULANCE! ) ... and what of the case of a rich person trying to > control > a poor one with many frivolous lawsuits ... while they can afford to file > lawsuit after lawsuit, the poor person cannot defend himself. What, exactly, would be the point of suing a poor person? Mark

1 0

Re: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:40 PM 1/27/97 -0500, Phillip M. Hallam-Baker wrote: > > >jim bell <jimbell(a)pacifier.com> wrote in article <5ch9f2$cuu(a)life.ai.mit.edu>... > >> Look, I've proposed what I consider to be a remarkably consistent method to >> prevent the kind of political tyranny that you criticize, and I don't see >> any recognition of this fact. > >Thats because its a whacko solution that has no credibility >or consistency. I'm still waiting for you to explain what you believe to be the "problem" for which we are searching a solution. Is the problem that there is slavery? Or do you think the only problem is that the slaves are unhappy? Jim Bell jimbell(a)pacifier.com

1 0

Re: Key Security Question
by Alan Olsen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:41 AM 1/31/97 -0800, Z.B. wrote: >My computer went into the shop a few days ago, and I was unable to take >my PGP keys off it before it went in. What are the security risks here? >If the repairman chooses to snoop through the files, what would he be >able to do with my key pair? Will I need to revoke the key and make a >new one, or will I be relatively safe since he doesn't have my >passphrase? Depends on how guessable your passphrase is. If you use something that would fall to a dictionary attack, then you are vulnerable. (Providing that they actually looked for your keyring and made a copy.) If you had nyms on your keyring, then those nyms can be associated with your "true name" with no passphrase required. (Unless you keep your keyring encrypted. Private Idaho supports encrypted keyrings, but little else does.) If you are really concerned about it, you could learn to do your own computer repairs. -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAwUBMvObZeQCP3v30CeZAQHwCgf+Oks1qT2Hc9pRU4jy+YU/q3WidHVhJmf2 QxjdEFeRPyX3rt+7ThCN4wnGdh7W2Ya8SYGwmgGgU7pucJ9vgC0JACU20RvRgsQk 5USpS3+Ua9QVNs/NpKGDDANlsurPMi9y12rIqrDbmPmcnW7HDfrfByLVy0HvfqKE ctJsOOz391rbjM+HiNXzMUiiWLBelVA9CrsG/UtSd243vymwD/J2dJiq3s0CMPln Tl1rSy1IVsMqNuQ65ALV9qsz6GJtK8Wu1nSk1IwR8Ge2ZSq6VCqkV/hY8+r5KPOM V0XMIblviEc87xmiJ8BMuNNJpOvhGzFZQ1TV9vwdec3pfyeV/HeHjw== =2if1 -----END PGP SIGNATURE----- --- | If you're not part of the solution, You're part of the precipitate. | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 09:26 PM 1/30/97 -0800, Sean Roach wrote: >At 11:15 AM 1/30/97 -0800, jim bell wrote: >>What you're presented (included in its entirety below) is what I've come to >>call an "AP story problem." I've worked through many of those myself; >>their main problem is that they don't carefully describe why _each_ person >>in the "play" you've described would be motivated to do what it's claim he >>does, and why he DOES NOT do other things to fix the situation he's in. >>Remember, I'm not merely talking about the main character, but also the ones >>who are (apparently?) incidental. >> >>For just one example, you said: "conventional bodyguards could be >>included, ones with no real pay but with the fore knowledgethat they will be >>buried with the tyrant." >> >>What motivates these people? Are they hostages? If they're hostages, then >>presumably that means they're motivated to seek the death of anyone who is >>holding them. What about their relatives; don't they have any sympathy for >>those who are taken? Why don't they donate to AP to see the lead guy dead? > >As I stated in the bottom, the children would be privaledged. Who says? What if the public doesn't agree? Might it not be better to sacrifice a few children to keep other children alive? > They would >merely be told that it is a great honor. It could very well be. Assuming >that the tyrant did not die, these children would live in comparable luxery. How much would this cost? Who would pay? Where would the money come from? Is this "solution" practical for everybody, or just the top guy? >They would be at risk only if the tyrant was. By keeping the children at >hand, the parents would balk at taking action against the tyrant, not only >their own action, but also that of others. The children would merely be >there to thwart the attempts of others. Suppose that didn't work. Who would kill the kids if the tyrant died? Who would risk death himself to do this? Etc. Hint: Unfortunately, you don't seem to be pursuing the implications of what you are hypothesizing. This is typical. Go back and do what I originally suggested: Look at the motivations of EACH person in the "play" and decide why he will play along with the game. This includes not merely the people you want to focus on, but also anyone else. Jim Bell jimbell(a)pacifier.com

1 0