December 2003 - cypherpunks-legacy

[Proposal:] Revolving Web Mirrors
by William H. Geiger III 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, I am working on a system of a revoloving web mirror. The basic operation would be as follows: 1. The Server - ------------ The would be a server that would contain a colection of web pages that have been "baned" or blocked due to their content by various countries. I addition to this their would be a form that users could fill out to subscribe to mirror a web page (details under User). The server would mail out periodicaly to the users different web pages for them to mirror off of their web pages. 2. The Forms - ------------ The Web Form for the user to fill out would give the user the options of size/# of pages, general content type, and how often to change. 3. The User - ---------- The User would be able to offer some of his web space to mirror web pages that due to their content have been blocked. The users should have a choice of different catagories of web pages: political, sexual, crypto, ...ect. (since they are donating the web space they should have some say in what web pages they mirror). The User should be able to determin the amount of web space / # of web pages he is willing to host. The User should be given the option of hosting HTML pages and/or binaries. If he selects to host binaries he should have some selections as to what binaries he is willing to host. 4. Links - ------- Some users may be unwilling or unable to mirror webpages. That may be willing to provide links to baned web pages and/or to the web mirror servers. A collection of links should be made available to the user so they can be integrated into their web pages. 5. Notification - ------------ Users that have subscribed to the Mirror service should be sent e-mail with a list of web pages that meet the options that they filled out in the form. The should be given URL's of where they can download the pages along with the orriginal web pages URL's so they can make the final determination of what web pages they wish to mirror. This is just a rough outline. If you have any thoughts or comments on this please let me know. If anyone has server space they could donate for such a project please let me know. Thanks, - -- - ----------------------------------------------------------- William H. Geiger III http://www.amaranth.com/~whgiii Geiger Consulting Cooking With Warp 4.0 Author of E-Secure - PGP Front End for MR/2 Ice PGP & MR/2 the only way for secure e-mail. Finger whgiii(a)amaranth.com for PGP Key and other info - ----------------------------------------------------------- Tag-O-Matic: What I like about MS is its loyalty to customers! -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv Comment: Registered User E-Secure v1.1 ES000000 iQCVAwUBMzccE49Co1n+aLhhAQEvJAP9Edh72M0adX5ZXcKPo6qQvuvbLG/1u6Vo CrPU8mMtRxbgBptRZgJ+fzCB98nEMASTUb/vkWx4He/sS5xs3Tjy5kS/fdxs9z4W pNwoau9YsOJOOx8EMUIWJNU08x011kREqxFMP2M7ds+LHsO9HuVy/fvNPVJuXDOV g7q/tEodJNc= =+ixR -----END PGP SIGNATURE-----

1 0

Re: UK to ban free use of crypto?
by Bill Stewart 17 Dec '03

17 Dec '03

The document is at http://dtiinfo1.dti.gov.uk/pubs/ At 08:01 AM 3/23/97 -0500, Peter D. Junger wrote: >After a very quick reading of this proposal I am convinced that all it >would do if implemented by legislation that follows its recommendations >would be to forbid those who are in the UK from using an unlicensed >key escrow services. > >It quite clearly does not intend to ban the use of cryptography or the >publication of cryptographic software. And Michael Froomkin offers similar sentiments. They're both lawyers, and I'm not (:-), so they're expected to do a better job of reading the legal parts of it. On the other hand, the DTI says: 57.The legislation will provide that bodies wishing to offer or provide encryption services to the public in the UK will be required to obtain a licence. The legislation will give the Secretary of State discretion to determine appropriate licence conditions. and it's got a really broad definition of "encryption services", including even things such as time-stamping. The big problem is that the document has a really warped view of the cryptographic and business services that a "Trusted Third Party" would provide, and some parts are expressed in quite broad language. For instance, it implies that the TTP is being trusted with private keys, otherwise there would be no way for it to recover anything. On the other hand, from their Q&A: Q: Will a TTP be able to access an encrypted message ? A: No. It is important to be clear that it is not envisaged that the encrypted communication would be routed via the TTP. Nor will the TTP encrypt the message, it will merely assist (depending on the service offered) in the very complex area of key management or Key Certification. If the TTP is not encrypting the data, they don't need the secret key or your private key. They DO need your public key, to sign it, so a second party can trust that a key they have is really yours. But you and the second party can use the signed keys to exchange a secret session key, or to sign documents, without the TTP's help.* So their primary description of what a TTP would do does not involve escrow. Keys are used for three things - communications, signatures, and storage. As discussed above, for communications, the TTP doesn't need your private key, and there's no business need for anyone to have the keys to decode a communication unless they already have the cyphertext. Business applications that do require a third party to have a copy of your _message_ can be met by sending them a copy of your message, encrypted with their key, and the document explicitly says it's not talking about them. Similarly, cell-phone companies are providing encryption and routing, so this document claims not to be about them, though it regulates them. The only third parties who need just the session key itself are eavesdroppers and forgers, who are Untrusted Third Parties. For signatures, there's also _never_ a need for the third party to have the private keys - the function you Trust the Third Party to do is to certify that the holder of the key either is who he claims to be or has the permissions he claims to have (e.g. to write purchase orders or sign contracts for Company X.) And the document even states that "There is, of course no intention for the Government to access private keys used for only integrity functions." The main time you want another party to have a copy of your keys is for stored data: to cover the "employee dies" case (the document explicitly permits companies to handle their own keys without regulation, so no TTP is needed here), and the "you die, and your family digicash is in your encrypted file system" case, for which you can give a copy of your key to your spouse or solicitor, or keep it on a floppy in your bank safe deposit box, all of which cases are presumably covered by current law in the UK just as they are in the US. SO - what _is_ all this malarkey about "legal access" and "key recovery" and "key escrow" systems? The document claims repeatedly that it's not purporting to regulate any of the conditions under which a Third Party would ever be Trusted with the keys you actually encrypted something with. There's a whole lot of material about restricting who can be in the business and offer these services, seemingly designed to either restrict the emergence of new services or to be later expanded to cover other parts of the encryption business, such as supplying encryption software. And it's very unclear about whether it covers the encryption services used in inter-corporate projects such as Mondex - as a stockholder and customer of some of those companies, this concerns me. In particular, the expansion appears to be targeted specifically at the UK end of the Stronghold Apache-SSL web server, Adam Back's RSA Munitions Shirts, the PGP and Crypto Software distribution site at Oxford, and Ross Anderson. [*There are non-public-key systems where the TTP handles the secret keys, but they're typically older or specialized military or banking systems, where the TTP isn't an independent party, and are generally superseded by public-key systems now that the technology is practical.] # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Reps. White and Bliley: requesting comments on crypto policy
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 24 Mar 1997 19:33:39 -0500 From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: FC: Reps. White and Bliley: requesting comments on crypto policy Reps. Rick White (R-Washington) and Tom Bliley (R-Virginia) have been busy sending out letters requesting comments on encryption policy -- and asking pointed questions. The letters have gone to: Lieutenant General Kenneth Minihan, Director of the National Security Agency Secretary William Daley, United States Department of Commerce Director Louis Freeh, Federal Bureau of Investigation Ambassador David Aaron, U.S. Special Envoy for Cryptology Robert Holleyman, President of the Business Software Association Ken Wasch, President of the Software Publishers Association Kathy Kincaid, Director of I/T Security Programs at IBM Attached is the one to the NSA. -Declan ******************* March 21, 1997 Lieutenant General Kenneth A. Minihan Director National Security Agency/Central Security Service 9800 Savage Road Fort George G. Meade, MD 20755-6000 Dear General Minihan: The Committee on Commerce has jurisdiction over all matters relating to interstate and foreign commerce, including commerce transacted over electronic mediums. One vehicle for interstate and foreign electronic commerce, the Internet, has experienced unexpected and exceptional growth. Our Committee has an obligation to ensure that the growth of electronic commerce over the Internet and other networks is not stifled by unnecessary or harmful regulation or policies. Thus, the Committee will be discussing what policies best promote electronic commerce over the Internet and other networks. The growth and success of the Internet and the World Wide Web as both a communications tool, and a medium for electronic commerce is unprecedented. Leading industry estimates indicate that the number of people using the Internet is increasing at the rate of more than 100% per year -- few technologies have had such quick acceptance into the daily activities of Americans. However, the full potential of the Internet as a means for conducting business transactions, or electronic commerce, has yet to be achieved. Most leading experts agree that a developed Internet, and corresponding intranets, have the capability to be engines for economic growth for those offering services over the Internet, and also have the capability to be a means for transforming business operations from one of paper-intensity to one conducted solely through electronic communications and transactions. Unlocking the full potential of the Internet and thus, promoting the use of electronic commerce has been difficult, in part, because of existing and perceived barriers, e.g., many consumers and businesses are concerned with the security and privacy of transactions that would occur over the Internet. A belief in the security of information passed over the Internet and through on-line services that use the public switched network will foster the continued growth of electronic commerce. Fortunately, the use of cryptography or encryption, either hardware or software, may provide a technological aid in the promotion of electronic commerce. We believe, however, that a sound encryption policy for both interstate and foreign electronic commerce must balance users= privacy interests with society=s interest in legitimate law enforcement and investigative needs and the needs to preserve national security. As you know, the U.S. has export restrictions on certain encryption products that may or may not interfere with the development of encryption products designed to secure communications and transactions. These restrictions have been the subject of recently proposed legislation in committees in both the House and Senate. Because of our responsibility over electronic commerce, we seek to have your views on a number of the issues related to the various bills. Therefore, we request that you provide written answers to the following questions by April 25, 1997: (1) With the understanding that there are no domestic restrictions on encryption products, please provide examples where national security may be jeopardized by the relaxation of current American export restriction policy, as incorporated in Executive Order 13026 and implemented, in part, in the corresponding Bureau of Export Administration rules of December 30, 1996. Are there remedies other than export restrictions that would provide the United States government the access it needs to encrypted communications, e.g., increased funding for new advanced computers? (2) How significant is your agencies= consultive role with the Department of Commerce within the current export restrictions? Should this role be strengthened or is it even necessary? How much additional application process time does your agencies= consultive role add to the Department of Commerce=s procedures? (3) It is commonly accepted that current encryption export restrictions imposed by the Administration will delay the proliferation of advanced encryption products, but that it is inevitable that advanced encryption products will be developed world-wide. In your opinion, do export restrictions prevent the development and distribution of advanced encryption products? (4) Are foreign import restrictions consistent with the Administration=s policy? Please identify the countries that have import restrictions and those that have stated their intent not to have any import restrictions. If the United States relaxes its export restrictions, do you anticipate that foreign nations will increase their import restrictions? In addition, we request that your staff analyze and submit their comments on the following: (1) the current export restrictions; (2) the congressional bills introduced that would alter export policy (H.R. 695, S. 376, S. 377); and (3) any other analysis related to encryption export policy your organization has prepared. Please have your staff contact John Morabito or Tricia Paoletta of the Commerce Committee staff at (202) 225-2927 if you have any questions regarding the above request. We thank you in advance for your assistance. With kindest regards, we are Sincerely, Tom Bliley Chairman Rick White Member of Congress ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/

1 0

Re: Analysis of proposed UK ban on use of non-escrowed crypto.
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

"Timothy C. May" <tcmay(a)got.net> writes: > (I could go on and cite dozens of examples. Did ASCII need the "force of > law" to make it a better standard? Did the government have to certify, > license, and regulate the makers of various implmentations of computer > languages? And so on.) Bad example, Timmy. I used to hang out with the standards people and yes, a lot of government purchases (both US and non-US) are mandated to comply with ANSI and ISO standards, which is why vendors push so hard to have their implementation declared the standard. Yes, U.S.Gov't does buy certified ANSI C, Fortran, etc compilers, not to mention ADA. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: UK to ban free use of crypto?
by jim bell 17 Dec '03

17 Dec '03

At 12:56 AM 3/24/97 -0800, Bill Stewart wrote: >The document is at http://dtiinfo1.dti.gov.uk/pubs/ >>It quite clearly does not intend to ban the use of cryptography or the >>publication of cryptographic software. > >And Michael Froomkin offers similar sentiments. They're both lawyers, >and I'm not (:-), so they're expected to do a better job of reading >the legal parts of it. On the other hand, the DTI says: > 57.The legislation will provide that bodies wishing to offer > or provide encryption services to the public in the UK will be > required to obtain a licence. The legislation will give the > Secretary of State discretion to determine appropriate licence conditions. >and it's got a really broad definition of "encryption services", >including even things such as time-stamping. Allowing government to "license" such services is a truly awful eventuality. If such organizations merely had to comply with limited number of laws, getting around those laws would be relatively easy. And the burden of proof (in many/most jurisdictions) is on the government to prove "guilt." But the moment you start "licensing" those organizations, the licensing terms may allow refusal or revocation of license for little or no reason, or hidden reasons: Perhaps the organization wouldn't "play footsie" with the government, giving up some information secretly and without a warrant. Potentially a large business goes down the drain. Licensing is, therefore, an invitation to an essentially unlimited amount of coercion and manipulation. Jim Bell jimbell(a)pacifier.com

1 0

No Subject
by Mix 17 Dec '03

17 Dec '03

Many forgeries are traceable with mathematical certainty to feebleminded Tim C[rook] May's poison keyboard. ( )( )________ Tim C[rook] May /00 \ _ O_\\--mm---mm /_______)

2 1

[IMPORTANT] Forgery detection
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Timmy C[rook] May's mother attempted to pro-choice the unwanted little bastard by fishing with a coat hanger in her giant cunt, but failed miserably to pull the rabbit and succeeded only in scraping out the contents of little Timmy's fetal cranium (not much to begin with). _ / ' | /><oo><\ Timmy C[rook] May //[ `' ]\\

2 1

Re: remailer spam throttle
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:46 PM 3/24/97 -0500, Andy Dustman wrote: >The first idea, which I've mentioned before, is requiring users to "sign" >a user agreement (magic cookie exchange) before they can send or receive >messages. This agreement basically states that the operator does not >monitor or filter based on content, and cannot trace messages back to the >original sender, and thus is not liable under US law for contents (check >some of the CDA provisions); and that the user is wholly responsible for >the legality of any messages sent. I think there are two broad models of complaints/problems with remailers: 1. The recipient is angry because they received a message they didn't like. (because it's an advertisement, or it's rude, or it's an image that their parents didn't like ..) 2. A third party is angry because the sender sent some information to the recipient which the third party thinks should not have been sent. (copyright, trademark, defamation, tortious interference with [prospective] contract, etc.) Your "contract" model (which looks like you really mean it to be a waiver of warranty/damages and/or an indemnification agreement) addresses (1) to the point of overkill, but it doesn't reach (2), because there's no contract with the third party, who is the party who's likely to be filing suit. (Indemnification by the sender might work, if you worded the contract correctly - but then you've got to abandon anonymity, and the value of indemnification from person you don't know whose assets/finances are unknown is pretty low.) Further, some fraction of the messages causing concern are message sent or available to minors .. whose contracts (modulo some exceptions) are voidable at their option. :( >The second idea, which I want to implement in conjunction with the above, >is to insert a disclaimer in the message body at the top of the message >with the important points (and references to) the user agreement, >including how to block messages. There would be a mechanism for clueful >users to disable this for messages they receive. This also works better for messages which are bothersome because of (1), but not (2). You can't, as a general rule, evade a duty imposed by law by posting signs saying "I'm not subject to a duty imposed by law." If it was that easy, we'd all be driving cars marked "GET OUT OF MY WAY, I'M NOT LIABLE IF I DRIVE INTO YOU". (Of course, such signs are still useful, if they trick people into not even thinking about suing someone who's got such a sign .. :) -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMzehnv37pMWUJFlhAQF/Jwf/QXgM9arbu4ERP4HwcNciKxfLLJFu7/0e yLEmuh0Nh7Ici0DbTtHK25ff8q/IHHMPZwuaNE9fXRhgewMvZKLrRXicBjpLisZE 3xjbuUwfqghyf9isa0vV6gOuGeZrzA10qqBFhze+kqkBN3qgT6Zk6c2xbT6rBxeA TaD4Nwpg0xBKjHZjP8IYeYOIxN0zEpa3YTV4PSWKieHj71nfpa7B4FUiPHWZUOqA x+p3oDV6dBkkkvxpASU5ifhTl0eRVO+xSidOZz6rF+cKyIELrk1A9j3BbdiwfyUy jmr/0kin8OEqEkvOSQ1SJipEvEQbhauMMzoKLpVwngdO3ErX1SB6gg== =QSem -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Announce: list-abuse mailing list
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Mon, 24 Mar 1997 15:12:13 +7 From: "John Buckman" <jbuckman(a)shelby.com> Subject: Announce: list-abuse mailing list To: listmom-talk(a)skyweyr.com Precedence: Bulk Sender: "ListMom-Talk Discussion List" <listmom-talk(a)skyweyr.com> Reply-To: "ListMom-Talk Discussion List" <listmom-talk(a)skyweyr.com> On the list-managers list, I suggested that a mailing list discussing how to prevent mailing list abuse might be useful. Based on the strongly positive feedback I received about the idea, I've gone ahead and created a "list-abuse" mailing list. I apologize to members of "list-managers" who have already received this announcement. General instructions about joining "List-Abuse" are available at: http://clio.lyris.net/list-abuse/ Alternatively, you can send email to: join-list-abuse(a)clio.lyris.net About LIST-ABUSE: LIST-ABUSE is an Internet discussion group working to stop abuses of Internet mailing lists. In particular, we aim to stop mail bombs, spoofed-subscribers, denial of service attacks, and other forms of "Mailing List Terrorism". Mailing list administrators, authors of mailing list software, and others interested in mailing list abuse are welcome to join. John John Buckman <jbuckman(a)shelby.com> Shelby Group Ltd., http://www.shelby.com/ Developers of Lyris Email List Server --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/

2 1

Tim C. May's Interpretation of the U.K. Proposal
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Timothy C. May wrote: > > The U.K. may sense that, absent such "local content" laws, the market for > key signings, time-stamping, and other services will naturally concentrate > in certain markets. > Longer term, the concentration may be more > globalized, or even in "cyberspace," but almost certainly not in Britain. > Nations may thus fear this flight of such services to other countries. Tim, at his best, interprets the U.K. laws from both a global and local perspective. Certainly, any actions of the U.K., in particular, should be viewed from the lingering shadow of the British Commonwealth. The U.K., having ruled an Empire, is much more cognizant of the implications of how the structure of proposed legislation will affect the expansion of global aims, or the protection of indigeonous rule. Although "local content," as Tim points out, is undeniably one of the major factors behind the legislation, the U.K. is also undoubtedly positioning themselves to resist letting the *power* that comes from information *control* fall into the hands of others. We have passed from the age when currency, alone, ruled. We are now truly in the Information Age, and those who wish to rule, to control others, must rule and control information. This is why the great battles of the day now surround standards and encryption, and encryption standards, above all. The US Bumverments reversal on encryption policy is not a result of enlightenment, but a result of other nations taking a leading role in encryption development. They have not really abandoned their plans to control all information, but have merely recognized that they must move their efforts into the global community before other powers have locked up the market. The only solution to the threat of global information control by one, or a few, players, is to promote the widest possible variety of encryption development. > So, besides the obvious OECD/New World Order interpretations, the U.K. > action may be a sign of something we may see more often: various countries > attempting to restrict extra-territorial uses of encryption services for > economic as well as for perceived national security reasons. Not just national security, but national *control*. Perhaps the U.K. is the first country to truly recognize and act on the threat of national borders falling victim to the global potential of new Internet technology. After all, they were one of the first nations to feel the sting of the printing press, and to experience the birth pains of the global changes that it would give birth to. Truly their is another great global war shaping up, but this time the battle will be fought with bits and bytes, and the battleground will be electronic. The winner will rule the medium. The medium IS the message. Those who rule the medium will rule the message. And in the Information Age, the message will rule the world. "In the beginning, was the Message. And the Message was with God, and the Message WAS God." McLuhan was a voice crying in the wilderness, an electronic John the Baptist. He, too, spoke of one who would come who was greater than he. And he warned of the evil one who would fight to rule the minds of all mankind. He warned of wolves, in sheep's clothing, who would claim that their aim was to protect us from pornographers and drug dealers. Well, not in the King James version, perhaps, but I am certain that it was worded that way in "Tim's Vernacular Translation of the Bible." TruthMonger N o t D r. R o b e r t s ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0