December 2003 - cypherpunks-legacy

Re: This is not "cash" if the government demands a report...
by azur＠netcom.com 17 Dec '03

17 Dec '03

At 4:51 PM 4/29/97, Kent Crispin wrote: >On Tue, Apr 29, 1997 at 01:01:59PM -0800, Tim May wrote: >> At 11:26 AM -0800 4/29/97, Kent Crispin wrote: >> >> >I was refering to your purchase of the 'vette -- presuming the dealer >> >followed the law, the sale would be reported, and the amount, and >> >hence the transaction is not anonymous, even though you paid cash... >> >> Ah, Kent, so you are citing the government's intervention in cash >> transactions (part of the War on Some Drugs, of course) as evidence that >> cash has flaws. Well, I wouldn't call this cash, not if the government >> demands that True Names be taken down and reported. > >OK. What would you call it, then? Perhaps you could think of another >catchy, short name for those greenish bits of paper and circular metal >objects I have in my pocket that I use to pay for lunch? The coins in your pocket are 'legal tender' or currency, a non-intrest bearing bearer bond issued by the treasury. Ecash and its ilk are private currencies, similar in some ways to traveller's checks and money orders which are unsecured and uninsured debts of the issuer, but legally closer to the tokens issued at an amusement park or or the premium stamps (like Blus Chip or S&H Green) which have all but disappeared. Constitutionally, the government has only limited rights to restrict private the issueance and use of private currencies (Stamp Act of 1861 and its current codification under Title 18.) --Steve PGP mail preferred Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 Key available on BAL server, http://www-swiss.ai.mit.edu/~bal/pks-toplev.html --------------------------------------------------------------------- Steve Schear | tel: (702) 658-2654 CEO | fax: (702) 658-2673 First ECache Corporation | 7075 West Gowan Road | Suite 2148 | Las Vegas, NV 89129 | Internet: azur(a)netcom.com ---------------------------------------------------------------------

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 08:40 4/30/97 -0500, Bradley Felton wrote: >What is needed is a "Bonsai" government, that is kept carefully pruned into >exactly the desired shape, and is never allowed to outgrow its pot. With >this analogy in mind, I would posit: > >4) Insufficient pruning mechanisms. I've proposed what I consider to be a very efficient and effective "pruning mechanism." However, I've also suggested that it would continue pruning until the size of government reached zero. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 21:32 4/29/97 -0800, Tim May wrote: >At 9:15 PM -0800 4/29/97, Jim Bell wrote: >>For example, I consider a major nuclear powers' possession of nukes to be >>one of the most serious examples of "nuclear terrorism" there is, but on the >>other hand I believe that an appropriate use of crypto (AP) could force any >>owners of nuclear weapons to dismantle them. Few people challenge this >>claim. If I'm right, crypto is a solution rather than a problem. Why not >>remind that journalist that her false impression is the real problem, not >>crypto. > >I believe you are incorrect that AP would force dismantling of nukes, for >reasons I am weary of repeating (you repeat your matra, I repeat mine), Well, you're entitled to be wrong! B^) I have always been willing to defend my assertion, and since it hasn't been discussed recently I think it's not too soon to rehash, as weary as you may be. Assuming AP works in particular, and crypto-anarchy works in general, both will work to reduce and minimize the "height" and size of government entities everywhere. Looked at from a cost/benefit standpoint, since nuclear weapons are generally of a certain minimum size and cost, they only "work" if the enemy is sufficiently numerous and segregated from the non-enemy populace to make attack with a large bomb effective. Reduce the size of the largest government unit, and it's harder to find a useful target, thus reducing the benefit of owning nukes. Also, if an AP system were available to an individual or group that previously owned nukes, it would be a far more economical (and specific) tool to defend itself from enemies of a certain limited size. (you can't nuke a terrorist cell, for instance, at least not without making far more enemies than you originally had.) At some point, nukes will become far "larger" a weapon than any owner can reasonably use, and at that point he will disassemble it due to sheer uselessness. (if you don't believe that the average size of the potential nuke-owners will get smaller, then you obviously don't believe in AP and/or crypto-anarchy!) AP dramatically increases the "cost" of owning nukes as well: If I were free to do so, I'd be happy to donate money to help force the few nuke-owners to dismantle their bombs. Assuming more than a small fraction of the population is sympathetic to this use of AP (and even if they generally would oppose other uses) this will work. Nukes won't be useful to "fight back" against AP and/or crypto-anarchy, and in fact threatening their use will do nothing except strength the argument in favor of the development and use of AP as an anti-nuke tool. Generally, in order to claim that a fully-functioning AP system WON'T dismantle all nukes, you've got to be able to postulate the kind of nuke-owning organization that could survive in a post-AP world, and further suggest what reason that organization would have to own them. > but >I agree that serious discussion of such game-theoretic issues is just too >scary, too extreme, too un-American for almost everyone. You'd be surprised. Since having had at least my second "15 minutes of fame" locally, I've had many discussions of the AP concept with average citizens. Admittedly, many of them were no more familiar with the cryptographic details than you might expect, so they pretty much accepted that part of the proposal as a given. However, every one of them seemed to accept the idea that if my system would do, generally, what it appears to do from first principles, the conclusion that it would shut down militaries and dismantle nukes follows directly. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by Lucky Green 17 Dec '03

17 Dec '03

At 08:40 AM 4/30/97 -0500, Bradley Felton wrote: >What is needed is a "Bonsai" government, that is kept carefully pruned into >exactly the desired shape, and is never allowed to outgrow its pot. With >this analogy in mind, I would posit: > >4) Insufficient pruning mechanisms. The pruning mechanism was put in by the Founding Fathers in form of the Second Amendment. The problem was that the People decided they wanted to give up the pruning mechanism for some (perceived) temporary safety. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

1 0

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 17:19 4/30/97 -0800, Tim May wrote: >(A copy of this message has also been posted to the following newsgroups: >alt.cypherpunks, talk.politics.crypto, comp.org.eff.talk) >CDT and other Washington insider groups are busily singing the praises of >the SAFE encryption bill, despite some acknowledged "minor flaws." > >Well, the flaws are not minor. The bill does not give Americans any rights >they do not already have, and does not ease export of strong crypto in any >meaningful way. In fact, the bill contains odd language implying it is >essentially only financial software which is easier to export, and then >only if the receiving country (huh?) allows it...since when is the duty of >U.S. Customs to pass products for export based on whether Baluchistan, for >example, wants the product? I agree with everything you've said, here. SAFE is truly awful if it attempts to make use of encryption illegal. Prosecuting the underlying crime, if a crime was done, should be considered more than enough. The thugs are afraid of getting whacked. Jim Bell jimbell(a)pacifier.com

1 0

Re: Rejecting Dialog with Government Vermin
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

At 23:07 4/29/97 -0700, Kent Crispin wrote: >3) There is no serious flaw -- the current government isn't as >bad as we claim. Or, put another way, the evils we see are a function >of size of government, and size of government is more a function of >population than anything else -- the larger the population, the >larger the government. > >I think that strong arguments could be made for any of these, though #3 >would be shouted down in this forum. I disagree that a "strong argument" could be made for item #3. Sure, some people would strenuously ATTEMPT to make that argument, but they would fail miserably. I feel confident that a statistical analysis of various countries' governments would reveal a wide scatter in the relationship between population and government size. One of the main factors in this scatter is simply the amount that government has decided to butt into activities that could (and should) be privatized. Another is the amount that the government steals from one group in order to reliably receive the votes of some other group. Population size would end up being a very poor determinant of government size. Jim Bell jimbell(a)pacifier.com

2 1

Problems with SAFE bill
by Declan McCullagh 17 Dec '03

17 Dec '03

I've received a few comments along the lines of "Why are you supporting the SAFE bill?" Here's my post to f-c about it from last week that might give some background. In short, I think this legislation is not good. -Declan (I sometimes forget to send f-c posts to cypherpunks, even when they're on-topic. If you want to join, subscription info is at the end.) ---------- Forwarded message ---------- Date: Thu, 24 Apr 1997 18:17:09 -0400 From: Declan McCullagh <declan(a)well.com> To: fight-censorship-announce(a)vorlon.mit.edu Subject: FC: Crypto moves forward: Commerce Dept panel and SAFE markup Encryption is again bubbling to the surface of Washington politics. Today the Department of Commerce announced that it was creating a new committee to advise it on crypto-issues. A department official told me it would be composed of "businesses that export encryption," and interested parties have 15 working days to file comments. A way for the White House to split industry opposition and persuade high tech firms to buy into key escrow? Hmm... On the Hill, crypto legislation that would lift export controls is about to advance farther than ever before. (Last fall, Sen. Exon killed any chance that pro-crypto legislation had in the 104th Congress.) Rep. Bob Goodlatte's crypto bill (SAFE) will move to subcommittee markup next Tuesday at 2 pm in Rayburn 2237. After the full committee reports the bill, it moves to the international relations committee. Sen. Conrad Burns also would like to move forward with his Pro-CODE bill in May. Problem is, Goodlatte's SAFE bill, which has about 70 cosponsors, does more than just relax export controls and prohibit mandatory key escrow. It also creates new criminal penalties for using encryption to further a criminal act. Now, some say that it's innocuous -- and a good tradeoff for getting export controls lifted -- but I'm not convinced. When encryption is widespread and present in telephones, radios, cell phones, wireless modems, web browsers, televisions, and maybe light switches, *any use* of any electronic appliance will involve encryption. (Who wants a hacker playing with your toaster?) Remember that Maryland bill that would criminalize sending "annoying" or "harassing" email? If the Goodlatte bill became law, Marylanders who signed their messages with PGP or telnetted to local ISPs could be slammed with an all-expenses-paid trip to the Federal pen for five years. In other words, SAFE would turn state misdemeanors into Federal felonies. This is not good. A coalition of groups is sending a letter to Goodlatte tomorrow supporting the bill but expressing concern over the criminalization provision. Interested in signing on? Email David Sobel: sobel(a)epic.org. -Declan ***************** Security and Freedom Through Encryption (SAFE) Act (Introduced in the House) `Sec. 2805. Unlawful use of encryption in furtherance of a criminal act `Any person who willfully uses encryption in furtherance of the commission of a criminal offense for which the person may be prosecuted in a court of competent jurisdiction-- `(1) in the case of a first offense under this section, shall be imprisoned for not more than 5 years, or fined in the amount set forth in this title, or both; and `(2) in the case of a second or subsequent offense under this section, shall be imprisoned for not more than 10 years, or fined in the amount set forth in this title, or both.'. ***************** Federal Register, April 24, 1997: DEPARTMENT OF COMMERCE President's Export Council Subcommittee on Encryption; Notice of Establishment The Secretary of Commerce has determined that the establishment of the President's Export Council Subcommittee on Encryption is in the public interest in connection with the performance of duties imposed on the Department by law. The Subcommittee will advise the Secretary, through the Assistant Secretary for Export Administration, on matters pertinent to the implementation of an encryption policy that will support the growth of commerce while protecting the public safety and national security. The Subcommittee will consist of approximately 25 members to be appointed by the Secretary to assure a balanced representation among the exporting community and those Government agencies with a mandate to implement policy regarding encryption. The Subcommittee will function solely as an advisory body. Interested persons are invited to submit comments regarding the establishment of the Subcommittee to Lee Ann Carpenter, Committee Liaison Officer, OAS/EA/BXA, U.S. Department of Commerce, MS: 3886C, Washington, D.C., 20230. Telephone: 202-482-2583. FAX: 202-501-8024. Dated: April 18, 1997. Sue E. Eckert, Assistant Secretary for Export Administration. [Thanks to JYA. --Declan] ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/ -------------------------------------------------------------------------- This list is public. To join fight-censorship-announce, send "subscribe fight-censorship-announce" to majordomo(a)vorlon.mit.edu. More information is at http://www.eff.org/~declan/fc/

1 0

Eternity service proxies
by Adam Back 17 Dec '03

17 Dec '03

[btw what do people think of the practice of putting To: cypherpunks, and Bcc: coderpunks@toad, cryptography@c2 as I have done here? I do this for stuff when I'm interested in comments of people who are on cryptography but not cypherpunks, similarly for coderpunks to avoid the non-crossposting issue with coderpunks, and avoid extra moderation work for Perry with cryptography. I know you get multiple copies if you're on all lists, how else does one reach you all? Myself I have a procmail recipie which junks multiple copies, like: :0 Wh: msgid.lock | formail -D 128000 msgid.cache ] My announce was rather hurried, and someone suggested to me the use of a proxy as an architecture for interfacing to the eternity service rather than the cgi based system I have. The person who suggested this to me also described some work on a "universal proxy framework" which is designed to enable things like "cookie-cutting, onion routing etc." Also it was suggested this is a cheaper way to implement a proxy. Here are some comments on possible architectures for an eternity service. There are a number of places where one might put a eternity server: - cgi script on your ISP for yourself and others to use - cgi script and local web server on your dial up linux box - standalone eternity proxy running on an ISP - local proxy - proxy framework module (local or remote? does it support both) - apache module "eternity proxy module" - browser plugin (if this has the power to do it) My ideal interface would have been a web proxy, as this allows the user to transparently integrate this into their browser. You may be able to set your browser to use the proxy to handle *.eternity, and have the rest go direct, but I'm not so sure on this point. Regardless, the proxy can forward requests as cacheing proxies do for documents not in *.eternity. My first consideration was to get a proof of concept going as quickly as possible. What you are looking at is a weekend hack + 3 days debugging and cleaning up. Proxies have higher user requirements to set up, you need root, or at least ability to leave processes running indefinately, and some mechanism to restart them on reboot (or do it manually). My cgi-bin implementation allows you to run with cgi access, and cron, or at a pinch to do without cron even. Local proxies have higher development costs, in that it involves windows code to be of use for the majority of users, which has much higher development cost. The universal proxy framework (which I am not familiar with) would allow a local proxy to be implemented more easily if I understand correctly. Local handling of at least the last layer of decryption would help from a security point of view. Or the local proxy could be a full eternity server for your own use. The ones I've made possible with my cgi based implementation are the first two, I chose them over proxies simply because they are the easiest to implement first. Basically what I have implemented is a poor mans remote proxy or (with a local webserver) a poor unix person's local proxy. You give it URLs of the form: http://www.foo.com/cgi-bin/eternity?url=http://blah.eternity/blah/ The cgi script modifies on the fly URLs in documents (if they are type text/html) and involve *.eternity to have prefix: cgi-bin/eternity?url= Well actually it copes with local, and site relative urls also (where site is the eternity virtual site). Normal URLs are left as is. Proxy is the more elegant way to do it as you don't have to re-write urls on the fly. There are advantages to running the server (proxy or otherwise) on an ISP rather than locally: - if you're using the cgi solution and an SSL web server you get SSL encryption on the link. This way people don't get to see your requests, if they are handled locally by your ISP from it's news spool. - it has lower bandwidth requirements which may be an advantage, as you don't have to down load all the eternity documents, only the ones you want to read as you browse them - if the eternity server is running on your ISP and the ISP has a local newspool people outside the ISP can not see your requests go to the NNTP server to see which articles you are reading. There are some advantages to local proxies: - you don't rely on the ISP or the eternity service operator not to log exdirectory URLs, and not to log your accesses. (However note that your ISP can observe your use of the NNTP server, unless you protect against this by saving all eternity web pages locally, so that you never have to do a NNTP lookup per article). - if you are accessing URLs which are private (encrypted with a password inside the final layer) you don't need to give this password to the server to get it to decrypt for you. (You don't need to with the remote proxy, but you get back a PGP message which you then have to manually decrypt, unless you can figure out a browser plugin to automatically decrypt PGP documents on the fly as they are read). A local proxy used in combination with remote proxy or cgi-proxy would allow another architecture. Your local proxy obtains it's article hash -> message-id/newsgroup/article-number database from a real remote eternity proxy which is watching news as it comes in. Then it can fetch the articles itself with lower overhead. Another architecture (moving more towards Anderson's meaning of an eternity service) is the idea of forwarding requests between eternity servers. In this way the eternity servers would be "remailing" your requests. If your entry point into the eternity service network was via an SSL protected link, and the links between the eternity servers were encrypted, the eternity servers as a whole would disguise who was accessing what. You could allow proxying of normal web pages too, and create a distributed version of anonymizer.com as a side effect. Adam -- Have *you* exported RSA today? --> http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

3 4

Privacy news: Oakland Cameras, Levi employee files, FileGate
by Bill Stewart 17 Dec '03

17 Dec '03

It's been a busy day for privacy issues in the Oakland Trib. Surveillance Cameras in Oakland ------------------------------- Bay Alarm is trying to sell the City Council a $500K-$1.5M closed-circuit TV system for watching people in public places. The three picknickers didn't litter, but the camera mounted on the public library building could zoom in enough to that the council could tell a ham sandwich from roast beef, and whether the two joggers were wearing Nikes or Reeboks. "Anybody who is a law-abiding citizen is not going to be concerned about this.. "When I'm out in a public place.... I don't have an expectation of privacy" said Councilcritter Nate Miley (East Oakland/Elmhurst), who wants a test run in his district, where residents have bars on their windows and are afraid to go out at night. Police Chief Joseph Samuels likes it too. "This is technology spying on our citizens from camera on light poles" said John Crew of the ACLU police practices project, speaking against it. Bay Alarm said that some British cities have dealt with privacy fears by setting up monitoring centers away from city and police offices, where tapes are kept in case a crime occurs -- crime victims can call up the police and ask them to play back tapes, said Mark Demier of Bay Alarm. The camera systems are also capable of taking pictures in the dark. Personnel Data Theft Plaguing U.S. Firms --------------------------------------- Levi Strauss & Co. recently had a disk drive stolen from an office computer. It had background information on over 20,000 current and former employees, including names, addresses, SSNs, birthdates, and bank account numbers. It appeared to be just a crude theft of the $500 hardware, rather than somebody trying to steal the information itself, and is "not likely" to be used fraudulently because it's "written in a language difficult to decode", but the affected employees have been notified. Dave Banisar of EPIC is one of the various experts quoted. Insiders Chip In for FileGate Fall Guy Defense ---------------------------------------------- Remember FileGate, with the White House accessing confidential background files of hundreds of Republican Administration workers? Remember Craig Livingstone, White House staffer who resigned after it was revealed that his office was responsible for it? Well, he was never charged with anything, but he had about $9550 in legal expenses to advise him when he talked to Congress, and apparently 55 of his good friends decided to help him out. Hillary Clinton's chief of staff gave $50, Bill Clinton's golf partner Vernon Jordan gave $250, D.C.City Council member Charlene Davis gave $100, and overall it averaged out to about $200 per insider. Petty cash, perhaps, but it goes to show you the Clinton Administration's attitudes toward violation of privacy and abuse of power. Needless to say, the Associated Press story was a bit more balanced in tone than my summary here :-) ---- And in other news, San Leandro High School students, mostly the drama club, led a protest against against a proposed school board policy that would ban profanity, obscenity, libel, or slanderous speech in school-produced publications and productions. (Out, Out, <censored> spot!) "We want to be able to have the plays we've had in the past", said Sean Givens. "We're not doing profanity, we're doing ideas." Last year the drama department canceled a production of "The Breakfast Club", though it was allowed to go on with modified language. And Mike Royko died. The world will be a quieter place without him. He'll be missed. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

3 2

Re: SAFE Bill is a Disaster--"Use a cipher, go to prison"
by geeman 17 Dec '03

17 Dec '03

At 05:19 PM 4/30/97 -0800, Tim May wrote: ..elided.. > >""§2804. Prohibition on mandatory key escrow > >"(a) PROHIBITION. -- No person in lawful possession of a key to encrypted >information may be required by Federal or State law to relinquish to >another person control of that key. >"(b) EXCEPTION FOR ACCESS FOR LAW ENFORCEMENT PURPOSES.-Subsection (a) >shall not affect the authority of any investigative or law >enforcement officer, under any law in effect on the effective date of this >chapter, to gain access to a key to encrypted information. " > >Sounds good...a ban on key escrow, right? No, because "EXCEPTION FOR ACCESS >FOR LAW ENFORCEMENT PURPOSES" could easily be used to mandage key escrow. >After all, even Louis Freeh and Dorothy Denning have never argued that key >escrow is for use by non-law enforcement! > I'd like to point out that the key phrase in there seems to be "under any law in effect on the effective date of this chapter" -- altho it's gobbledegooked, the intent seems to say "if there is no law in effect mandating GAK when this bill becomes law, there can never be a law passed which does" Or in other words, it has the effect of making GAK no better, or worse, than under current law, while preventing passage of GAK laws in the future.

2 1