December 2003 - cypherpunks-legacy

IBM sues critics?
by Secret Squirrel 17 Dec '03

17 Dec '03

According to a usually reliable contact in a position to know, IBM Friday filed a liable suit against the 11 authors of the study titled "The risks of key recovery, key escrow and trusted third-party encryption" plus their employers and the Centere for Democracy and Technology, which sponsored the report. According to my contact, IBM feels that the report directly targets their own key recovery system, and falsely implies that it isn't reliable. They are asking for unspecified damages. This means IBM is suing such people as Matt Blaze, Whitfield Diffie, and Ronald Rivest, along with AT&T, Sun, Microsoft, and MIT over the question of whether its key recovery system really works. Considering that truth is a defense and the details of the IBM system could be part of the defense's evidence, it should be an interesting trial to say the least. I have not seen the actual court papers and really have no idea whether my contact is totally accurate. Can anyone confirm the details? I just read the study in question, and it sounds like IBM is totally out of line and trying to intimidate its critics with threats of expensive if frivolous lawsuits. On the other hand, some of the parties named in the suit (Microsoft, AT&T) have their own armies of lawyers to defend themselves, so it's hard to be sure of what's going on here. I think the report is still at www.crypto.com or www.cdt.org.

4 3

Democratic Assassination
by Pilgrim 17 Dec '03

17 Dec '03

> Instead of putting child pornographers in prison we will put >cryptographers and remailer operators in prison. Instead of >confiscating the assets of drug czars will confiscate the assets >of people who have a kid who smokes a joint once a week. Instead >of censoring legislation which limits our freedom and privacy >we will censor literature which proposes democratic assassination >of those who oppress us. Whoa there bud! I have a nagging feeling that democratic assassination is a large can of worms than we realize. There is something fundamentally wrong with a society that is built upon the notion that those people who do and say unpopular things deserve death. Yet that is exactly what a system of "democratic" assassinations would do, enable a large group of people to intimidate and subvert a smaller group of people. So, for the sake of argument, let this system of anonymous democratic assassination come to pass...then what? Utopia? Maybe.... But let's say that someone comes along later, proposing a way of living that is radically different from the norm. Exhibiting a nasty characteristic that has been inherent in the human races for eons....even before the rise of large sprawling governments....the majority of people decide that they don't like this troublemaker....through the process of democratic assassination...this person is now dead. Forget even the shade of a possibility that this person may have been right...that his way of living ***may*** have been better than the norm. Right and wrong don't matter. Popularity and the "mood of the crowd" do...this person said somethig unpopular, and is dead because of it. Freedom of speech? Let's say that a group of people suddenly become unpopular. Perhaps times are tough and the majority need a scapegoat. Maybe this group of people have been long oppressed and are finally fighting back. Through a system of democratized assassination....their leaders are dead....with no one willing to take their place (out of fear)....maybe a few other random people are killed just to really get these people quaking in their boots. Or let's take it one step further. If democratic assassination is good, why not democratic genocide. Let the people take a vote, and if the scale tips the right way, an entire group of people need killed. Is this good? Let's take a step further. Going back to my first example, let's say that someone comes along proposing a new way to live, and many people take to it and follow this person. Unfortunately, this person has just happened to make a few powerful enemies. Through a system of "democratic" assassination, this person is now dead...and there is no way to catch his/her killers. Is this even democratic? Even if digital cash, anonymous remailers and strong encryption could enable us to set up a democratic system of assassination (which it couldn't)...I still wouldn't want to live in a society where killing is democratized...I do not want to live in a society where people can abitrarily take a vote on whether I should live or die.... Just because a majority of people like an idea, does that make the idea any more right or any less wrong? I (and I would wager you) do not want to live in a society where it is dangerous...even life threatening to be unpopular, and to go against the flow. I know that I hold fast to ideas and beliefs which are hardly considered popular....the only reason I'm not socially scorned, right now, is because I'm very diplomatic about them.... You wrote a lot about "The Machine," as if it was some real, intelligent, calculating conscience. It is not. While I do not doubt that "The Machine" exists, it is not something that is tangible....it is a system...a way of doing things...a set of entrenched powers...it is not a person. "The Machine" won't be defeated by killing. Its weakness is far more subtle..and takes a lot longer to exploit....but that's another story...for another listserv. That IRS guy that you want to kill? Sure, he might work for "The Machine," but killing him won't solve anything. Hating him won't solve anything. It might be a short term fix, but there will be others. And perhaps, if you stop and look at that IRS guy whom you hate so much...you might find that 1) He has parents, maybe even a wife and children, all of whom love him 2) He gets tired and night, and has to use the bathroom 3) He gets happy, sad, lonely, depressed, He's another human being....just like yourself...indeed, the only difference between himself and yourself is how he makes a living. And maybe...just maybe...he is just as big a victim of "The Machine" as you are. Of course, I'm not accusing anyone of wanting to kill anyone...or hating anyone. I'm just throw this out because it is food for thought. You write so much about "The Machine" causing division and hatred between people. Perhaps "The Machine" has manipulated you more than you realize. Justice rarely comes out of hatred. Regards, Pilgrim Regards, Pilgrim

2 3

Re: Anonymous proxies & ITAR question
by Rich Graves 17 Dec '03

17 Dec '03

Also sprach nobody: >Under ITAR regs, if a "foreign national" was to use the server to get >access to "munitions" (sure, software kills, didn't cha know?), could I be >held in violation? > >Even if all they had was circumstantial evidence, I'd really like to avoid >being indicted - puts a real kink in one's social schedule. > >Your thoughts on this would be appreciated. This is why we need more remailers, and why it's good that you posted anonymously. The proper thing to do is to be "shocked, shocked!" that anything illegal is happening on your server, immediately shut it down (counting on the network to be self-healing with the help of an enhanced remailer list), and offer to cooperate fully. Unfortunately, you don't keep logs, so you wouldn't really be able to help (damn!). -rich http://www.stanford.edu/~llurch/

4 6

Impact of Netscape kernel hole (fwd)
by Paul Bradley 17 Dec '03

17 Dec '03

>It'd be nice to have more specifics about the whole situation, but >regardless - any preliminary threat assessments? Exactly how widely >exploited do you think this has been? > >Tim's post (although refuted by Marc) raises some serious issues since I >suspect that Joe Public has his secret key sitting in c:\pgp\secring.pgp > >Some coherent input on the possible impact of this would be appreciated. Basically the threat model is very simple: Joe "slightly crypto-savvy pgp user" sixpack keeps his pgp keyring in c:\pgp on a dos/w95 box. The average user of any of the unices keeps his keyring in /usr/pgp or /usr/local/pgp it does not take a lot of attempts to go through most of the common places. The very same guy probably has a password that is: A. FRED (notice how close the letters are, this is a real dumb-ass password of the century) B. His wifes name C. Her birthday D. The name of his favourite film or some character from it... Can you say "dictionary attack"???. I must admit I personally, against all the rules, keep my pgp secret key on this box. This doesn`t worry be greatly because: 1. I have a strong passphrase. 2. This box is only on dialup, so is not connected for long, and I VERY rarely use the web anyway, Its too slow, so I prefer ftpmail and ftp for getting files. This corresondingly reduces the risk of me having used a site that exploited this hole. 3. If I ever have anything to recieve that needs to be really secure I use a one time key pair, so even the RSA key is one time. Most PGP mail I send or recieve is fairly innocuous and the use of encryption is just precautionary, ie. to stop nosy sysadmins. What it basically comes down to is that Joe Sixpack, the guy most likely to have his key compromised by this attack, is: 1. Not likely to be sending valuable enough mail to expend time mounting even a simple dictionary attack on his key. 2. The least likely to know about, understand or respond to this flaw. So basically the threat is the usual one: The stupid will get caught. If you are sending highly criminal mail your key shouldn`t be on any machine not 12 feet underground in a concrete bunker with 24 hour fully trusted security guards, CCTV etc. etc. anyway. Datacomms Technologies data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: FC76DA85 "Don`t forget to mount a scratch monkey"

5 5

Re: Flag Burning...
by Peter Trei 17 Dec '03

17 Dec '03

"RS" writes: I'm curious as to why you feel the need to conceal your identity. > When it comes down to flag burning, It really bothers me that we allow our > symbol of freedom to be burned. It's more than a flag and a right. It's a > symbol of the freedom we have. To allow someone to publicly burn a flag is > essentially displaying our freedom being burned. It's a symbol, not the thing symbolized. You are confusing the map with the country. Burning the flag is a statement by the burner that they feel that the symbol has become empty, and the freedom which the flag symbolizes is gone or has been compromised in some manner. It's clearly a form of political speech. True, It's a very strong statement, but strong political speech has been protected by the Constitution (at least up till now). > Bush was a veteran, and Clinton was not. I take it the ones who are > writing on this subject about how we should have the "freedom" to burn the > flag have never served in the military or for our country. You are mistaken - some of the people opposing your viewpoint have stated that they are veterans. > Being a veteran myself, I find it very distateful to allow anyone on our > soil to be allowed to "BURN" our symbol of freedom. Think about the flag > for a moment and what it really stands for. Does it not stand for freedom > and liberty? It does *stand* for freedom and liberty, but only as long those values really exist. It *is* *not* freedom and libery in it's own right. When what the flag symbolizes is gone, it becomes just a piece of cloth. Burning this cloth draws attention to the loss. It is a dramatic statement, but under certain circumstances an appropriate one. > Sorry, I just had to let this out. I stand behind Bush on this one. Don't > burn the flag unless you would like to live under another flag! Thank you for your opinion. You are of course free to express it. And I, and other thoughtful, freedom-loving Americans can oppose it. Think about this: Would you rather people did not burn the flag because: 1. They'll be thrown in the slammer if they do. 2. The revere the values for which it stands, and will not descrate a meaningful symbol of these values. In (2), we can look at the (very rare) individuals who *do* burn the flag, and determine for ourselves if they have a valid point to convey. In (1), we'll never know. For Congress to deny the freedom to burn the flag is a desecration of what the flag stands for - a descration of the flag by the government itself. Peter Trei trei(a)process.com Disclaimer: I represent only myself in this article.

3 2

Re: Hettinga's e$yllogism
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> Digital Commerce *is* Financial Cryptography, > Financial Cryptography *is* Strong Cryptography, > therefore, > Digital Commerce *is* Strong Cryptography. > and, therefore, > No Strong Cryptography, no Digital Commerce. Why can't escrowed ecash support digital commerce? Strong crypto with a government backdoor. That's what you're offered. Prove it can't work. Anon

5 4

Re: Canarypunk: Jim Bell in a coalmine
by Blanc 17 Dec '03

17 Dec '03

At 02:38 PM 6/22/97 -0400, Robert Hettinga wrote: >Admittedly, this is a distraction from the most important thing, which is >writing code, but I bet that there are in fact cypherpunks-who-don't-code >in Bell's neighborhood, and not necessarily even Friends of Jim, who would >be happy to personally go see how Bell is doing and come back and tell us >what happened. Think of it as part of the feedback loop for net.freedom. A >trip into the coal mine with a canary cage. > >Yeah, I know. It's me making work for someone else. Nonetheless: Anyone out >there want to do this? ............................................................................ ..... I live about an hour's drive from Tacoma. I'm not too enthused about taking such a lengthy trip just to go see how Mr. Private Assassinations is doing, but - taking after your own methods, Robert - I'd be glad to do it in exchange for a trip to Anguilla next Feb. :>) (You know, it is true that having friends in times of stress, like when you're sitting in jail, is good for the soul, but on the other hand one must give credit to Jim for his having created his own situation. He did provoke the government types into suspicions about him and he must have known that distributing his AP ideas, containing such apparent potential for being translated into reality, would make him a grand target. When you do things like that, you ought to consider what you're going to do when "they" come after you. He afterall is quite aware of the atmosphere in which we live and how fragile is the relationship (if it can be called that) which civilians have with the local military saviors which daily protect us from ourselves.) Having said that, I'll consider the possibility, if visitors are allowed on weekends. Perhaps several cpunks could go (if anyone else around here interested? (Wei, Joel, I know you're just dying to go <g>)), if more than one visitor at a time is allowed . .. Blanc

2 1

Re: New Laws in Oregon - "Land of the Legal betatest"
by Ryan Anderson 17 Dec '03

17 Dec '03

On Sat, 21 Jun 1997, Roy M. Silvernail wrote: > > How do you propose to deal with such things as the Telecommunications Act > > of 1996 (which incidently included the CDA)? I can see a problem where > > one sentence or clause gets thrown out of a major bill (say a compromise > > budget, that someone screwed up one minor ammendment), and if you have > > that happen 3 times in 6 years, you've lost 90% of your senators! I'm not > > saying that your idea isn't without merit, just that it's got a few > > problems that strike me as somewhat major.. > > Please elaborate, as I can't see _any_ problem with eliminating 90% of > the sitting legislature. You've completely missed my point. This would be an on-going problem. Congress can only function with some idea of compromise in it. When you're passing budgets, especially the kind of budgets we have right now, they get big and complicated, I can't see that changing significantly, even with a massive turnover of members. But having no consistency in Congress at all, even for some "good" reps would be horrible. ----------------------------------------------------------------------- Ryan Anderson - <Pug Majere> "Who knows, even the horse might sing" Wayne State University - CULMA "May you live in interesting times.." randerso(a)ece.eng.wayne.edu Ohio = VYI of the USA PGP Fingerprint - 7E 8E C6 54 96 AC D9 57 E4 F8 AE 9C 10 7E 78 C9 -----------------------------------------------------------------------

6 8

Re: CDT Policy Post 3.08 - Senate Committee Approves Key Crypto Bill
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Sat, 21 Jun 1997 12:18:09 -0700 (PDT) From: Declan McCullagh <declan(a)well.com> To: Paul Spirito <spiritop(a)slic.com> Cc: fight-censorship(a)vorlon.mit.edu, Charles Platt <cp(a)panix.com> Subject: Re: CDT Policy Post 3.08 - Senate Committee Approves Key Crypto Bill I'm much more intersted in looking at the motives not of the minority who voted for ProCODE II, but at who endorsed the final McCain-Kerrey bill and reported it out of committee. Keep in mind that civil liberties and business groups across the spectrum are unanimous in condemning the McCain-Kerrey bill as evil. But which senators on the full Commerce Committee voted against it? Did Ashcroft? Did Burns? -Declan On Sat, 21 Jun 1997, Paul Spirito wrote: > 1) The senators who voted for the pro-CODE "compromise" were acting > about as principled as senators normally will.

1 0

spook pressure on crypto exports
by John Young 17 Dec '03

17 Dec '03

Adam Back asked for info crypto export news for AU, IE and NZ, which I echo. I recall that Peter Gutmann has a standing request for crypto export info from anywhere. We'd like to host any reports that come in. For those who've not seen it, his report on his bizarre trials is at: http://jya.com/nsazeal.htm And a report on a weirdly similar UK experience by Mike Cobb is at: http://ukeep.htm Documenting the various international experiences is a worthy accompaniment to those of Bernstein, Karn and Junger, and about the only way to expose global GAK at work. It seems to be spreading quietly, implemented case by case, wearing down isolated appliants with evasive procrastination, or promising a one-time approval, using the clock to threaten pending sales.

1 0