December 2003 - cypherpunks-legacy

Re: Building crypto archives worldwide to foil US-built BerlinWalls
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text To: John Young <jya(a)pipeline.com> Cc: cryptography(a)c2.net, John Gilmore <gnu(a)toad.com> Subject: Re: Building crypto archives worldwide to foil US-built Berlin Walls Date: Tue, 08 Dec 1998 19:36:23 -0500 From: Dan Geer <geer(a)world.std.com> Sender: owner-cryptography(a)c2.net Tradeoff time. ==== Q: Is it better for the providers of crypto resources to alarm/log accesses to their websites or not? I'd strongly argue not; Team Despot will disguise itself and we are surveilled as we speak; Team Legion loses if it creates targets for harvesting. ==== Q: Is coordinated integrity control (code signing) a Good Thing? I'd weakly argue not; The absence of a coordinated signing strategy does not preclude verification so avoiding common-mode fraud, e.g., long-running denial of service attacks on the central signing agent, seems advantageous. Alternative argument; Integrity of crypto code can be signed via quorumed split-key means so that no single actor fraud is effective yet only the minimum quorum need be online at any given time; this has the advantage that a completed split-key signature cannot be attributed to which quorum subset made it yet is verifiable by ordinary client means once complete. Since intermediate (partial signing) results do not leak fragment holder identity, quorum members can indirectly communicate through commonly held dead-drops. ==== Q: Should requestors routinely avoid surveilled identification? I'd argue strongly for: We, Team Legion, must commit to a cell organization with pseudonymity coverage such as through the "Crowds" system; to avoid any one of us being guilty we must all be. ==== Getting the problem statement right for this endeavor is the most important thing we have left to do. If the above sample is misguided, say so. To the extent it is incomplete, fix it. If one of us goes off the air, step into their place. It is time for us to walk the fine line between undue paranoia and a heightened state of awareness. --dan --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Between our..
by Pete 17 Dec '03

17 Dec '03

****************** InterScan Message (on ns0) noname scanned and no virus found ********************************************************* NO TRICKS - IT'S FREE! Process all major credit cards on your web site. NO MONTHLY COSTS, NO TRANSACTION FEES. CHECK IT OUT. You get: - Virtual Terminal for phone/fax/mail orders - Email receipt - Recurring billing feature - Password generation for membership sites - Automatic batch closing - Address Verification Service (AVS) - Backoffice to access account history - Remote mode - Interface for all major shopping carts - Installation included For our free information package just reply to: mailto:yetr@iname.com?subject=more_info If you are interested in becoming an authorized agent please reply to: mailto:yetr@iname.com?subject=agent If you wish to be removed from our mailing list please reply to: mailto:grekk2@hotbot.com?subject=remove

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I think setting up mirror sites of crypto archives across the world is a great idea. However, I also think we need to focus on getting more and more people to use crypto. I would guess that the vast majority of computer users worldwide see no use for encryption in their day-to-day lives -- and even those that do don't also use it. If everybody in the world is using encryption, it is going to be extremely difficult for "democratic" governments to tell them they can't use it any more. Unfortunately, it's easy for governments to blame crypto for terrorism and a host of other crimes, simply because the average citizen doesn't understand the concept of an "electronic envelope".

1 0

Re: Building crypto archives worldwide to foil US-built Berlin Walls (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 09 Dec 1998 13:59:20 +0100 > From: Mok-Kong Shen <mok-kong.shen(a)stud.uni-muenchen.de> > Subject: Re: Building crypto archives worldwide to foil US-built Berlin Walls (fwd) > I don't see why you have to pose such severe selection criteria. Because those are the issues that will determine success. > As long as a number of countries don't yet have export regulations, Which doesn't mean they won't hassle the operators with various techniques in order to pursuade them it's a bad idea to continue. > If the 'economies', 'infrastructure' 'religon' and what not of the > countries do not (yet) affect crypto laws, why care about them? If They effect crypto by defintion. > at a later point of time some of these countries do have crypto laws, If they don't have crypto laws it's likely they don't have a lot of other sorts of laws and the social and economic structure those laws imply. This makes it very difficult to operate a archive with any sort of stability or protection. > well, simply close down the archive there and let the sites in the And what about the costs and effects incurred by that person you so glibly throw away? > Much more important is to discuss how to solve the finacial problem There is NO financial problem. It costs hundreds of dollars to purchase the hardware. The connectivity is less than $100 a month in most parts of the world. It simply isn't expensive or economicaly challenging. That ISN'T the problem and should recieve scant attention while these other issues are extant. Bottem line, if you can't afford to put up a box then you're not going to be able to afford to deal with the other issues such activities incur mainly because you're going to be too busy trying to pay your housing and food costs. In that situation you've better things to do with your time then run an archive site. ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- -------------------------------------------------------------------- ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1

Re: Building crypto archives worldwide to foil US-built Berlin (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 9 Dec 1998 07:33:32 -0500 > From: Robert Hettinga <rah(a)shipwright.com> > Subject: Re: Building crypto archives worldwide to foil US-built Berlin > Walls > ==== > > Q: Is it better for the providers of crypto resources to alarm/log > accesses to their websites or not? > > I'd strongly argue not; > Team Despot will disguise itself and we are surveilled as we speak; > Team Legion loses if it creates targets for harvesting. > > ==== >From a security standpoint it is advised to log access and all resource use for about 4-5 days so you can get a sample big enough to look for under_the_radar_hacking. On the flip side you don't want to keep them longer than that because they could be used in an incriminating manner, whether an actual criminal act occured or not. I use the default buffer time (4 days) for my mail package as my ttl value. Once that time is past the files are bye bye. If the security of the site is compromised then it's pretty worthless as an archive. > Q: Is coordinated integrity control (code signing) a Good Thing? > > I'd weakly argue not; > Alternative argument; > ==== The code shouldn't be signed by any of the archive sites, they shouldn't put their butts on the line. The code should be signed by the originators of same. This verifies that ALL the archive sites have the same package and not individualy modified ones. The archive sites should provide some sort of hash to verify successful transfers. > Q: Should requestors routinely avoid surveilled identification? > ==== There isn't any way around this one. If the site is up and it's advertised and publicly accessible then expect to be identified. Either the owner of the domain/network resources you're using or your registration to the relevant domain name authorities will provide ample pointers. Of course there is the strategy of registering the domain for a year only and then each year register a new one. Then you could provide bogus address and owner information. This of course won't slow a packet sniffer down for long. Onion and CROWDS won't help here unless you're connected directly to the anonymizer. If you're that close they'll find you by following the wires. > it. If one of us goes off the air, step into > their place. You so glibly throw people away...it's better to fix a system such that there is a legal ramification (ie resistance) for the LEA's applying the pressure; a fight in court. Beside shutting the sites down another primary goal of LEA's is to keep the conflict off the evening news. There is ample evidence of LEA's dropping charges because the group made it known they were going to use their day in court as a platform for espousing their agenda. ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

Re: Re:
by Mbishop645＠aol.com 17 Dec '03

17 Dec '03

>HaB wrote: ><snip> >> That's a good place to begin, though. "Would you send a letter to >> someone without an envelope?" "Then why not put your email in the >> electronic equivalent of one?" >> >> balance. > >Would I send a letter to someone without an envelope? >One word: postcard. Ahh, but would you tape a check for your phone bill to a postcard? Other than writing a greeting to someone what else do you use a postcard for? --- Paul Weinstein <http://www.weinstein.org> <webmaster(a)weinstein.org> <http://members.aol.com/paulw37280> <paulw37280(a)aol.com> <http://www.waubonsie.com> <pdw(a)waubonsie.com> <http://www.c2.net <pdw(a)c2.net> --- Windows 98(n) - 32-bit extensions and graphical shell for a 16-bit patch to an 8-bit operating system originally coded for a 4-bit microprocessor, written by a 2-bit company that can't stand 1 bit of competition. --- Visit LCARS: A Macintosh Reference at http://www.weinstein.org/lcars

2 1

Wassenaar/Crypto News
by John Young 17 Dec '03

17 Dec '03

A BXA spokesperson said today that the text of the recent Wassenaar agreement had been received yesterday and it is now being prepared for release on the BXA website (www.bxa.doc.gov) maybe by the end of the week but maybe not until next week. She said she expected the US to be the first to publish the doc, after I cited the WA message below from Caspar Bowden. She also said that the Practising Law Institute (www.pli.edu) session on encryption controls yesterday was taped and inquiries should be made to PLI (a continuing legal ed org; ) 1-(800) 260-4PLI. And that Bill Reinsch did not participate in the session, only gave the speech on Dec 7 noted here yesterday: http://jya.com/war120798-2.htm An inquiry to PLI (Betty Gray) has not been returned. >From UK Crypto: From: "Caspar Bowden" <cb(a)fipr.org> To: "Ukcrypto (E-mail)" <ukcrypto(a)maillist.ox.ac.uk> Subject: More from Wassenaar Secretariat Date: Wed, 9 Dec 1998 09:19:09 -0000 Message-ID: <000401be2355$07529ec0$dc77e4d4@cpsb> MIME-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit X-Priority: 3 (Normal) X-MSMail-Priority: Normal -----Original Message----- From: Wassenaar Secretariat [mailto:secretariat@wassenaar.org] Sent: Tuesday, December 08, 1998 16:54 To: Caspar Bowden Subject: Re: Attn: Dirk Weicke Mr. Weicke is still away, however, I can assure you that the Secretariat has been recently authorized by all member states to publish the new Lists on the web site. This will be done as soon as possible. Please be patient, we are a very small Secretariat. Glenn Sibbitt Special Advisor WA Secretariat Caspar Bowden wrote: > Dear Mr.Weicke, > > We spoke by telephone on Fri afternoon. > > You mentioned that the text and details of the new agreement would be > published on the Wassenaar website this week. > > I understand that you have been away sick for a few days (my > commiserations), but there have been reports from your colleagues > that there will in fact be no publication on your Website. > > I'd be most grateful if you could just confirm when publication of > details will take place, in particular the "Cryptography Note" detailing > key-length limits, and definitions of categories. > > Kind regards > -- > Caspar Bowden http://www.fipr.org > Director, Foundation for Information Policy Research > Tel: +44(0)171 354 2333 Fax: +44(0)171 827 6534

1 0

Re:
by Joel O'Connor 17 Dec '03

17 Dec '03

They say education is power abd naybe they were correct. I agree with the fact that more people need to use encryption, the problem (as you stated) is that people do not understand how to use it, or even know it exists. Unfortunate for us, fortunate for big brother. While the only way we can counteract this debate is through empowerment, the question remains, how do you spread the word to up to a million people, enough to get their interest and keep it, enough to take the time to teach them how to use the tools. I work for an IT department and the users I train rank from intelligent to "where the hell did you come from?!" Teaching people who have no want or need is the hardest part, just ask Christians, they know what it's like. Our greatest problems lie within our inability to train and make use of what lies in front of us, if people don't see the need, then why would they? Another point, some people feel that if they have nothing to hide, then why use it. An acquaitance of mine has the same stubborn attitude, what steps do you take to thwart that? That excuse bothers me beyond belief, but it is a common thought that if you need to take the steps to hide something, then it must be wrong. God help us. . . ---Anonymous <nobody(a)replay.com> wrote: > > I think setting up mirror sites of crypto archives > across the world is a great idea. However, I also > think we need to focus on getting more and more > people to use crypto. I would guess that the vast > majority of computer users worldwide see no use > for encryption in their day-to-day lives -- and > even those that do don't also use it. > > If everybody in the world is using encryption, it > is going to be extremely difficult for "democratic" > governments to tell them they can't use it any more. > > Unfortunately, it's easy for governments to blame > crypto for terrorism and a host of other crimes, > simply because the average citizen doesn't understand > the concept of an "electronic envelope". > > > == Ogre bounces like sonar. . .Peace. Ogre _________________________________________________________ DO YOU YAHOO!? Get your free @yahoo.com address at http://mail.yahoo.com

5 4

What happened to this NY Times article on STOA and Echelon?
by Ernest Hua 17 Dec '03

17 Dec '03

Does anyone have any idea what happened to this article on STOA and Echelon? http://www.icdc.com/~paulwolf/nytimes.htm I cannot seem to find it in the NY Times archives. Is it really from 1998? Could it be from 1997? Anyone been in contact with the author? Ern

2 1

The politics of crypto archives
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 09 Dec 1998 17:46:37 +0100 > From: Mok-Kong Shen <mok-kong.shen(a)stud.uni-muenchen.de> > Subject: Re: Building crypto archives worldwide to foil US-built Berlin Walls (fwd) > Let there be a large number of sites. If part of these fail, there > are others that are successful. (Compare evolution.) But two sites don't reproduce to make a 3rd site, some set of sites don't deny environmental resources to others, etc. etc. Your analogy is flawed on many levels. If the sites go down that often what motive would somebody else have if they know they'll face the same sorts of problems and won't have any additional resources to help them face it? Why would you put up a site if you knew that the 14 others before had failed and that nobody would help with your legal fees when you did go down? It's one thing to put your neck on the block for yourself, it's a whole other issue when you start asking other people to do it for your benefit (they obviously don't need an archive since they have the resources already) when you make it clear that you won't reimburse or otherwise recognize their efforts for YOU. > > > If the 'economies', 'infrastructure' 'religon' and what not of the > > > countries do not (yet) affect crypto laws, why care about them? If > > > > They effect crypto by defintion. > > How, for example, can they affects the functioning of an archive, if > you get the right people and machine? Because those machines have to be available and paid for, their utilities need to exist and need to be reliable, the police need to have some sort of legal boundary to cross, and you need some recognized and guaranteed legal recourse for your own self defence. Those are just a couple of the issues involved in running a archive site. Things don't exist in vacuum. You naively take WAY(!!!) too much for granted. I'll tell you what. Just as an experiment put up a CDR node for 6 months and see what it's like. Keep the box up 24 hours a day, pay the electricity, phone lines, domain name, etc. We're talking less than $500 total if you already own a box. Such an experiment is within the reach of just about any person who has sufficient resources (even students) to surf the web. If you don't have the infrastructure to send the email in the clear then crypto won't effect that one whit. And putting up an archive that nobody can get to is not worth the effort either. > > If they don't have crypto laws it's likely they don't have a lot of other > > sorts of laws and the social and economic structure those laws imply. This > > makes it very difficult to operate a archive with any sort of stability or > > protection. > > It is not true that there are more gangsters in the small than in > the powerful nations. What do you mean by stability (which has plenty > of meanings)? Well of course not, the populations aren't comparable. However, it is clear that smaller 3rd world countries have much more stringent regulations or because the instability causes there to be no standards to regulation and lack many of the protections we in the US take for granted. It makes the continued existance of the archive problematic. Putting up an archive on Monday only to have it go down on Tuesday is pyrrhic at best. I use stability in the commen political meaning. The country has a political and social system that is long-lived, has a well defined mechanism for transfer of power (if they even recognize transfer of power), etc. If you're in a situation where some rebels or other forces start lobbing mortar shells into your immediate area then crypto is the least of your worries. Or as in Columbia where a group drove into town, drug people out into the street and shot them in the head. Consider S. Korea. Even though it's a democracy it's illegal to operate a firewall. The closest place S. Koreans can get in many cases to a firewall and network security (for groups outside of S. Korea) is Australia. Now how do you expect to seriously run a crypto site when the military and police have a legal authority to come rummage in your system at will? And can put you in detention if you deny them that access? Those sorts of places are where crypto is needed but clearly can't do the job for themselves. > > And what about the costs and effects incurred by that person you so glibly > > throw away? > > I suppose that running an archive is a voluntary (self-sacrificing) > act of a benovolent person ready to offer his service to the public. > If his site has to close down sometime later, he has to accept his > bad luck. Why should you care so much minutely for him? (And you > say below that the money problem is trivial!) No, it isn't self-sacrifice. It's sacrifice for the users of that archive. Their motives are not self-centered, they're society centered. As users of those archives you OWE them. I would suggest strongly(!) that you spend more time studying ethics and morality. > So it rests to find people who have the time and (that small) money > and energy to run sites and some countries that aren't going to > have strict cryto laws in the near future. THAT, however, is > difficult, I believe. Duh. I wonder why....(well, actualy I don't) ____________________________________________________________________ If I can put in one word what has always infuriated me in any person, any group, any movement, or any nation, it is: bullying Howard Zinn The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

2 1