December 2003 - cypherpunks-legacy

Re: Privacy Software
by Adam Shostack 17 Dec '03

17 Dec '03

Adam Back wrote: | Monty Cantsin writes: | > We should consider a rewrite, which gives us the added benefit that | > it will be completely unencumbered. | | Sounds maybe worth doing. | Not maybe at all. The IETF will require a second, interoperable implementation for standardization of OpenPGP. Its sad that the interoperable SSH was written for Pilots, since it uses some libraries there that are not portable. | > Something I've never liked about PGP is their approach to encrypting | > to multiple keys. For one thing, the PGP crowd seems overly | > conservative with bit expenditure, which is silly because bits are | > cheap. This means that creating entirely separate messages is | > completely economical. | | This is more secure I agree. The real kicker with this problem is | people who turn on encrypt to self -- I don't want messages with | encrypt to self (an extra door into the message) on them in my | mailbox, nor coming over the wire headed to me. Pretty Good, not Perfectly Strong. Never underestimate the value of pretty good security. The bad guys use scanners that need to work in real time; even 40 bit crypto with a 30 second delay creates huge headaches. I see a PGP encrypted message, even with encrypt to self on as pretty good. Sure, its not sealed with a two color wax seal in a tyvek envelope, but its pretty good. Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

1 0

Re: PGP and Compliance with SEC and Liability Rules
by mark＠unicorn.com 17 Dec '03

17 Dec '03

Tim May quoted from macweek: >"The Gartner Group's Wheatman pointed out that PGP Policy Management Agent >allows corporatins for the first time to centralize control over >encryption: "For encryption to be accepted, IT had to gain control. This >isn't Big Brother; this is necessary to comply with liability laws and SEC >regulations."" However, this doesn't seem to work, unless I'm mistaken about CMR enforcement and the SEC regulations. CMR will only allow the snoops to read incoming email, not outgoing, and hence if Joe Blow at Foo-Bah.com wants to send me some handy insider trading tips CMR will not stop them. So this seems to be another justification for CMR which just doesn't make sense. Mark

3 2

Re: PGP and Compliance with SEC and Liability Rules
by mark＠unicorn.com 17 Dec '03

17 Dec '03

tcmay(a)got.net wrote: > CMR and the Policy Management Agent can (and presumably will) be set to > scrutizine _all_ mail for "policy violations," outgoing as well as > incoming mail. The PGP page has some descriptions of their products. Hmm, I looked but couldn't find any real detail. If it can force encryption to a company key for outgoing mail as well, it's even worse than I thought. Mark

1 0

Teaching Kids To Love Big Brother
by mark＠unicorn.com 17 Dec '03

17 Dec '03

>From the Infowar Web site: BRISBANE, Nov 2 AAP - Special computer software will stop Queensland school children accessing pornography on the Internet as schools are connected to the worldwide web over the next year, Education Minister Bob Quinn said today. [deletia] "Students will not be permitted to deviate down the many unsavoury side roads off the information superhighway," Mr Quinn said in a statement. "We don't want children exposed to pornography. We don't want them learning how to make bombs. We don't want them gambling in cyberspace and we don't want them wasting their valuable time on silly games and other pointless pursuits." [deletia] Attempts to access prohibited sites on school Internet terminals would trigger an automatic alarm monitored by Education Queensland's network administrators. Mr Quinn said e-mail would also be scrutinised and messages with prohibited words or phrases automatically directed to administrators. [deletia] The monitoring system would also monitor traffic patterns used by Queensland's 450,000 students and 30,000 teachers, he said. >>> END Shame about the export restrictions, or this would be a great market for PGP's new snoopware. Mark

1 0

Re: ANNOUNCE: New Remailer - palnu@juno.com
by TruthMonger 17 Dec '03

17 Dec '03

Andy Dustman wrote: > > I've been pinging palnu for a day now, no response yet. Try looking at some dirty pictures while you do it... IPingMyOwnPalnuTooMonger

1 0

Re: Why porn must be stopped at all costs, by Jodi Hoffman (fwd)
by Brandon Crosby 17 Dec '03

17 Dec '03

> > > Someone on this list, I forget who, has made numerous attempts at > > convincing us that pornography 'does no harm' to children. It is > > exactly at this point that I must draw a line. Studies have shown that > > an event which lasts even so much as three-tenths of a second, within > > five to ten minutes has produced a structural change in the brain. > > Exposure to porn causes actual brain damage, especially in a child. > > let me guess . . . scientology? it sounds to me as if you just despise > porn so much that you're seeing red, and hence . . . not seeing the > facts straight (or believing whatever you [want to] hear). > Take a young child to the mall. He or she sits on santa's lap. Does the brain change at this point? The simple fact that the brain has been altered in some way only proves that the child is concious. -Brandon Crosby

1 0

You Can Make $100 From Every FREE Phone Call !!!
by 94WD55P1211＠aol.com 17 Dec '03

17 Dec '03

THE WORLD'S GREATEST INCOME OPPORTUNITY!!! THIS PROGRAM WILL CHANGE YOUR LIFE FOREVER!!! Can you think of anything any easier than just promoting a TOLL FREE number, and then the professionals on the other end do all the work for you? If you can mail a postcard or send e-mail you can earn $1000's each week, just like I do. Just call the following *TOLL FREE* numbers from 8AM-10PM Mon-Sat CST. 1-800-811-2141 Code 46779 US 1-800-588-9786 Code 46779 CANADA -0r- 913-762-6715 (alt. for Canada) ** They are getting over 1,000 calls per day, so don't be surprised if you don't get through on the first try. TRY AGAIN, YOU WILL BE GLAD THAT YOU DID!!! THIS TRULY IS THE BEST PROGRAM YOU'VE EVER SEEN!!! AND, ALL YOU HAVE TO DO IS CALL THE TOLL FREE # TO FIND OUT FOR YOURSELF!!! THIS IS THE OPPORTUNITY YOU'VE BEEN WAITING FOR!!! YOU OWE IT TO YOURSELF, CALL NOW!!!

1 0

Libertaria in Cyberspace
by Jenaer Mixmaster Anonserver 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 A lot has been written about Libertaria in Cyberspace both before and after Timothy May wrote the paper by the same name. I wonder how such a Libertaria will form. For a truly free communications medium we must have strong cryptography. This is a given. Anonymity cannot be insured without strong cryptography and the freedom of remailers or similar mechanisms to operate unobstructed. Speech is never truly free unless it can be anonymous if the author so chooses. Who wants to espouse an opinion which will get them flogged, either figuratively or literally, by their neighbors, their government, or in some cases even their family? In my opinion, Mr. May is correct when he says that physical space is too small and too exposed to outside intervention. A floating oil tanker can be torpedoed, and a small island simply invaded. Libertaria cannot easily build a standing army without inviting intervention by world powers and being dubbed as terrorists or an organized gang. Yes, cyberspace does look much more promising. The amount of "space" in cyberspace is unbelievably large. The amount of data I can store on one gigabyte of hard drive is incredible by conventional standards. Data on one computer can be made accessible through a network to any number of other computers and it can further be distributed. And space is very cheap in cyberspace. A three gigabyte hard drive runs around two hundred U.S. dollars and that price is dropping all the time. A truly free communications medium must allow its users to be anonymous. Speech is never truly free unless it can be anonymous if the author so chooses. Who wants to espouse an opinion which will get them flogged, either figuratively or literally, by their neighbors, their government, or their own family? Who wants to die "under mysterious circumstances" or in an automobile "accident" on an empty road? That an opinion is unpopular does not make that opinion wrong or invalid. That an author does not want his "true name" attached to an opinion does not diminish the value of that opinion. In some cases an author simply does not want to attract attention regardless of whether such attention be positive or negative. Strong cryptography is necessary for anonymity and the secure exchange of information. A remailer system such as we have built is simply not secure without the aid of cryptography. No network connection is secure when the connection is visible to anyone who has the capability and curiosity to listen in. A disturbing trend on the Internet today is the opinion that "good users are known users" and that "good users have nothing to hide." This kind of idea is offered by the government of the United States as well as many users and system administrators. Such an opinion is detrimental to the free flow of ideas and information. The arguments that a "good users are known users" policy is necessary to curb "computer crime" and network abuse are invalid in my opinion. A great percentage of "computer crime" is simply due to lax security protocols in the first place. When somebody can go into a university and run a sniffer program to get hundreds of passwords the problem is not so much that the user is running the program as it is that the data is available to the user in the first place. When somebody can get a throw-away account and post 30,000 ads to USENET the problem is not so much the abuser as it is abusing the network as it is a fault in the system. When people post mindless drivel to a network the problem isn't so much the poster as it is that such drivel is read and ranked at the same level with more legitimate postings. The first case of somebody running a packet sniffer can be avoided very easily by using encrypted protocols and secure machines. If root permissions can not be easily obtained on a machine and they are necessary to install trojans one major avenue for our cracker is blocked. If all network traffic is encrypted the cracker's job becomes all but impossible. Sadly most people seem to send passwords and vital information in the clear and most machines do not have encrypted communications tools installed. The majority of TCP/IP traffic is cleartext. The second and third cases of network abuse and drivel propagation are avoidable by various common sense means. First, news servers can be altered to not propagate massively crossposted articles or articles which are virtually identical and posted to many different groups over a short time period. Second, readers of news can use reputation capital systems to eliminate the remainder of off-topic postings and mindless drivel. If I trust Bob's opinion and Bob says that a particular posting is rubbish nobody has been censored unless Bob becomes very powerful and misuses that power to censor opinions he doesn't like without anybody knowing. However even that sort of abuse can be avoided by people being able to retrieve what they aren't normally seeing to occasionally check. And the argument that encryption must be outlawed or the government must have access to decryption keys is rediculous. The law abiding citizens will be monitored while the real terrorists, child pornographers, and tax evaders will hide their data in sounds or pictures and use encryption anyway. Put simply, for Libertaria to truly thrive in Cyberspace many things need to occur: First, encrypted network layers must become easily available. Nobody sitting on a network backbone should be able to see what I am saying or what anybody is saying to me. Authentication should be included here as well. Second, traffic analysis must be made considerably harder if not thwarted totally. When I go to http://www.cypherpunks.to an outside observer should not be able to see that I was the one who filed this request by watching my TCP/IP traffic. A modification of CROWDS is perhaps appropriate here. Third, some form of true distributed and redundant data system must be created. Eternity servers as currently implemented accomplish this to a certain extent, but don't seem to quite reach the mark. Some form of truly redundant, distributed, and secure filesystem which spreads across many jurisdictions would be most appropriate, I think. There are many technical problems involved in this however. As with anything else, such a filesystem should be anonymous and should be very hard to shut down. Fourth, if indeed a programmer in the United States can use a crypto library available outside the United States without infringing on ITAR then programmers outside the United States should begin work on such a library. Such a library should include many different algorithms for authentication, encryption, and key exchange. This would allow programmers inside the United States to legally write software which employs these technologies. Fifth, existing news and mail readers on all major platforms need to be altered to support anonymous remailers, encryption, decryption, authentication, and key exchange. This should include, at minimum, Windows, the Macintosh, and UNIX variants. Perhaps a whole new set of network protocols is necessary even if a bit grandiose. Tim May is correct: Libertaria will thrive in cyberspace. -----BEGIN PGP SIGNATURE----- Version: PGP 5.0i Charset: noconv iQA/AwUBNF+NoHXr/REbgWGuEQJbfgCfZ/j8KZIubDkBBFmiWmXCguZMCDgAn3/8 KrkCbQdmWDFXbv7KlXpETEOT =q4kv -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP 5.0i mQGiBDRfi98RBADnsCoIsCkfD6bgRKEubaP5qAyUmZRX4b7JXn9CIPUNMp+KWA7p QObKWOs+DQ4Rc4DISrCm3TSdtvBHIZ0PvXNd1Ry2mhtaZKA0T9JawWotmKJzP/q1 yFh+A0Cs7nUW09vbgg3r7p17hRtrLY2UicXT+trajZc62ZmbPO5uMw+cawCg/6g2 uRrNxBRtqy8rEYoJ+7o7mw8EANSHUM+mSmKwNoSHQR1NeCcs76TjHsHiXjGwXewg ECxg9aQrCRD4DrHMkoPOiEHuKbHZzMfIMrkjHn46s00Is64zEVXv1rPWO0iB4/fQ h5W9L/ncA+05ltBNSQSwGaUuHy7HSUPqgPxET6heSYUWakIPs7WRc/WFCmtVgp0P OUIMA/4oQs45VL1GZUv9Oh25DNY6ZHLYOsULj2d6IdyxM0H6sdC59x0nGk6Gx9bb 0+4xVy/P+ZHnsvR5I6P0fZeIfvv8uLiy/kR7xIm7atx/PQh65uoVrxIuBeqkrl+7 ece1uCQLJuhTTHqK2jEcu4FLkHIGBi3LKPp7pRosYQQm/c7Fk7QiVmlzaW9uYXJ5 IDxhbHQuYW5vbnltb3VzLm1lc3NhZ2VzPokASwQQEQIACwUCNF+L3wQLAwECAAoJ EHXr/REbgWGuxqkAn0gFBb+rkOXMJN7SaDQT/in9fmG9AKCBr078DSRLz0FQf/Ot lNu72aDtkrkCDQQ0X4vhEAgA9kJXtwh/CBdyorrWqULzBej5UxE5T7bxbrlLOCDa AadWoxTpj0BV89AHxstDqZSt90xkhkn4DIO9ZekX1KHTUPj1WV/cdlJPPT2N286Z 4VeSWc39uK50T8X8dryDxUcwYc58yWb/Ffm7/ZFexwGq01uejaClcjrUGvC/RgBY K+X0iP1YTknbzSC0neSRBzZrM2w4DUUdD3yIsxx8Wy2O9vPJI8BD8KVbGI2Ou1WM uF040zT9fBdXQ6MdGGzeMyEstSr/POGxKUAYEY18hKcKctaGxAMZyAcpesqVDNmW n6vQClCbAkbTCD1mpF1Bn5x8vYlLIhkmuquiXsNV6TILOwACAggAmKdYv7uXJ8Vf nqp57+feOEQJx0wfBr/dcDpMBy3FLarVlkZJd3J/HwjRY/Nz1fZpeZrH0Trp0IeV 5OL+HkZVBDbzOqcXZ/o8YrgfbwlMpnAPjzMncRdJ9txLZFrGg89YFCoSHbvvAZwU 0PT8KtgXPYkDhzfPqPHny9J7Wg0DpdUEJc7HR+0d5rxeQ0/9rAbBym4/Qc+jdk6T g54vlRDOucm9MeYui9VUyGo2bZmZCfC792eK3Vve8At2XFRPBCP3cGP8QagqkJR6 Tc/uFOPjV4OkUkMLMD6Svi5jZFn6k4bxpqbPfo8NCH9vkoOS10qLOIUeBZMyu6zK tE5RPuMe9okAPwMFGDRfi+F16/0RG4FhrhECJ6EAoKNzXAfSzHaMQby20kgWg8Pu pScWAKDJ/nas7KT03gs374nVb7nxwzgrkQ== =TMag -----END PGP PUBLIC KEY BLOCK-----

1 0

Taxing Churches for their views? Bad idea. (fwd)
by Brandon Crosby 17 Dec '03

17 Dec '03

> > >More telling, she doesn't seem to have a problem using a religious (and > >therefore tax-exempt) organization to push a political agenda. Apparently > >that whole 'separation of church and state' thing only applies when it's > >convenient. > > > >If religions want to play politics, the least we can do is get them to pay > >for the privilege. I'd feel a certain guilty pleasure seeing some of those > >bottom-feeders taxed into penury. > > Nonsense. And a dangerous course. Yes. > One can decide to "tax churches" or to "not tax churches." I have no > particularly strong opinion on either option. > > But one must definitely _not_ base the decision to tax or not to tax on the > opinions expressed by a church! Agian, yes. > One cannot decide to tax the Catholic Church "into penury" because its > anti-abortion views have become politically incorrect in the last 30 years. > Nor can one decide to tax the tempes and synagogues of Judaism "into > penury" because they are centers of support for the Zionist Entity. 'Political Agenda' and free speech are two seperate things. Nowadays, free speech is constantly being challanged by racism, bias and such. People sue each other because they say something that makes someone feel bad. Churches lie at the center of free speech, being awarded for their views by tax exemption. Should 3M have tax exemptions because it gives people jobs? While I do not want a debate over tax exemptions in churches, 'Free Speech' may very well involve supporting canidates for positions in a democracy. This is the very basis for elections. However, one begins to question this reasoning when a church leader attempts to get into the government, using the church's tax exemptions, for either support of the church, support of self, or some illegal (or, at least, unethical) mix. Should churches be tax exempt? Without their long history of helping people, I doubt they would have any benifits. However, even if their privillige was removed, they would simply be able to donate less money to community causes. Uncle Sam (and his son, IRS) really shouldn't be applied to this subject: What is free speech? Is tax exemption justifiable to all types of [free] speech? -Brandon Crosby [Can you see the ghosts making snowmen?]

3 2

Re: Sympatico Petition
by Toto 17 Dec '03

17 Dec '03

john smith wrote: > > Please tell me everything Sympatico has done to make you think they > moniter your email. Everything please and i can make something of it. When I first saw your email re: Sympatico petition, I assumed that Sympatico would be monitoring activity surrounding the petition. I visted your web site on Oct 28 and surfed around. When I got to the petition-signing page, I decided not to sign, in order to see if those merely visiting the page were being monitored. I pretty much forgot about it until I got an email from Sympatico Admin which dealt with what appeared to be bogus concerns, and containing vague threats of loss of access. I checked out the headers on my past incoming and outgoing email and found changes in the way it was routed and dealt with--changes which started shortly after I visited your website. I confirmed the results of my traffic analysis on my own account by checking them against those of another Sympatico account whose records I have access to, and which is used as a 'control' because it is used only for very normal and boring communications by a very regular jane/joe. (The changes started late on Oct 28th, and I got the threat from Sympatico on Nov. 4th.) As well, my follow up communications with Sympatico Admin resulted in replies which contained further evidence that the claims they were making in regard for the reasons for their actions were askew. Sympatico is little more than a company that acts as a front for the Canadian Telecos, so that they can continue to operate what are basically monopolies, without appearing to do so. SaskTel charged outrageous connect charges of ~$5.00 an hour out in the boonies, as long as they could. When it became apparent that they couldn't get away with it for much longer, Sympatico appeared on the scene, as SaskTel's 'competition'. The two entered into a sweetheart deal which effectively allows Sympatico and SaskTel to operate a dual monopoly, by making it difficult for small operators in the boonies to get a cut of the action. You may have noticed that 'Sympatico Admin' is pretty much synonymous with the SaskNet Admin. Their bum-buddy relationship is covered by only a thin veil of pretension. SaskTel still manages to maintain a semi-monopoly in the big cities, but their real power comes in the boondocks, where the Sympatico deal allowing no toll-charges effectively cuts out the smaller providers who can only offer services to a handful of in-area customers. The bottom line is that there are advantages to the basic infrastrucure of the system being developed by a single entity, such as SaskTel, but if that entity is allowed to pick and choose who receives preferred treatment, then they tend to do so in their own interests, and not in the interests of the end users. SaskTel charged $5.00/hr connect time in the boonies until there were enough complaints that they made a deal with Sympatico to control the market at slightly less monopolistic rates. People tend not to figure out that the change from $5.00/hr to around $1.50/hr, practically overnight, merely reflects that SaskTel charged over twice what was reasonable, for as long as they could get away with it. I checked the numbers, in regard to bandwidth costs, etc., to hook up and provide an InterNet service, and found that the types of rates you quote on your website are not out of line, but are not possible if one cannot get the type of deal Sympatico gets. e.g. - I charge you $20/month for total access, but you pay $6.00/hr to SaskTel for long-distance charges, to connect. SaskTel/Sympatico will continue to maintain a monopoly whose prices will reflect how much they can charge before complaints force them to move toward more truly competitive rates. I applaud your efforts to make some noise in this regard, and hope that they have the effect of forcing SaskTel/Sympatico to maintain their monopoly at more reasonable rates than at present. I am somewhat notorious in certain areas of the underground computer movement, having been involved in the dissemination of a number of subversive on-line manuscripts, so I often get hackers and phreaks sending me confidential information from my ISP's. I found it rather humorous that the original email from the Sympatico Admin: > Please note: this note is being sent to our security dept. as we > deem this type of activity to be mis-use of the mail system and > as such you could loose your access privileges. ...contained an 'additional' note from a hacker named the Evil-1, who added: > [And I'll make sure you get a copy! (;>} ~~ Evil-1] Toto ~~~~ "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix "WebWorld & the Mythical Circle of Eunuchs" http://bureau42.base.org/public/webworld "InfoWar" http://bureau42.base.org/public/infowar3 "The Final Frontier" http://www3.sk.sympatico.ca/carljohn

1 0