December 2003 - cypherpunks-legacy

Plea from a parent who wants to keep their kid free of SSNs
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- David C. Treibs writes via Declan McCullagh: >The Bible gives the responsibility of raising children to parents, not >to the government or any other entity. > >Forcing Social Security Numbers on children represents a major violation >of parents' God-given responsibility. While I am generally sympathetic with Mr. Treibs, it does not seem reasonable to ask for a government child subsidy while claiming the government has no business raising kids. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEUAwUBNCrALpaWtjSmRH/5AQFr+Qf2P6C4HBs9iAPAdTKPrQSPkpDIy6y3Sa4a GFpDuPoqS9DpCEM/6oQIqezy0AdFZD8L3A7/VmRyHMW1H72I+F3KrqrEjmdc6vbK zil8XnuezijL/4IisfN5PvWaL8NmT/7f+15BE4/qegXcWOwP7LM+oHKcuk01zJLX dvMXGwtmeRBJh+bqOIbv1y0mgfaHw08MEakmN5oA8BGhTu8IhRubttGCVG+jNY46 p47NqVYYa0tt0n1kMOWl2Y+qLWucvCRsuPAzfWJzDu+fzTvNsjNwn2IJfQN/O8Id C/jVQvJv3Eo99YOAlPa1XnSGyc7SWRg/VVMto114biIVw4UtaWdy =cxyC -----END PGP SIGNATURE-----

2 1

Remailer Attack
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- According to Raph's remailer stats, the remailers have widely varying latencies. Given that only a few remailers have latencies which are acceptably low, the list of usable remailers is quite low. If the user of the remailer, Monty Cantsin for example, signs his messages, a fairly accurate measure of total transit time is obtained. The total transit time gives clues to the remailers which were actually used in the chain. In an of itself, this may not comprise the user, but combined with other weaknesses it will cause the attacker to be significantly more confident of identification hypotheses. The remailers should all have about the same latency. 0 seconds seems like a good Schelling point. What would it take to reduce remailer latency to under 60 seconds for most of the remailers? Do people need old 486s to dedicate to the task? Do they need money? Better software? If you operate a remailer, please tell us what you need to make it really work well. Perhaps the rest of us can help make it happen. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNCrG4paWtjSmRH/5AQFuAAf+ID6TSjoUV1sVehzW6DoqVXREyO/fR4Uw H+W6QCiTOQaRhTD1Z6WSaL9FOaBJ5aSHCdLzKy9eIvagXsYR+eqVBdO0oSuDaloc BYSN+QXSKvMEuEotkCF4RicRoENlTmD0Qcrz4KvvW+d+jRxyxejs9O0HqDeTq9y/ KpBtq8CytpEMmGc6VSHuAX90qwJTtHUk/k4ulXU7v4xMmBLu1HpS/9M5h7mooybC 8qwVJKswAMI4wTB5FlBj/+b8txkCzMdqJkFdLEYu+LAGZfkB96W9uRU+eGekCHY2 6iycxv+m4r7wXPbP9A83Y6UnP4nkZBW86y7Du8NjVWGpscCfNjFF3g== =QjE1 -----END PGP SIGNATURE-----

8 8

RE: Why the White amendment is a good idea (fwd)
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 12:00 PM, Lizard [SMTP:lizard@dnai.com] wrote: > But to do that, you see, you'll need warrents, reasons for > suspiscion, and, becuase of the effort involved, you'll only do it > for serious crimes with a strong liklihood of conviction. *That* is > the 'stauts quo' law enforcement *claims* to want. and the technical realities of encryption, plus the limitations of any "NETCenter," will force a respect for, or at least compliance with, the 4th amendment. Hooray! Aaron

1 0

Re: Exports and criminalizing crypto
by John Smith 17 Dec '03

17 Dec '03

>From: Adam Back <aba(a)dcs.ex.ac.uk> >John Smith <jsmith58(a)hotmail.com> writes: >> Getting rid of these export restrictions would produce an explosion >> of Cypherpunk style crypto software. It is a big win. > >I disagree. > >Cypherpunk (freeware) crypto isn't hardly hindered at all by EAR >export nonsense. > >You reference Ian Goldberg claiming to have to work on crypto during >trips to Canada. I think he was just trying to make a political >point. I submit that he could write and publish all the crypto he >wants in the US (on one of those "export controlled" sites). It will >get illegally exported in no time at all. Where's the problem? That's easy for you to say, there in England. You don't have these export controls, right? How can you say what Ian Goldberg should do. I think he was not just making a political point. From what he said, he really does not release crypto from inside the US. Only when he goes to Canada, which isn't that often. I'll bet he could be releasing 3x more crypto if we didn't have the export laws. Is he on this list? Let's hear what he has to say. >William Geiger has PGP on a non-export controlled site, and the export >bods haven't said a word, so it's not even clear that they care about >freeware at this point. PGP is a special case because it is already out there everywhere. Still the example of Phil Zimmerman is a good one. Even though he got away with it eventually, they showed how they can make your life hard. Probably the only reason he didn't get charged was because they couldn't prove anything. Not many people are going to be willing to take that chance. William Geiger and a few others may be exceptions, but most people won't openly break a law which has strong penalties like this. There is nothing to stop te authorities from prosecuting William Geiger and even threatening him with jail. There is no guarantee that he will become another Zimmerman and get all kinds of donations and support. A lot of hackers thought they'd be heros but ended up doing time. Read that letter from Jim Bell if you want to see how different things look once the government comes down on you. >Also your claim that the FBI is defeated, and that safe is a good >idea. Disagree also. > >1) SAFE has lots more hurdles to pass before it gets to be law. Yes, I said that. It probably won't go anywhere this term. The big question will be what happens next year. But after all the opposition which came out, from practically every interest group there is, I am sure that there is no way domestic controls on crypto are going to pass. Even with the CDA there was not this much united opposition. Car companies and phone companies didn't fight the CDA. Religious right didn't fight the CDA. CDA passed, remember? FBI's bill did not. And all the opposition came together in a few days. Nobody was ready for this. Next year there will be more time to organize, and the opposition should be even stronger. >2) If it does get to be law, you won't like the modifications that are >made to it by that stage. That depends. The law may still be good. Who cares about this crypto center. That's just another boondoggle. The main thing is getting the export laws changed. >3) Crypto-in-a-crime US domestic restrictions are a _bad thing Stupid, yes, but not that big a deal. Everyone will have crypto so every crime will use it. Wouldn't it be better to have a world where every phone was encrypted? So what if they add crypto-in-a- crime to every crime where somebody used a phone to plan it. It's not like people aren't going to use phones, or they're going to turn off the crypto. It really won't have any effect on anybody, except maybe make some prison terms longer. That's not my issue, how long prison terms should be. I want to be able to use crypto. I hope this stupid mailer doesn't chop off my message again. "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

4 3

Re: Emphasizing a point by Donald Eastlake re key recovery
by Carl Ellison 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:25 AM 9/25/97 -6, Peter Trei wrote: >Well, I dunno. About 18 months ago, I was involved with the >negotiations over the exportability of an SSL equipped web >server I had helped develop. The export model used 40 bit RC4 >and 512 bit keys. The initial version used 3DES to encrypt >stored private keys, and this was turned down. I modified it to >use single DES, and it passed. > >Note that this was for secret key storage only. This should be listed as yet another outrage of the current system -- perhaps reason to start another lawsuit. - Carl -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQCVAwUBNCra7FQXJENzYr45AQECaQP/aqrptzzWdwjJsseEtIKGckIg0mXLRAFk APtO4O4hzeZJDVJ7QPKtJc6BqSU8uT5gs44rJR3SrUZ3g0D5RG4zyjue30Drhyor bmqQKJXsbtIW/wk0uPXA3EyfRusjUr51yVjPdkwhRsh6ta5YIvAusTAonSjAoJrf AL+F9+pFBPw= =yC89 -----END PGP SIGNATURE----- +------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc. http://www.cybercash.com/ | |207 Grindall Street PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Baltimore MD 21230-4103 T:(410) 727-4288 F:(410)727-4293 | +------------------------------------------------------------------+

1 0

RE: Why the White amendment is a good idea #2
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 11:34 AM, Tim May [SMTP:tcmay@got.net] wrote: > Though we as technical people are usually cautious to say that > "unbreakable" is a dangerous word, the fact is that it's our current best > description of what a 2000-bit RSA key is, and that's all there is to it. I don't dispute you -- in the slightest -- that a brute force attack against a 2000-bit RSA key is functionally impossible today. However, I don't think that a brute force attack is the most likely for a functional law enforcement (or national security) crypto lab. Unless you think that today's algorithms and conventional random number generators are perfect ... Aaron

1 0

RE: Why the White amendment is a good idea (fwd)
by Aaron Weissman 17 Dec '03

17 Dec '03

On Thursday, September 25, 1997 11:34 AM, Tim May [SMTP:tcmay@got.net] wrote: > The NETCenter is largely duplicative, though will be much less effective, > than the NSA. I strongly urge Aaron and others to review the history and > capabilities (and limitations) of the NSA. Sure, it is duplicative. However, for this thing to become law, I envision a rather dramatic shift in the organization of our intelligence institutions. Or at least a change in some of the building names at Ft. Meade :) > (The NSA sometimes assists with law enforcement. But often it does not. I > grant that a purely civilian codebreaking facility might once have been > needed. But for reasons I'll get to below, it's much too late to start now! > And much too expensive.) There is an exective order or presidential decision directive (pdd) from the mid-80's that formalizes a "relationship" between the NSA and FBI for law enforcement decryption. However, I never was able to get my hands on it ... Aaron

1 0

Re: Why the White amendment is a good idea
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

At 03:36 PM 9/25/97 -0400, Jeff Barber wrote: >Follow your own advice. All this crap about NETCenter has nothing >to do with our civil liberties. Whether NETCenter is a good idea or >not is a completely separable issue (which I see Tim May just covered >thoroughly), and is merely a fig leaf offered to spineless >Congresscritters to deflect some of the "criticism" they might >otherwise be subjected to on the law enforcement "issue". The fact >that White offers it shows that he is just as spineless. > >We shouldn't have to "trick" Congress into doing the right thing, >or provide cover for them either. **BZZZT** WRONG ANSWER! >As you say, though, let's keep this debate framed with our criteria: >Do you, Congressman, support the constitutional guarantee of free >speech, or not? How loudly do we have to shout it? **CONGRESS DOES NOT SUPPORT THE CONSTITUION. PERIOD.** They prove it time and time again. Recent example: they wouldn't have passed the CDA 94-6! if they were worried about the Constitution. You call the congressvermin "spineless". They do hate that label, and voting "tough on crime, tough on drugs," is how they avoid it. With Lying Freeh telling them that evil Mexican drug lords use crypto to outclever the FBI (true), and therefore a vote for GAKked crypto is a vote that's tough on crime (false), they can't rush to vote "yea" fast enough. It doesn't matter if the vote doesn't make sense, or violates the Constitution eight ways from Sunday, the vote is there only to provide the illusion to the voters: "Hey, I'm TOUGH on CRIME." You better learn that Congress is not there to support the Constitution. Any part of it. It's not in the part of their job description that gets them reelected. Constitutional issues do NOT attract voters. Only SIX senators voted against the Telecom Reform Act, the one that contained the CDA. My senator is one of them, and I know that he is a lame duck not seeking re-election. So, don't go dangling Constitutional challenges in front of Congress. There's not enough bait on that hook. Fighting unemployment attracts voters. Fighting crime attracts voters. But they couldn't trample hard enough on our freedom of speech when the voters heard about child porn on the net. And now that evil Mexican drug lords use encryption, well, I'll let you connect the last two dots. We can't afford to simply frame the debate on Constitutional issues. The number of voters looking at them through that frame won't get them reelected. Shame on us cowardly Americans. (Yeah, _us_. I'm hiding behind a remailer.)

1 0

RE: "Matchcode" technology sparks privacy flames.....
by russ＠russ-smith.com 17 Dec '03

17 Dec '03

>Few things are more contradictory than calling in the government -- the biggest known violator of privacy -- to "protect" privacy on the Internet. ... This is the kind of generalized hand-waving statement I am talking about. If you are talking about the FBI or the IRS I would agree but I don't think the FTC is collecting personal information in order to violate privacy (although I think they give industry an unfair advantage when it comes to developing privacy rules). I also don't think agencies like the National Endowment for Arts or the Park Service is doing this either. I also think the government is #2 behind companies such as Experian and Metromail due the profit incentive. As for going to agencies such as the FTC for assistance, I am looking for them to develop rules so I can protect my own privacy. I do not expect them, nor do I think they are capable of, protecting my privacy (they cannot even develop their own privacy policy for their web site correctly). I want to able to find out who has information about me and be able to (in some circumstances) stop the distribution of the information if I so desire and make it unprofitable for companies to violate such regulations. Another example is the junk e-mail. CEI says the FTC should be concerned with property rights and the 'rules of law' but then go on to indicate the FTC should not get involved in junk e-mail regulations. I view the hundreds of spams I received as a violation of my property rights and I simply want to recover my expenses. I went to a telecommunications deregulation seminar at CATO about 2 weeks ago and I found some the people there to use the same hand-waving arguments. I was discussing the situation with uu.net and the 'Internet death penalty' situation when other administrators got together and stopped routing their packets for newsgroups. Who knows how this could be used in the future. My suggestion was to have some type of rule concerning the packet flow when it is necessary to depend on another provider to route your packets. The answer I received: Internet users need to get redundant paths through the Internet. That sounds real good during a debate while sitting in CATO being served lunch, but such a plan would clearly put many small operators at the mercy of large ISP's or would simply put them out of business. A presenter on the CATO board also kept discussing how good the WinTel situation has been to consumers. She did have a somewhat valid point since, even with all the problems, computers are relatively cheap and an entire operating system costs less than $100. However, what would it be like if the DOJ didn't keep talking about breaking up the monopoly? Russ Smith http://consumer.net

1 0

Re: Exports and criminalizing crypto
by John Smith 17 Dec '03

17 Dec '03

>From: Tim May <tcmay(a)got.net> >J. Random Hotmail User, you'd better learn to read the text of the bills >you so blithely think are OK. Well, I read the text of the bill, and here is part of what it says: `(2) ITEMS NOT REQUIRING LICENSES- No validated license may be required, except pursuant to the Trading With The Enemy Act or the International Emergency Economic Powers Act (but only to the extent that the authority of such Act is not exercised to extend controls imposed under this Act), for the export or reexport of-- `(A) any software, including software with encryption capabilities-- `(i) that is generally available, as is, and is designed for installation by the purchaser; or `(ii) that is in the public domain for which copyright or other protection is not available under title 17, United States Code, or that is available to the public because it is generally accessible to the interested public in any form; This sounds like it should cover the kind of crypto that we are talking about and that Ian Goldberg does. It is generally available and installable by the purchaser (it's free) and it is in the public domain and generally accessible to the interested public, etc. And see, there are no export licenses for this. There is another part that has the stuff you were talking about re "diversion" and terrorism, but that is separate. It is for software that is not generally accessible and installable by the purchaser and all that. More specialized stuff, like custom packages. But cypherpunks software is for everybody, and this bill should make it free to export. "John ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

2 1