July 2018 - cypherpunks-legacy

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

Re: Public Key Infrastructure: An Artifact...
by None 06 Jul '18

06 Jul '18

At 1:59 PM -0800 11/20/2000, Bram Cohen wrote: >On Mon, 20 Nov 2000, Arnold G. Reinhold wrote: > >> Perry's last sentence gets to the heart of the matter. If CAs >> included a financial guarantee of whatever it is they are asserting >> when they issue a certificate, then all these problems would go away. > >They aren't going to. > >-Bram Cohen > It's still early in the game to be so certain. But if you are right, that in it self is an indictment of PKI. If there really is a market for trust establishment and a form of PKI is the low cost producer of trust, then someone should be able to make money by using their expertise to assemble a technology suite and sell trust insurance based on the spread between the risk perceived by the market and what they know to be a lower risk. If such services never develop, it either means there is no market or PKI doesn't have enough economic impact to cover the costs of starting such a business. Arnold Reinhold For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)reservoir.com" with one line of text: "help".

1 0

[p2p-hackers] announcing tiddly_on_tahoe v1.0
by Zooko O'Whielacronx 06 Jul '18

06 Jul '18

[This announcement is being sent to [1]tiddlywiki(a)googlegroups.com, [2]cap-talk(a)mail.eros-os.org, [3]p2p-hackers(a)lists.zooko.com, and [4]tahoe-dev(a)allmydata.com. Please adjust follow-ups appropriately.] Announcing the 1.0 release of tiddly_on_tahoe! This is the combination of TiddlyWiki, which is a JavaScript wiki that runs in a web browser, with Tahoe-LAFS, which is a decentralized secure storage grid. The result of combining these two things is a "decentralized web app". It looks and feels just like a web app, but it is decentralized like a p2p app. To see what one looks like and to make one for yourself, please follow this link -- read-only access to a copy of the tiddly_on_tahoe starter page: [5]http://testgrid.allmydata.org:3567/uri/URI:DIR2-RO:7h7syiurogz5erc2 au74tjwguu:h7bdxvjtvidlkcdbld3j2d5sbgyzsbqs7wdnu6yznqrejzssc5za/wiki.h tml To see one with real content in it, follow this link -- read-only access to my daily hacking journal: [6]http://testgrid.allmydata.org:3567/uri/URI:DIR2-RO:hgvn7nhforxhfxbx 3nbej53qoi:yhbnnuxl4o2hr4sxuocoi735t6lcosdin72axkrcboulfslwbfwq/wiki.h tml To edit one of these and save your changes on the Tahoe storage grid, follow this link -- writable access to a copy of the tiddly_on_tahoe starter page: [7]http://testgrid.allmydata.org:3567/uri/URI%3ADIR2%3Alq5unk3sdmwqckz ey573b35paa%3Azshb54dvy4jmpdxjlptn6ttm4m7awi7xf7hqtwmvjriy6ryeb7ya/wik i.html Then change something, then click "Save Changes". Everyone has write access to that last one, so it may have changed by the time you look at it. For readers of [8]tiddlywiki(a)googlegroups.com: Tahoe-lafs is a secure, decentralized storage grid. All files are strongly encrypted and then split up into 10 pieces in such a way that any 3 of those pieces are sufficient to serve the file. Then each of the 10 pieces is stored on a different server. For more information: [9]http://allmydata.org . For readers of [10]cap-talk(a)mail.eros-os.org: Please let me know what you think about the user interface here which is offering crypto-capabilities embedded into URLs. This is an ongoing experiment in order to determine if crypto-caps-in-URLs work well for actual human use. Please notice the "access control explanation text" at the top of each page. See the appended JavaScript fragment which is the implementation of that explanation. For readers of [11]tahoe-dev(a)allmydata.org: All of the URLs in this note point to the Tahoe Test Grid, but you can of course do the same thing on your own Tahoe grid, and customers of [12]allmydata.com are of course welcome to host their TiddlyWikis on the [13]allmydata.com commercial grid. For readers of [14]p2p-hackers(a)lists.zooko.com: Isn't this cool? Decentralized web apps! Thanks to FND and Eric Shulman -- Tiddly Hackers -- for teaching me JavaScript and Tiddly. Thanks to Douglas Crockford for jslint. Regards, Zooko P.S. A bit of JavaScript to produce the access control explanation text: if (document.location.toString().match(new RegExp(HTTPLEAD + TAHOE_IMMUTABLE_CAP_RE_STR))) { wikify("This is an immutable view of this page. Using this URL will always show this version of this page, even if a newer version has been uploaded.", place); } else if (document.location.toString().match(new RegExp(HTTPLEAD + TAHOE_NONWRITABLE_THING_CAP_RE_STR))) { wikify("This is a read-only view of this page. If you share this URL with someone, they will be able to see the most recent version of this page, but not to change the page.", place); } else if (document.location.toString().match(new RegExp(HTTPLEAD + TAHOE_WRITABLE_THING_CAP_RE_STR))) { getReadonlyURLToThisPage(function (readonlyCap) { wikify("This is a writable view of this page. If you share this URL with someone, they will be able to change this page. Click here for a [[read-only view of this page|" + readonlyCap + "]].", place); }); } else { wikify("You are not accessing this page through the Tahoe-LAFS secure, distributed filesystem.", place); } References 1. mailto:tiddlywiki@googlegroups.com 2. mailto:cap-talk@mail.eros-os.org 3. mailto:p2p-hackers@lists.zooko.com 4. mailto:tahoe-dev@allmydata.com 5. http://testgrid.allmydata.org:3567/uri/URI:DIR2-RO:7h7syiurogz5erc2au74tjwg… 6. http://testgrid.allmydata.org:3567/uri/URI:DIR2-RO:hgvn7nhforxhfxbx3nbej53q… 7. http://testgrid.allmydata.org:3567/uri/URI%3ADIR2%3Alq5unk3sdmwqckzey573b35… 8. mailto:tiddlywiki@googlegroups.com 9. http://allmydata.org/ 10. mailto:cap-talk@mail.eros-os.org 11. mailto:tahoe-dev@allmydata.org 12. http://allmydata.com/ 13. http://allmydata.com/ 14. mailto:p2p-hackers@lists.zooko.com _______________________________________________ p2p-hackers mailing list p2p-hackers(a)lists.zooko.com http://lists.zooko.com/mailman/listinfo/p2p-hackers ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com http://postbiota.org 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE

1 0

Can you be compelled to give a password? [was: Police
by Patrick W. Gilmore 06 Jul '18

06 Jul '18

On Jul 28, 2006, at 1:32 PM, David Farber wrote: > I don't believe it is a crime in any US Federal or State law, or in > Canadian law, to set passwords and use encryption. In the US, I > believe that a warrant would be necessary for law enforcement to > ask for your password, but I don't know if you have to comply. IANAL. That is a good question - Can you be compelled to give up a password? Would you mind posting it to IP, I am interested in the answer. Seems there might be some 'self-incriminatory' arguments here. Perhaps even an "unreasonable search" argument. But IANAL. -- TTFN, patrick ------------------------------------- You are subscribed as Agrosso(a)worldnet.att.net To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting- people/ ------------------------------------- You are subscribed as eugen(a)leitl.org To manage your subscription, go to http://v2.listbox.com/member/?listname=ip Archives at: http://www.interesting-people.org/archives/interesting-people/ ----- End forwarded message ----- -- Eugen* Leitl <a href="http://leitl.org">leitl</a> http://leitl.org ______________________________________________________________ ICBM: 48.07100, 11.36820 http://www.ativel.com 8B29F6BE: 099D 78BA 2FD3 B014 B08A 7779 75B0 2443 8B29 F6BE [demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

1 0

Re: [IP] Can you be compelled to give a password? [was:
by Andrew Grosso 06 Jul '18

06 Jul '18

Police Blotter: Laptop border searches OK'd] As a former Assistant U.S. Attorney, allow me to comment. Information may be obtained by the government from a person in one of four ways: (1) it is voluntarily provided; (2) by regulation in a heavily regulated industry; (3) by subpoena; and (4) by a search and seizure warrant. We are concerned with number 3, the subpoena. A person can refuse to produce incriminating information in response to a subpoena under the Fifth Amendment. Please note that the password is not protected. If it is written down somewhere, the document on which it is written is not protected by the privilege. The *act* of producing the document or the password itself *may* be privileged, if such an act is itself incriminating. For example, if the password was used in a crime, and the fact that you have the password in your possession tends to show that you participated or conspired in the crime, and then the Fifth Amendment privilege is applicable to protect you from implicating yourself in the crime. The Government *can* immunize you to the limited extent necessary to obtain the password - it cannot then use the fact that it got the password from you in order to prosecute you. This is known as "Doe" immunity, and there is an extensive line of cases that has developed in this area. Webster Hubbell, the former Associate Attorney General who was convicted of tax fraud by Ken Starr's IC Office, eventually had his conviction vacated because Starr's legal team failed to follow the rules when they obtained, from him (by subpoena), his tax records. If the government is not investigating a crime, then it may use an administrative or civil subpoena to try and get the password. If the witness invokes the Fifth Amendment, then the government can immunize that person and compel production. The second point, above, concerning a regulated industry, applies to such areas as Medicare and Medicaid, Government contractors for procurement matters, industrial health and safety mattes, environmental concerns, etc. The same analysis as above would apply. Border searches are a different animal, since the government has the right to inspect items crossing the border without a warrant. However, if the password is in the traveler's head, then that is not an "item" that can be inspected at the border. The information on the laptop might very well be such an item, however, and if the only way to convince the government to allow you to cross the border is to show the border guards what is on the laptop, then the traveler might very well face the choice of turning on the laptop and opening files,, using the password, or not crossing the border. I do not believe that, even here, the traveler would have to produce the password itself. Andrew Grosso, Esq. Andrew Grosso & Associates 1250 Connecticut Avenue, NW, Suite 200 Washington, D.C. 20036 (202) 261-3593 Email: Agrosso(a)acm.org Web Site: www.GrossoLaw.com ----- Original Message ----- From: David Farber To: ip(a)v2.listbox.com Sent: Friday, July 28, 2006 2:26 PM Subject: [IP] Can you be compelled to give a password? [was: Police Blotter: Laptop border searches OK'd] Begin forwarded message:

1 0