- cypherpunks-legacy - lists.cpunks.org

Wassenaar Arrangement and public domain software
by Declan McCullagh 17 Dec '03

17 Dec '03

The courier showed up, and I'm now at home changing in preparation for a soccer game (I'm part of a libertarian soccer team), but thought I'd post a brief note about the W.A. It says: "The Lists do not control 'software' which is either generally available to the public... or in the public domain." So what's the fuss about? Hmm.... -Declan

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

> >Nothing personal. I just get tired of hearing about "story angles" and > >"columns." Frankly, the only people I want to communicate with are those > >who take the time to read this and related lists....the sheeple who read > >about the Net in Time and Newsweek and their ilk are not worth > >communicating with. They will be spaded under. > > But what if Declan were writing for the Economist... I have a lot more respect for Duncan's style than certain Economist articles. A case in point was a little hatchet job some journo-hack did on Sorros' piece on the open society in the Atlantic monthly. I consider that Sorros has demopnstrated empirically a knowledge of markets that few economists and no journalists can claim to match yet the economist decided to have a go at him. In any case since the piece was principally about political philosophy the Economist interpretation was plain wrong. Phill

2 1

Re: [PGP-USERS] BestCryp NP
by Alec 17 Dec '03

17 Dec '03

>From: GWNapier(a)aol.com >Date: Thu, 10 Apr 1997 16:11:41 -0400 (EDT) >To: pgp-users(a)rivertown.net >Resent-Message-ID: <"h3W-hD.A.rVC.jmUTz"@rivertown> >Reply-To: pgp-users(a)rivertown.net > >To Fred and His Question About BestCrypt NP. I received this today and >thought it might be of interest. > >>Someone asked on the list about the possibility to transparently access >>encrypted data on a CD. SFS doesn't allow this, but I yesterday found >>a software for Windows 95 that does. > >>BestCrypt NP costs $115, the home page is www.jetico.sci.fi. >>They even have our Mr Peter Gutmann on their credits list. BestCrypt >>supports BlowFish, DES (boo) and GOST, a russian standard with >>256bit key. It supports all fixed, removable or networked media, >>allowing upto 6 "containers" be open simultaneously. > >>Although the company seems like Finnish, they don't speak Finnish and >>I don't get even a discount for telling you this :) Just thought some >>of you might be interested. > >>Jyrki Petsalo

2 1

Japan E-Commerce Promotion Council on CAs
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Thu, 10 Apr 1997 11:44:59 -0700 From: jmuller(a)brobeck.com (John D. Muller) Subject: Japan E-Commerce Promotion Council on CAs To: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: jmuller(a)brobeck.com (John D. Muller) Press release Announcement of Certification Authority Guidelines in Japan ---------------------------------------------------------------------- -- Full Document 7th, April, 1997 Electronic Commerce Promotion Council of Japan ---------------------------------------------------------------------- -- 1. Background The Electronic Commerce Promotion Project partially funded by the Japanese government was started In late 1995 . The project consists of 19 test-bed projects which experimentally provide various kinds of electronic commerce between consumers and businesses. Currently over 350 companies participate in the projects and more than 500,000 consumers are presumed to have join. To foster Electronic Commerce(EC) in Japan, and also to support and coordinate these projects, the Electronic Commerce Promotion Council of Japan (ECOM) was established in early 1996. ECOM has set up 14 Working Groups to study a wide range of EC related issues. One of these Working Groups is the Certification Authority(CA) Working Group which focuses on the technology, practice, and legal environment of CA. One of objectives of this CA Working Group is to develop the CA Guidelines. The primary draft of the Guidelines was made public in the December 1996. 2. Objectives of the CA Guidelines CA Guidelines provide the foundation for the operation of CAs which issue digital certificates. A digital certificate, which electronically verifies the identity of business parties during network transactions, will play an important role in electronic commerce conducted via open networks. Digital certification guarantees the security of transaction information transmitted through networks, and information transmitted between organizations, within organizations and between individuals, by eliminating problems such as wiretapping, tampering or repudiation. This fosters the reliance and trust required to conduct business. 3. Structure of the CA Guidelines(Alpha Version) (1) Introduction This section first defines the basic terminology related to CAs, such as public keys, certificates, and revocation of certificates, etc. The section then deals with the following subjects concerning public key infrastructure, which can be regarded as the technological foundation of the guidelines: (1) certificate management service for issuance, publication, and storage of certificates, services relating to the registration and management of personal information, and electronic notary, etc. (2) hierarchical structure of CAs; (3) purpose of use and format of certificates. (2) Management requirements As management requirements are important for increasing the reliability of CAs, establishment and publication of policies relating to certification, requirements needed by organizations, operational security requirements, and information disclosure requirements are stipulated. Within the policy arena the establishment and presentation of provisions concerning the requirements for secure operation of equipment and facilities, and of provisions concerning standards for issuance of certificates are discussed. This section also stipulates that organizational requirements must specify independence, third party character and specialization. (3) Service requirements This section specifies requirements for guaranteeing security relating to five services that constitute the certificate management service, which is the basic service of CAs: management of the keys of CAs, issuance of certificates, registration and publicizing of certificates, storage and management of certificates, and revocation of certificates. For example, in view of the serious consequences of leakage or theft, private keys of CAs must be stored in an independent special module with high storage capacity, and in an environment that does not allow illegal removal of the storage module. Auditing of certificate issuance are also discussed. The personal verification of the applicant must be divided into three levels and that personal verifications should be conducted according to these levels. (4) Facilities and system requirements This section specifies that requirements conform to measures classified under group A of the "Information Systems Security Measures Standards," which were announced by MITI in August 1995 and the instruction manual was published by the Information Service Industry Association in October 1996. Group A requirements relate to information systems that affect people's lives, the property of others, privacy and other social elements. 4. Forthcoming Schedule ECOM is requesting that member companies and other relevant parties offer their comments regarding this guidelines draft. At the same time, the guidelines will be applied to the electronic commerce test-bed projects sponsored by MITI ( Ministry of International Trade & Industry), with the results of these test operations to be incorporated in the guidelines. The final version, based on opinions obtained from various sectors, is scheduled to be prepared and announced by March 1998. More information E-mail: tawara(a)ecom.or.jp FAX : +81-3-5531-0068 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from the dcsb list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Re: Checkout the crypto in IE 4.0
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>Maybe people have already noticed but the pre-release IE 4.0 has >S/MIME encryption and signatures built in. I'm trying to set it up >as we speak. Just found an even more important cypherpunk feature. It has a kill file feature for both news and mail. Now if we could just get them to put Dimitri in as the default it would be fine. Phill

1 0

security_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ Thursday April 10 10:03 AM EDT Internet Security Code Said Vulnerable To Hackers By David Morgan ATLANTA - The new security protocol for safeguarding credit-card transactions on the Internet may have to change because the underlying cryptography is too easy to hack through and too difficult to upgrade, an expert says. Steve Mott, senior vice president of electronic commerce and new ventures for MasterCard International, said it could take hackers as little as a year to break the industry's standard encryption code, which is supposed to render credit-card numbers unreadable to outsiders on the Internet's World Wide Web. For that reason, the consortium of technology companies and creditors that has spent two years developing the Secure Electronic Transaction (SET) protocol may switch to a faster encryption system called Elliptic Curve, which is produced by Certicom Corp. The first complete version of SET, known as SET 1.0, will be available to software makers June 1 with core cryptography provided by RSA Data Security, a unit of Security Dynamics Technologies. "RSA is a very good starting point. But we suspect that in a year or two, the Kevin Mitnicks of the world will start to figure out ways to hack it," Mott said. Mitnick is one of the most notorious computer hackers. "The only way you scale an RSA is to add a lot more bits. You add a lot more bits and it becomes more complex software in terms of the interaction of the transaction messages. That's part of what's taken SET so long to start with." MasterCard has been helping put together merchants with its own member banks for SET pilot projects in Denmark, Japan, Taiwan, South Africa and the United States. Mott told a news conference at the Internet Commerce Expo that the Elliptic Curve encryption system would make a better encryption core. In fact, he said it would have been chosen in the first place if developers had been known about it. "It will fit on a chip card. I think its 160 bits equals security to 1,024 bits of RSA," the credit industry executive said. "We anticipate putting it into some SET 1.0 pilots in the very near future this year in the U.S." Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

EVENT! Rep. Anna Eshoo (D-CA) holds online town hall meeting April 16!
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================= _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ "Government Without Walls" _________________________________________________________________________ Update No.5 http://www.democracy.net/ April 10 1997 _________________________________________________________________________ Table of Contents - Join Silicon Valley Internet Policy Leader Anna Eshoo (D-CA) Live April 16. - Background on Rep. Eshoo - democracy.net statistics - About democracy.net ___________________________________________________________________________ JOIN SILICON VALLEY INTERNET POLICY LEADER ANNA ESHOO (D-CA) Live ONLINE! Representative Anna Eshoo (D-CA), walks point for Silicon Valley on Internet policy issues. Her career has been marked by outspoken positive positions on Internet policy, but also for her groundbreaking work of making the Internet a tool for servicing her constituents better. Rep. Eshoo will hold a live online interactive 'town hall meeting' at democracy.net on Wednesday April 16 at 8:30 pm Eastern (5:30 pm Pacific). The town hall meeting, moderated by Wired Magazine's Todd Lappin, will be completely virtual. The discussion will be cybercast live via RealAudio, and listeners can join a simultaneous interactive chat discussion and pose questions to Rep. Eshoo. This is a unique opportunity for Internet users to discuss current Internet issues, including how Congress can better communicate with the public using the Internet, the chances for online speech legislation in the 105th Congress, Congress' agenda for encryption policy reform, and others. Details on the event, including instructions on how you can submit questions in advance, are attached below. ____________________________________________________________________________ INSTRUCTIONS ON HOW TO PARTICIPATE * Interactive Town Hall Meeting with Rep. Anna Eshoo (D-CA) * DATE: Wednesday, April 16, 1997 TIME: 5:30 pm Pacific / 8:30 pm Eastern LOCATION: http://www.democracy.net In advance of the town hall meeting, please visit http://www.democracy.net and fill out the form to ask Rep. Eshoo a question. We will collect the questions and forward them to the moderator on the day of the event, and will make every effort to ensure that questions from constituents are asked first. 1. Attend and ask Rep. Eshoo a question! Please mark this date in your calendar: Thursday April 16, 5:30PM Pacific at http://democracy.net/ 2. Get your friends and co-workers to join the discussion Members of Congress love to hear from their constituents. If you have friends that live in the district, please forward this invitation and encourage them to attend. 3. Make sure you have the right software To participate in the chat, you will need two pieces of software besides a Web browser. To listen to the _____________________________________________________________________________ BACKGROUND "We need to send a clear, unscrambled message to Washington that our nation's encryption policy needs to be reformed, and reformed now." -- Rep. Anna Eshoo (D-CA), SAFE Forum, July 1, 1996 Given the 14th District's concentration of high-tech industries, it is not surprising that Rep. Eshoo serves on the House Committee on Commerce. Her subcommittee assignments on this committee include the Subcommittee on Telecommunications, Trade, and Consumer Protection, as well as the Subcommittee on Health and the Environment. The Commerce Committee has policy making power over high technology, biotechnology, public health, and the environment. Through her seat on the Commerce Committee, Rep. Eshoo is well positioned to assist high technology interests in her district. She fought hard to ensure that securities litigation reform and telecommunications reform were signed into law. Rep. Eshoo has introduced the Online Parental Control Act to fight government censorship and encourage parents to use technology to control their children's access to online materials. She has led the fight to improve the Food and Drug Administration's product review process and played an instrumental role in securing the $238 million B Factory for the Stanford Linear Accelerator Center. In addition, Rep. Eshoo has pushed to loosen costly export controls on high technology products, make NASA contractors more liable for the costs of failing to comply with their contract requirements, and prevent government laboratories from competing with private industry. She also played a key role in stopping the Financial Accounting Standards Board from adopting a rule requiring businesses to charge stock options against earnings, a move which could have seriously curtailed the growth of small firms and start-up businesses, particularly in the high technology industry. Additional Information can be found at the following locations: * Rep. Anna Eshoo's Home Page -- http://www-eshoo.house.gov/ * democracy.net Page -- http://www.democracy.net/ _______________________________________________________________________________ DEMOCRACY.NET STATISTICS In the two weeks following the original Pro-CODE cybercast hearing, over eight times as many people (804) listened to the RealAudio archive than could have fit into the room at the hearing itself! The hearing transcript continues to be extremely popular, with the testimony of Jim Barksdale (CEO, Netscape) and Louis Freeh (Director, FBI) counting as the two most popular hearing witnesses to listen to. Over a quarter of our visitors to the hearing archives stop to listen to Barksdale and Freeh's takes on the encryption debate. Whether you're a concerned citizen who can't get to Washington, a student researching the topic of privacy, or a reporter just following the debate, these archives are here for you. You can experience Government Without Walls at the March 19th hearing cybercast archive at http://www.democracy.net/. _______________________________________________________________________________ ABOUT DEMOCRACY.NET The democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, Public Access Networks, the Democracy Network, and DIGEX Internet. More information about the project and its sponsors can be found at http://www.democracy.net/about/ To receive democracy.net announcements automatically, please visit our signup form at http://www.democracy.net/ _____________________________________________________________________________ End update no.5 04/10/1997 =============================================================================

1 0

Re: store your private key on a multi-user system! use pubkeys without verifying them!
by Toto 17 Dec '03

17 Dec '03

Bryce wrote: > > The non-cpunks that I talk to frequently say that "no bad guys > would bother to read my e-mail". > as long as the value of reading your private e-mail is less than > the cost of reading it, you can consider yourself safe. Bad, bad assumption. > So my points are as follows: > 2. To the cpunks: the _value_ of invading your privacy is not that > high. There are no evil storm troopers whose full time job is to run > a man-in-the-middle attack on your PGP public key, or dedicate a > cracking farm to decrypting your messages, or using TEMPEST devices > on your home computer or whatever. Therefore, simply encrypting your > personal e-mail with a 512-bit PGP key, storing your private key on > your local multi-user Unix system, and using people's public keys > _without_ doing anti-Man-In-The-Middle techniques is more than > sufficient to protect your privacy. Horseshit. Send me all of the email and files from the hard drives of the NSA, CIA, FBI, and the organizations we don't know about, for the last 20 years, and then we'll talk about what evil storm troopers do, or do not, exist. Then we can begin to talk about what really trips up most fugitives/criminals/freedom-fighters--the mundane. J.Edgar Hoover didn't rise from the grave to entrap the UnaBomber with high-tech devices and an army of spooks. His own family turned him in. Four guys broke into a Vancouver bank a few years ago, spent the weekend cracking the vault and safety deposit boxes, and made a clean getaway, except one of their suitcases broke open on the trip out of town, spilling the goodies for everyone to see. They sat in jail until Monday morning, when the banks opened, and the cops could figure out who they robbed. > Now, if you use your e-mail to transmit really _valuable_ data, then > that is a different story. I submit that everyone has _really_valuable_data_, no matter what value others put on it. I would guess that there are no shortage of people who would rather have their company's data compromised, than have their spouse find their secret love-letters. The key is to be as meticulous as possible in your security precautions, because those things you have little knowledge of or control over may well be more dangerous to you than those that you don't. Case in point. I spent twenty years of my life making sure that I had extra 'butts' on me at all times, so that I would not have to face my greatest fear--going to jail without a suffiecient supply of nicotine. The one time I slipped up was when I was on 'safe' ground, in my hometown, crossing a border I had crossed every day for the last few weeks with no trouble. Then I got hauled in for a 'bad check' that was a result of a clerical error. I actually had the cancelled check in my motorhome, but the facts didn't matter--I was headed for the slam with almost no butts. An understanding Sheriff's deputy with a couple extra packs probably saved me from the death penalty for killing cops to escape and go get more butts. When you decide that you've got nothing to worry about, because the 'bad guys' aren't after you, then the 'good guys' will get you. Your wife will hire a teenage hacker to look for the secret love letters that don't exist, and turn up unrelated info that the kid will use to get a sweetheart deal when the Feds break down 'his' door. Your employer's audit of the books will point to you being a thief, and in the process of proving you innocent, will turn up evidence of your office affair, giving your spouse grounds for divorce. The people who get fucked aren't the people who 'deserved' it. They aren't the people who 'took crazy chances'. They aren't the people who 'had the most to hide'. They are the people who got fucked. The bottom line is, if you have something to hide, then hide it, and hide it well. You can be faster than a speeding bullet and leap tall buildings in a single bound, but somewhere out there is a bum going through a dumpster, and he just found a funny, glowing, green rock. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

2 1

Re: A mini rant on IRS and Social Security
by Toto 17 Dec '03

17 Dec '03

Timothy C. May wrote: > > Many of you in the United States have probably seen the reports on how the > Social Security Administration has pulled their Web site, citing security > problems. > > I'm not naive. I knew that anything I reported to the IRS, or that my > employers reported, was accessible to those with access (Q.E.D.). I just am > surprised that my earnings for the past 28 years are "online," available > to anyone with the few bits of entropy needed to get past the minimal > security. > > This ought to be recounted far and wide. Remind your siblings, friends, and > others about this situation. Point out to them that when a society becomes > dominated by "accounts," instead of old-fashioned cash payments, then he > who controls the keys controls everything. IRS Continues Personal Privacy and Security Breeches (From the NYTimes, April 9, 1997) The IRS admitted that it has not stemmed the improper browsing of taxpayer records by nosy agents. 1,515 such cases have become known in the last two years. A study of the EARL (Electronic Audit Research Log) software program indicates that, "some employees, when encountered, indicated they browsed because they do not believe it is wrong and that there will be little consequence to them if they are caught." About 51,000 IRS employees have access to taxpayer records through the Integrated Data Retrieval System. Senator John Glenn, (D-OH) agrees, as recent court rulings have decided that these invasions of privacy are not illegal as long as the information is not given to others; as though determining that was at all possible. Senator Glenn is attempting to levy heavy fines and imprisonment for violators. The GAO has also determined, according to their recent report on these abuses, that 6,400 tapes and cartridges which "might" contain taxpayer information are also missing. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

1 0

Re: "...markets are fundamentally chaotic, not efficient"?
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> By that definition, markets, whether for capital or assassins, > are distinctly _not_ chaotic*, since most people's decisions > [* Unless Life, The Universe, and Everything are really > deterministic, but fate has decreed that I don't believe that...] > about what stocks to buy/sell, and particularly the timing, > are influenced by lots of random events - when they hear what information, > whether they were busy doing something else when they heard, > whether they'd just blown their disposable income on a new car > because that freak windstorm dropped a tree on their car the same > week the Post Office ate their car insurance payment, > whether Alan Greenspan had a bad pizza the night before the quarterly > interest rates came out or too much caffeine before his latest speech.... I don`t really want to get into this discussion/flame war too deeply but I will post on this thread once... Any of the events described above are completely determined by the initial conditions of the system, just because a system is too complex for us to measure its initial conditions in enough detail does not mean it is random, it simply means we see it as random. Hence a market`s behaviour is labeled chaotic, because it appears random. It is, however, completely deterministic however we cannot know the initial conditions because they are too complicated. End of chat, chaotic behaviour is NOT random, it simply appears so unless one can accurately measure the intial conditions. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 2