- cypherpunks-legacy - lists.cpunks.org

...and other Trials
by deltorto＠aol.com 22 Jan '93

22 Jan '93

>> Tom DeBoni adds: >>should university academicians working for state-supported institutions be subject >>to the same constraints on privacy and freedom from arbitrary search and seizure in >>their email and computer files as high federal governmental officials? That's a tough one. I suppose there would have to be a body that decided on a case by case (or a class by class) basis what accounts would be subject to heavy scrutiny. Unfortunately, this begins to create a overseeing body so huge and convolute as to render the entire process unwieldly approaching on the absurd. I read Kafka's "The Trial" and I don't want to face that sort of Juggernaut any time soon. On the other hand, if you don't lump _every_ friggin' state and federal employee (and I didn't) into the picture and only consider those persons with a dangerous largesse inherent in their positions (sorry, but that swell fella Ollie North somehow once again comes to mind), the whole thing takes on a more manageable (notice I said "more") appearance. Hey, this is a tough ethical dilemma. I ain't got all the answers, just an opinion (just like assholes... everyone's got one, right?). Basically, I worry about abuse of email systems by knowledgable/sinister government officials. When you consider how hard it is for the general public to conceive of abuse on paper memos, imagine how much damage and subversion a savvy individual could do with a "computer" (gwarsh, Mickey! Whut's a kum-pee-you-ter?) to the democratic process before anyone would pay attention to a cypherpunk crying "wolf!" Encryption to the Masses! dave

1 0

unsubscribe
by parish＠cactus.org 22 Jan '93

22 Jan '93

Please remove me from the mailing list. Thank you Tom

1 0

Re: random remailers
by DrZaphod 22 Jan '93

22 Jan '93

In Message Thu, 21 Jan 93 12:47:35 PST, Eric Messick <parallax.com!eric(a)netcomsv.netcom.com> writes: >The problem with this is that every site along the way has to know the >final delivery address, at least of this subset of the address chain. >Better to just send it directly, and add some load balancing traffic. > >-eric messick What about letting every remailer see the second to last system in the remailing process, another remailer. Other remailers would route the message around for a specified # of times +/- a small random # [users choice with a max. limit set by remailers]. The second to last remailer would recognize the last remailer from it's public key encrypted message [::Request-Remailing-To: FinalDestination] and send it on down to the last remailer which would decrypt the final remailing block using it's secret key and send the intended message to it's final destination. This would provide random remailing routes without compromising the ending not originating location. The first remailer wouldn't know if it had just received a message from a person, or another remailer. TTFN! DrZaphod [AC/DC] / [DnA][HP] [drzaphod(a)ncselxsi.uucp] Technicolorized

1 0

public servant privacy
by deltorto＠aol.com 22 Jan '93

22 Jan '93

In response and affirmation of Eric Fogleman's note on Communications Policy, I have to concur. ALL documents produced by a public official operating an email system on public time and in pursuit of public policy (e.g. a White House official) should be subject to scrutiny and should not be considered as that person's private property. If such a person wants to have private communications with other private citizens, they should do it on their OWN time and with their OWN money. HOWEVER, if such persons then turn around and abuse this freedom by abusing the public trust in those contexts (i.e. if Ollie North started communicating with NSA officials through CompuServe to order illegal shipments of money to CIA agents in Peruvian cocaine cartels), they should, by virtue of their positions of public trust be subject to the same (presumably high) levels of scrutiny as they are now - Congressional, OMB, GSA, FBI investigations, etc. >>The burden should not be on individuals to constantly be open to scrutiny to >>demonstrate their innocence, but on those with the power to suspend individual >>rights. Yes, private citizens should not be subject to the same sorts of investigations unless there is direct evidence of criminal intent or activity in which case there should be a search warrant and notification of intent to search. Tim May notes (appropriately) that: >>Strong crypto means even Ollie North can fully protect his records. Yes, but shouldn't he be _required_ to "open" his files if he is under criminal investigation just like a drug-dealer who's required to open the locked trunk of his car? I'm sure my opinion is open to development, but this is my gut-level response. dave

3 2

Communications Policy
by norm＠xanadu.com 21 Jan '93

21 Jan '93

I hear concern over privacy and also over erasure of White House tapes. I pose the following question: Should an institution have the right to private communication? Is the White House an institution? Notice that I say "should" not "does". Which sort of world would you rather live in. I have mixed feelings. If we say that all computer communications should be accessible to courts then the effect will be to displace some communications from computers.

4 5

Re: possible solution to the anonymous harrassment problem
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 21 Jan '93

21 Jan '93

> RSA has a patent on their algorithm. It's quite likely that I can't > even create a key pair without their permission, let alone use it. You're poorly informed. As a condition of a grant from DARPA to RSADSI, RSAREF may be used noncommercially, for free, to do any of the following: - RSA encryption and key generation, as defined by RSA Data Security's Public-Key Cryptography Standards (PKCS) [4] - MD2 and MD5 message digests [3,5,6] - DES (Data Encryption Standard) in cipher-block chaining mode [7,8] Moreover, I believe you'll find that RSADSI has become much more helpful recently. For more information, anonymous ftp to rsa.com and look around. I've just gone over the RSAREF license agreement again. It seems to permit any sort of not-for-profit operation, including a public key service. -- Marc Ringuette (mnr(a)cs.cmu.edu)

5 4

privacy vs. public servants
by deboni＠diego.llnl.gov 21 Jan '93

21 Jan '93

This is a very interesting thread. But should university academicians working for state-supported institutions be subject to the same constraints on privacy and freedom from arbitrary search and seizure in their email and computer files as high federal governmental officials? I submit that the amount of (real or potential) oversight should be somehow proportional to the potential for harm or abuse of power available to the individual involved. Surely Ollie North or Richard Nixon had much greater abilities to subvert the democratic process or otherwise break the law than Professor Smith of the Chemistry Dept. of State U. Tom DeBoni (a state and federal employee with no power whatsoever)

1 0

Re: random remailers
by Eric Messick 21 Jan '93

21 Jan '93

>> Has anyone thought about the consequence of randomly picking a >> remailing path instead of using the same one? > >what if the remailer flips a coin, choosing between final delivery >and remailing through another of its ilk. "message delivery with >probability one ..." The problem with this is that every site along the way has to know the final delivery address, at least of this subset of the address chain. Better to just send it directly, and add some load balancing traffic. -eric messick

1 0

Re: Communications Policy (fwd)
by tcmay＠netcom.com 21 Jan '93

21 Jan '93

After sending the attached message to Johan Helsingius, I decided it might be of general interest to the Cypherpunks list. It's a message I sent out in December, originally, and which got debated. Johan's concern about my "accusations" suggests there may be enought newcomers to the list to justify republication of posts. --Tim From: tcmay (Timothy C. May) Subject: Re: Communications Policy To: julf(a)penet.FI (Johan Helsingius) Date: Thu, 21 Jan 93 9:49:00 PST > > e-mail system kept by sysadmins. Sort of like the archives being kept > > by some of the so-called anonymous remailers!) > > Hmmmm.... I find the accusation about anonymous remailers pretty strong. > If you have proof of stuff like that happening, or even reasonable cause > for suspicions, I feel the accusations and names of the sites should be > published as widely as possible. That is the only way we can stop > such unethical behavior. Johan, Attached below is the message I sent to the Cypherpunks list in December, about remailers keeping logs. As I said in my message today to the list, there was a debate about this, and an admission by several remailers that they keep archives. From: tcmay(a)netcom.com (Timothy C. May) Message-Id: <9212140649.AA12228(a)netcom.netcom.com> Subject: A minor experimental result To: cypherpunks(a)toad.com Date: Sun, 13 Dec 92 22:49:45 PST One of the purposes of setting up remailers is to experiment with them, see what kind of emergent behavior appears, see what kind of flaws and obstacles arise, see how they break, etc. Here's one: the compromise of my "anonymity" by one of the folks running a remailer. (Who and where don't matter, just the phenomenon itself.) I used a single bounce without any encryption to send a message and got a query from the owner of the remailer saying "I couldn't help looking through my remailer archives and noticing...." and requesting more information from me!! Hoist by my own petard! Several lessons: * Multiple bounces help, even without encryption, as then the remailer sysop can't be sure who originated the message. * Encryption is of course even more desirable, though a hassle (especially for Mac users). * Remailer sysops should make a point to _not_ look at their remailer archives. In fact, they should discard them immediately (for their own legal protection, and for slightly greater trust amongst users, though this is a hazy area...). (Recall that the "mix" on which our software-based remailers are loosely patterned are "memoryless," i.e., the tamper-resistant modules that implement the receive-decrypt-store-forward protocol have no memory of the mapping between incoming and outgoing messages. In fact, the outside world cannot possibly compromise the protocols to get at this information.) So, my laziness in using only a single bounce, combined with the curiosity of a remailer sysop, breaks the anonymity. Neither surprising nor profound, but I thought you folks would like to know. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | PGP Public Key: by arrangement.

1 0

Re: possible solution to the anonymous h
by Hal 21 Jan '93

21 Jan '93

I have to agree with Peter Honeyman that Marc Horowitz's proposal that remailers reveal message sources under certain conditions wouldn't work well. Remailer users will prefer remailers which won't do this. So reputations and such will tend to push things in the opposite direction. Also, I'd point out that the Pax remailer actually did maintain a database of anonymous addresses with the corresponding real addresses. So it already worked much as Marc suggested. You can actually send mail to someone who posts anonymously through Pax just as easily as you could send to someone who posted non-anonymously. So if you want to complain about some offensive posting or email to the person who did it, you still could with Pax. These features didn't stop Pax from getting shut down. Marc's suggestion that commercial users could run remailers without pressure from NSF sounds good in theory, but it's not clear how well it would work in practice. I don't think Cypherpunks could run such a remailer, even if Marc is right and it would cost $10 per Cypherpunks reader per month. I doubt that many people would be willing to make this charitable contribution for what would be a public good - a remailer that anyone could use. Even if it could be done, one remailer isn't enough. We need many remailers so that no one remailer can expose users. I think the best bet would be a commercial site which has a connection for other reasons, and which is willing to run a remailer on the side. I don't know what kinds of sites use these commercial connections. The commercial Internet access that I am aware of is through companies like Compuserve, Portal, Netcom, the WELL, and so on, and I think they all have to abide by the NSF acceptable use policies. At least, I had to agree to those on Portal and I think on Compuserve. What would be an example of a site with commercial Internet access which would be free of NSF pressure? One other point I'd make with regard to Marc's message is that if PGP itself is the problem, there's no reason the remailers can't use RIPEM. That's legal in the U.S., so the legality issue would not arise. This might be a good approach to take in broaching the subject with administrators. I haven't looked at RIPEM much but I'm sure the remailers could use it just as easily as PGP. Even non-encrypting remailers can provide basic anonymous posting and mail, if those would be more acceptable. A final point is that forwarding mail for another person can hardly be made illegal in general. If I receive a message from person A asking me to forward it on to person B, and I do so, this is clearly a legitimate email message that I choose to send. To try to disallow this would be to put intolerable restrictions on email content. So, if this is allowed, it seems to me that I should be able to write a program to do what I am allowed to do manually. If these remailers could be made widespread, with tens of thousands of people running them as a routine service, I think a crackdown would be much more difficult. I think we need to educate users about the value of privacy and anonymity in order to encourage more people to run remailing software. Can anyone suggest a newsgroup where these kinds of discussions would be appropriate? Hal Finney 74076.1041(a)compuserve.com

5 4