- cypherpunks-legacy - lists.cpunks.org

more on security/obscurity/reality
by Hal 16 Jan '93

16 Jan '93

I can understand Daniel Ray's proposing to keep a low profile in running remailers, using encryption and such. Pax was probably the highest profile service, at least in the Usenet groups I use, and look what happened to it. The problem is, how can a remailing service be secret? Its address has to be known in order for it to be used! The only way it could be secret that I can see would be for it to have only a small, select group of "clients" who use it, and who keep the address to themselves. But there is no such group; it's not like there's some kind of ring of privacy lovers out there who will want to use such services but who will be willing to keep the servers secret. If remailers are going to be useful, they _have_ to be public. People have to know how to reach them in order to use them. The real task, it seems to me, is to justify anonymous mail to the Internet public, so that people will not support these shutdowns, and, even better, so that people will routinely use encryption and even remailing when they communicate. Eric Hughes made the point here some time back that we should aim for a society where sending non-encrypted remail is considered rather eccentric: "What? You send your mail _exposed_? You don't mind if everyone reads it?" In the same way, sending mail in such a way that everyone can see who you are communicating with, and that everyone you send to can see your true address automatically, could become equally unusual. One other point I'd make regards the use of pseudonyms for replying. The Pax service created a pseudonym for each person who used the service which was put into the "From:" line of outgoing mail. Then people could reply to that pseudonym and it would go back to the original sender. The problem with this approach, as far as spreading remailers, is that you have to have privileges on your machine in order to create new user ID's. An individual user who doesn't own or run a machine is generally not able to create such pseudonyms. This means that the number of people who can run remailers which use such features is much smaller than the number who can run the simpler Cypherpunks remailers in their current versions. The Cypherpunks remailers do allow for anonymous return addresses, but they are quite cumbersome to use, not automatic like the Pax type. But they do have the advantage that anyone who has access to Unix, PGP and Perl can run them. This is probably a much larger population. Hal

2 1

Released GSA Docs Slam FBI Wiretap Proposal
by Dave Banisar 16 Jan '93

16 Jan '93

"GSA Memos Reveal that FBI Wiretap Plan was Opposed by Government's Top Telecomm Purchaser" The New York Times reported today on a document obtained by CPSR through the Freedom of Information Act. ("FBI's Proposal on Wiretaps Draws Criticism from G.S.A.," New York Times, January 15, 1993, p. A12) The document, an internal memo prepared by the General Services Administration, describes many problems with the FBI's wiretap plan and also shows that the GSA strongly opposed the sweeping proposal. The GSA is the largest purchaser of telecommunications equipment in the federal government. The FBI wiretap proposal, first announced in March of 1992, would have required telephone manufacturers to design all communications equipment to facilitate wire surveillance. The proposal was defeated last year. The FBI has said that it plans to reintroduce a similar proposal this year. The documents were released to Computer Professionals for Social Responsibility, a public interest organization, after CPSR submitted Freedom of Information Act requests about the FBI's wiretap plan to several federal agencies last year. The documents obtained by CPSR reveal that the GSA, which is responsible for equipment procurement for the Federal government, strongly opposed two different versions of the wiretap plan developed by the FBI. According to the GSA, the FBI proposal would complicate interoperability, increase cost, and diminish privacy and network security. The GSA also stated that the proposal could "adversely _affect national security._" In the second memo, the GSA concluded that it would be a mistake to give the Attorney General sole authority to waive provisions of the bill. The GSA's objections to the proposal were overruled by the Office of Management and Budget, a branch of the White House which oversees administrative agencies for the President. However, none of GSA's objections were disclosed to the public or made available to policy makers in Washington. Secrecy surrounds this proposal. Critical sections of a report on the FBI wiretap plan prepared by the General Accounting Office were earlier withhold after the FBI designated these sections "National Security Information." These sections included analysis by GAO on alternatives to the FBI's wiretap plan. CPSR is also pursuing a FOIA lawsuit to obtain the FBI's internal documents concerning the wiretap proposal. The GSA memos, the GAO report and others that CPSR is now seeking indicate that there are many important documents within the government which have still not been disclosed to the public. Marc Rotenberg CPSR Washington office rotenberg(a)washofc.cpsr.org Note: Underscores indicate underlining in the original text. Dashes that go across pages indicate page breaks. [Computer Professionals for Social Responsibility is a non- profit, public interest membership organization. For membership information about CPSR, contact cpsr(a)csli.stanford.edu or call 415/322-3778. For information on CPSR's FOIA work, contact David Sobel at 202/544-9240 (sobel(a)washofc.cpsr.org) ------------------------------------------------------------- (#4A) Control No. X92050405 Due Date: 5/5/92 Brenda Robinson (S) After KMR consultations, we still _"cannnot support"_ Draft Bill. No. 118 as substantially revised by Justice after its purported full consideration of other agencies' "substantive concerns." Aside from the third paragraph of our 3/13/92 attachment response for the original draft bill, which was adopted as GSA's position (copy attached), Justice has failed to fully address other major GSA concerns (i.e., technological changes and associated costs). Further, by merely eliminating the FCC and any discussion of cost issues in the revision, we can not agree as contended by Justice that it now " ... takes care of kinds of problems raised by FCC and others ...." Finally, the revision gives Justice sole unilateral exclusive authority to enforce and except or waive the provisions of any resultant Iaw in Federal District Courts. Our other concerns are also shown in the current attachment for the revised draft bill. Once again OMB has not allowed sufficient time for a more through review, a comprehensive internal staffing, or a formal response. /Signature/ Wm. R. Loy KMR 5/5/92 Info: K(Peay),KD,KA,KB,KE,KG,KV,KM,KMP,KMR,R/F,LP-Rm.4002 (O/F) - 9C1h (2) (a) - File (#4A) ------------------------------------------------------------- ATTACHMENT REVISED JUSTICE DRAFT BILL DIGITAL TELEPHONY The proposed legislation could have a widespread impact on the government's ability to acquire _new_ telecommunications equipment and provide electronic communications services. _Existing_ Federal government telecommunications resources will be affected by the proposed new technology techniques and equipment. An incompatibility and interoperability of existing Federal government telecommunications system, and resources would result due to the new technological changes proposed. The Federal Communications Commission (FCC) has been removed from the legislation, but the Justice implementation may require modifications to the "Communications Act of 1934," and other FCC policies and regulations to remove inconsistencies. This could also cause an unknown effect on the wire and electronic communications systems operations, services, equipment, and regulations within the Federal government. Further, to change a major portion of the United States telecommunications infrastructure (the public switched network within eighteen months and others within three years) seems very optimistic, no matter how trivial or minimal the proposed modifications are to implement. In the proposed legislation the Attorney General has sole _unilateral exclusive_ authority to enforce, grant exceptions or waive the provisions of any resultant law and enforce it in Federal District Courts. The Attorney General would, as appropriate, only "consult" with the FCC, Department of Commerce, or Small Business Administration. The Attorney General has exclusive authority in Section 2 of the legislation; it appears the Attorney General has taken over several FCC functions and placed the FCC in a mere consulting capacity. The proposed legislation would apply to all forms of wire and electronic communications to include computer data bases, facsimile, imagery etc., as well as voice transmissions. The proposed legislation would assist eavesdropping by law enforcement, but it would also apply to users who acquire the technology capability and make it easier for criminals, terrorists, foreign intelligence (spies) and computer hackers to electronically penetrate the public network and pry into areas previously not open to snooping. This situation of easier access due to new technology changes could therefore affect _national security_. (1) ------------------------------------------------------------- The proposed legislation does not address standards and specifications for telecommunications equipment nor security considerations. These issues must be addressed as they effect both the government and private industry. There are also civil liberty implications and the public's constitutional rights to privacy which are not mentioned. it must be noted that equipment already exists that can be used to wiretap the digital communications lines and support court- authorized wiretaps, criminal investigations and probes of voice communications. The total number of interception applications authorized within the United States (Federal and State) has been averaging under nine hundred per year. There is concern that the proposed changes are not cost effective and worth the effort to revamp all the existing and new telecommunications systems. The proposed bill would have to have the FCC or another agency approve or reject new telephone equipment mainly on the basis of whether the FBI has the capability to wiretap it. The federal- approval process is normally lengthy and the United States may not be able to keep pace with foreign industries to develop new technology and install secure communications. As a matter of interest, the proposed restrictive new technology could impede the United States' ability to compete in digital telephony and participate in the international trade arena. Finally, there will be unknown associated costs to implement the proposed new technological procedures and equipment. These costs would be borne by the Federal government, consumers, and all other communications ratepayers to finance the effort. Both the Federal government and private industry communications regular phone service, data transmissions, satellite and microwave transmissions, and encrypted communications could be effected at increased costs. (2) ============================================================= Documents disclosed to Computer Professionals for Social Responsibility (CPSR), under the Freedom of Information Act December 1992 =============================================================

1 0

Re: more on security/obscurity/reality (fwd)
by tony＠morgan.demon.co.uk 16 Jan '93

16 Jan '93

In message <9218(a)eternity.demon.co.uk> you write: > Forwarded message follows: > > > From cypherpunks-request%toad.com(a)relay2.uu.net Fri Jan 15 12:52:47 1993 > > One thing I've really noticed over the 5 or 6 years I've been on the net > is the real hatred people have for what is coined "security by obscurity." > I think it is because of the terrible way people have gotten burned by > relying on conceiled methods only, or secret algorithms as ciphers to > protect their material. The method is discovered one way or another, and > everything caves in on itself! Quite understandable. > > Yet I cringe at the way people have just turned their backs on the whole > meta-philosophy of "coversion." If, for instance, you are to do battle with > an unbearable, overwhelming power, such as the Government, then what is the > only real way to "win?" Besides convincing them not to do battle with you? > > It is by staying conceiled, secret, untargetable. If they don't know to fight > you, or, if they do know, but cannot find you, then you stay all right. > Once it gets to a face-to-face confrontation, however, you lose, and you > lose immediately, there is nothing you can bring to bear, since it is now > just a force equation, and they have over 10,000 times the force you do. > Or more... > > This is one of the applications of the secret side of life. Modern crypto- > graphy has advanced, I think, by declaring all coversion as eventually > discoverable, and only seeking algorithms that will suffice even if the > enemy knows your methods. I agree with this. I guess I part company, however, > when people totally throw out being secretive as a partial or adjunctive > solution to something that is intrinsicly secret to begin with. The addition > of conceilment, disinformation, invisibility, etc. can be a tremendous > advantage when combined with strong methods (good ciphers that don't rely > on coversion). It is a multilayered approach that first tries to not become > a target, and, if it is a target is still hard to crack. > > When us little people try to maintain privacy against a Govt. that is REALLY > PISSED OFF BY EVEN THE IDEA WE WANT TO STRONGLY PROTECT OURSELVES, a multi- > layered, contingency-based approach is required. The most important part of > it is not a strong cipher, but, not to become a detectable or locatable > target. i.e. coversion and secrecy. While what you say is certainly true, it won't survive any kind of detailed attack. I'm all for the sentiment, but while there are so many mundane things going on round about, the best way to remain undetected is to remain undecipherable and to make sure that there is enough traffic about of the same sort. Press for encipherment of e-mail, that way, if everybody is doing it, who's to know what the underworld is doing? This is especially useful if you are not actually interested in violent revolution. You can then convince the powers that be that you are not worth monitoring. regards Tony ------------------+-------------------------------+--------------------------+ | Tony Kidson |`morgan' is an 8MB 486/33 Cat-| Voice +44 81 466 5127 | | Morgan Towers, |Warmer with a 670 MB Hard Disk.| E-Mail | | Morgan Road, |It resides at Morgan Towers in| tony(a)morgan.demon.co.uk | | Bromley, |Beautiful Down Town Bromley. | tny(a)cix.compulink.co.uk | | England BR1 3QE | -=<*>=- | 100024.301(a)compuserve.com| +=================+===============================+==========================+

1 0

Re: possible solution to the anonymous harrassment problem
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 15 Jan '93

15 Jan '93

> If you read closer, you will see that you need "special permission from > RSADSI" to use non-published interfaces to RSAREF. I thought their interface was good enough to do all of the obvious operations -- RSA block encrypt and decrypt being the most important -- and that this restriction was just to prevent bizarrelly hacked versions of their code from being confused with the original. > R_SignPEMBlock computes a digital signature on a message > R_VerifyBlockSignature verifies a digital signature on a block of > data such as a certificate Let me know if I'm wrong, but I don't think I am. -- Marc Ringuette (mnr(a)cs.cmu.edu)

2 1

Re: use of ripem instead of pgp
by Marc.Ringuette＠GS80.SP.CS.CMU.EDU 15 Jan '93

15 Jan '93

Bear in mind that many countries have restrictions about shipping encrypted traffic across their borders. These restrictions will be almost impossible to enforce, true, but do exist. M.

1 0

Re: use of ripem instead of pgp
by jthomas＠kolanut.mitre.org 15 Jan '93

15 Jan '93

BRIAN MCBEE <opac!brian%OPAC.osl.or.gov(a)cs.orst.edu> writes: >Since the only reason we are talking about RIPEM is because of legality >concerns about PGP, I thought I'd mention that it is (at least theoretically) >illegal to export RIPEM from the US, annd therefore could not be legally used >to correspond with persons overseas. >I don't know if there is a legal way to do public key cryptography between >persons inside the US and persons outside the US. What is illegal to export is the software implementations of strong cryptography, not messages encrypted with them, or even detailed specifications of how to implement compatible software. So, theoretically, if a group in each COCOM-complying country and a group out of the reach of COCOM each independently implemented software to do the public-key cryptography (the U.S. group is the only one that will have to worry about licensing PKP's patents), then trading encrypted mail would be unquestionably legal. It would also be a lot of wasted work and duplicated effort, and I don't see any reason to respect the laws that make exporting or importing this software illegal. RIPEM has no doubt escaped the U.S. since RSADSI put it up for anonymous FTP last week, and PGP is everywhere. Joe

1 0

unsubscribe
by eab＠msc.edu 15 Jan '93

15 Jan '93

unsubscribe please

1 0

use of ripem instead of pgp
by BRIAN MCBEE 15 Jan '93

15 Jan '93

> RIPEM is Mark Riordan's public-key program. It is similar to PEM, but does > not use the PEM certificates and therefore does not require people to have > their keys signed by an agency. It is not really PEM compatible. It does > use the RSAREF public-domain encryption package, so it is legal for non- > commercial use in the U.S. and Canada. > > What I suggested was the use of RIPEM since it is available now, is legal, > and is free. > > Note, though, that whether RIPEM or PGP is used, they are only for non- > commercial use. A remailer that wanted to charge, such as the ones that > Eric Messick is discussing, would probably have to license the technology > from PKP directly to be legal. (I'm not sure whether PEM also is limited > to non-commercial use.) > > Hal Finney > 74076.1041(a)compuserve.com Since the only reason we are talking about RIPEM is because of legality concerns about PGP, I thought I'd mention that it is (at least theoretically) illegal to export RIPEM from the US, annd therefore could not be legally used to correspond with persons overseas. I don't know if there is a legal way to do public key cryptography between persons inside the US and persons outside the US. ----- Brian McBee ----- (503)378-4276 ----- brian(a)opac.osl.or.gov ----- ----- Oregon State Library, State Library Building, Salem, OR 97310 ----- Plan globally, attack locally

2 1

resource for writing corp e-mail policy?
by matt＠oc.com 15 Jan '93

15 Jan '93

Can anybody out there point me towards some resources that could be used to write a good corporate e-mail privacy policy? -- Matthew Lyle (214) 888-0474 OpenConnect Systems matt(a)oc.com Dallas, TX "...and once you have tasted flight, you will walk the earth with your eyes turned skyward, for there you have been, and there you long to return..."

1 0

Re: pax shutdown
by jordan＠imsi.com 15 Jan '93

15 Jan '93

From: BRIAN MCBEE <opac!brian%OPAC.osl.or.gov(a)CS.ORST.EDU> If it turns out that pressure to shut down really did come from the official net hierarchy ... There is no question: those who were paying for the (quite expensive, relatively low bandwidth) connection between the US & Australia found themselves with a saturated link and looked for a "good candidate" to shut off. It turns out that lots of the packets are mail, and a good number of the mail messages were going to/from the anonymous service. This was not a move against anonymous e-mail or the research into it. This was just an abuse of "someone elses money" that was easy to target. Next topic please ... this is getting tired. /jordan

1 0