- cypherpunks-legacy - lists.cpunks.org

re: November 21 meeting, 12 noon, at Cygnus offices
by Tom.Jennings＠f111.n125.z1.FIDONET.ORG 17 Nov '92

17 Nov '92

U> ANNOUNCEMENT U> ============ U> U> The Third Physical Cypherpunks Meeting: Project Planning U> [...] U> U> DIRECTIONS U> ========== [...] U> U> Cygnus Support U> 1937 Landings Drive U> Mt. View, CA 94043 U> U> There's no phone service there yet. Wrong! 415-903-1400 --- ReadMail * Origin: tomj(a)fidosw.fidonet.org / World Power Systems (1:125/111) -- Tom Jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!Tom.Jennings INTERNET - Tom.Jennings(a)f111.n125.z1.FIDONET.ORG

1 0

Re: Extortion Explosion
by nobody＠alumni.cco.caltech.edu 17 Nov '92

17 Nov '92

Cheer up, Cassandra! Things aren't all that bad. > New opportunities in the extortion industry: > > Old problem: the victim may inform the police, making it risky to pick up the > money, which will likely be watched. > New solution: demand payment via cryptomoney. Many forms of electronic money can be traced if there is cooperation between the payer and the bank. For example, [...] However, if she simply _tells_ the bank the value of C, then when Bob goes to deposit it, he can get caught. Fine, if there are some forms of electronic money which can be traced sufficiently to suppress extortion by rivals, and there are some forms which are less traceable, will we have the wisdom to advocate the ones which enable our main oppressor to maintain its monopoly on extorting us? I suspect for many on this list, it would be a bitter pill indeed (it was for me). > Old problem: you may be caught firebombing the house, shooting the victim, > slashing the victim's daughter's face, or whatever; if you subcontract to a > thug, the thug may be caught and inform on you. > New solution: use cryptomoney (and a reputation for paying) to hire thugs > while maintaining anonymity. Well, if thugs know that they are now going to be taking the sole responsibility for their actions, without the safety of knowing that they can rat on their employer if worse comes to worst, then they'll charge more to make up for the greater risk. This will make extortion less profitable. Enough to outweigh the new advantages? > Old problem: providing protection, so that you keep a supply of economically > viable victims from whom to extort. > New solution: Please find one! If the government can't protect victims > from you, how can you protect them from competitors? This is the key point. What stops protection rackets now? Is it really the points listed above: that the money may be traced, that others may falsely benefit from my reputation, that thugs may inform on me? What about simple physical surveillance of property? What about revenge on the transgressors? (As above, the revenge would be restricted to the thugs who did the job, but if it was bad enough it would still have a strong deterrent effect.) My impression is that *the* weak link in extortion activities now is how to pick up the money. This is where most extorters get caught, and it is where our monopolistic extortion & protect racket concentrate their protection activities when faced with a competitor. If someone has a more informed understanding of the practice of "law enforcement authorities" when faced with competitive extortion, please post. Thanks. > Wishful thinking in the pursuit of liberty is no virtue; realism in the > defense of imperfect liberty is no vice. Free-lance oppression isn't freedom, > and I don't want it. > > Cassandra It makes more sense to have good fire and police forces to deal with the bad guys than to get all in a tizzy because the bad guys can talk to each other now without getting caught. If I believed that the police forces could still protect effectively when deprived of their major tool (monitoring the money pickup), then my objection would go away. However, I don't see how they can. It's just too easy to firebomb a house (or any number of other attacks) when no one's looking. Polyanna Cassandra 1784360449840245

1 0

ECPA - PRIVACY
by tom.jennings＠f111.n125.z1.FIDONET.ORG 17 Nov '92

17 Nov '92

Crossposted from FidoNet PUBLIC_KEYS from: GK Pace to: Mike Riddle I just finished reading your article concerning the "laymans view" of the ECPA. I found it very informative, and interesting reading. Thank you for taking the time to study this issue, and share with the rest of us the conclusions you arrived at, upon doing so. I would like to comment upon some of what you've written, in hopes of expanding upon what you have conveyed, and have quoted your article so that those who haven't read your article will find it easier to understand the nature of my comments. ========== Begin Quote ========== Anytime someone passes what they hope to be a private communication to another, they expect that their fellow citizens will respect its privacy. Not only do the customs of society enforce this expectation, statute laws have been enacted to insure it. Thus, everyone knows, or should know, not to tamper with the mail. Everyone knows, or should know, not to electronically eavesdrop ("bug") someone else's telephone calls. And everyone knows, or should know, not to do likewise with computer communications. Alas, not everyone knows that. If everyone did, we wouldn't need laws to protect what ought to be our reasonable expectations of privacy. Not too long ago, the Congress of the United States passed PL 99-508, the Electronic Communications Privacy Act of 1986. In doing so, Congress was recognizing the way technology has changed society and trying to react to that change. ========== End Quote ========== This statement kinda sums up what the discussion is all about... and ties this subject into the provisions of the ECPA. seems like a fitting beginning for the remainder of what I'd like to discuss. ========== Begin Quote ========== What about electronic mail, or "e-mail?" E-Mail has been the single biggest area of misinformation about the new law. First, section 2701 does make it a federal offense to read someone else's electronic mail. That would be exceeding your authorization, since "private" e-mail systems do not intend for anyone other than the sender or receiver to see that mail. But, and a big but, sysops are excluded. ========== End Quote ========== This statement in and of itself lends credibility to the position that we have the right to read any messages passing thru our system... however as you continue to mention, this exclusion is not without conditions, and it isn't necessarily a "right" but is perhaps more accurately defined as an acknowledgement of the technical aspects of our respective systems, and the part we play in accomodating the transfer of E-mail... ========== Begin Quote ========== Whoever staffed the bill for Congress realized that system operators were going to have access to information stored on their systems. ========== End Quote ========== You also of course mention reasons for which this ability might be desired: ========== Begin Quote ========== There are practical technical reasons for this, but there are also practical legal reasons. While the Act does not directly address the liability of sysops for the use of their systems in illegal acts, it recognizes they might have some liability, and so allows them to protect themselves from illegal use. ========== End Quote ========== This statement reeks of common sense... but is there anything in the ECPA which would indicate a "responsibility" on the part of the Sysop to actively monitor such communications, requiring the Sysop to assume the position of censor, police, and/or judge, over the content of those messages passing thru ones system - or does it again acknowledge the techical aspects, and responsibilities the Sysop might be required to exercise in the event the Sysop were to become aware of a message containing potentially illegal information? ========== Begin Quote ========== Sysops are given a special responsibility to go along with this special privilege. Just like a letter carrier can't give your mail to someone else, just like a telegraph operator can't pass your telegram to someone else, just like a telephone operator overhearing your call can't tell someone else what it was about, so sysops are prohibited from disclosing your e-mail traffic to anyone, unless you (or the other party to the traffic) give them permission. ========== End Quote ========== This analysis is again just plain common sense, and again the question arises, are the provisions this refers to those which are acknowledged as technical limitations, accomodating them as such, or are they to be construed as indications that we have obligations above and beyond that which is necessary for the performance of the service we are providing? ========== Begin Quote ========== What all this has said is that the federal criminal code now protects electronic communications the way it previously protected written ones. It understands that mailmen, physical or electronic, have access to the mail they carry, so it tells them not to tell. ========== End Quote ========== This statement seems clear enough... but when viewed from the aspect of the issue of wheather "private" E-mail should be allowed in Fidonet, it gives rise to some questions which can possibly be best conveyed by following the analog you have chosen... i/e that of a mailman, and that of "paper mail". The issue of the Sysop having the ability to read e-mail, as compared to the provisions of the ECPA appear to be more closely comparable to "postcards" being carried by a mailman. In this case, no one could deny that the mailman has a "technical" ability to read the postcards being carried, and that the requirements on the part of the mailman not to divulge such information he/she might happen to notice is clear... as are the responsibilities that would be evident were he/she to become aware of information which could resonably be contrued as illegal in nature. But as in the example of the mailman handling paper mail, there exists the ability to send "private" paper mail, which is enclosed in an envelope. In such cases is is not within the rights of the mailman to open such mail to enable his ability to determine the contents thereof, nor is there any legal responsibility for the mailman to have knowledge of the contents thereof. Indeed it would be a criminal act were the mailman to do so. With the above in mind, wouldn't the introduction of private e-mail capabilities in Fidonet be governed by the same logic? And isn't public key encryption simply the means of wrapping an envelope around e-mail to make it private? -gk --- GenMsg vers:1.14/a * Origin: Privacy... everyone needs it, Lets Route it thru FidoNet (1:374/26) SEEN-BY: 11/2 13/13 101/1 109/25 114/5 123/19 124/1 125/20 28 33 40 111 125 SEEN-BY: 125/180 1212 203/1 23 205/10 209/209 280/1 390/1 396/1 ;;PATH: 374/26 12 1 151/1003 13/13 396/1 203/23 125/125 33 -- tom jennings - via FidoNet node 1:125/555 UUCP - ...!uunet!hoptoad!kumr!fidogate!111!tom.jennings INTERNET - tom.jennings(a)f111.n125.z1.FIDONET.ORG

1 0

Re: IP bouncers
by mark＠coombs.anu.edu.au 17 Nov '92

17 Nov '92

>Remailers are extremely important, but we also need anonymous IP bouncers. > >An IP bouncer might work like this: there would be a user, a server, and a >target. The server and user would each have key pairs (probably a new pair >for each session), and would trade public keys. The user would request a >port from the server, and then would issue (encrypted) commands to the >server. > >These commands might include: >telnet - open a connection to the target. The target would route its >ignore - get ready to recieve lots of random bits and perhaps pass them on to >mail - act as an anonymous remailer (like the ones we already have set up). >port - provide a port that other people can telnet in to. >This type of anonymous bouncer would be helpful for everything we do with I have and use something along these lines. It was written by someone for other purposes but it should be easy enough to port to this application. It's rather inefficient at the moment unfortunately. I'll see what I can do to it. Mark

1 0

Idea on Random Number Generators
by hugh＠domingo.teracons.com 17 Nov '92

17 Nov '92

The problem with Diodes and the like is that it is possable to induce a pattern into the output of these things. Well, might we be able to look at how and set up a counter such that if the open end is held high on one diode it gets driven down on a second circuit which get added togethor before we go onto to 0/1 ballencing? Next I would set up a drifting clock rate on the device reading the diode, this messes up many efects of interference and might help look for induced patterens! Hey, imagen a random number generator that tells you when the bad guys are trying to influence your random numbers! ||ugh

2 1

The legality of PGP
by S.E. Brown 17 Nov '92

17 Nov '92

Well, I've been reading a lot of speculation and outright disinformation about the legality of PGP. Does anyone have any informed information about the actual legal status us sing and disseminating the program? Gratis My SuperIllegal Key : -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.0 mQCNAirSjlcAAAED/ijVaTjlU62mQdXwxj+bEO3wqdMKkZlRNt1rSi8VOSkeQ0G7 7KbBeINoVCTIi12ax74q7ANhKCga+ZkBxAVTnfSBQZXfFh/5XMxzzqk7NT2fKKlZ /Hrf4cDd8VYgSl6WPhyVO+EpvyZn5HezGLBbryGpCcloSmjBcwd2g1pYVIhjAAUR tCxTLkUuIEJyb3duIDxzaGF3bmJAY3NjaWhwLmVjc3QuY3N1Y2hpY28uZWR1Pg== =Wrv7 -----END PGP PUBLIC KEY BLOCK-----

3 2

Why remailers...
by Hal 16 Nov '92

16 Nov '92

Tim mentioned that not many people on the list have expressed interest in the remailers, and it occurs to me that maybe people don't all share the vision of why this crypto technology is important. I'm trying to recall how I learned about the possibilities of this technology. I recall reading "True Names" a few years ago. Vinge had his netters exchanging mail anonymously. The hero downloaded a big batch of messages from a BBS and tried decrypting all of them to see which were for him. Okay, I thought, that would be a way of disguising which messages you were _receiving_. Then Vinge said something like "and using more elaborate techniques, the sender of a message could be hidden as well." Hold on, I thought. That will never work. If they tap your line, they're going to know exactly what messages you're sending. Too bad. Vinge had a clever idea going, but it's flawed. I only learned about Chaum's crypto stuff last year. Somebody on the Extropians list mentioned PGP, and I'd always had a casual interest in crypto, so I downloaded it and played with it some. I thought it was great and really got into it in a big way. This got me interested in crypto in general, so I started doing some library research. When I found Chaum's stuff, it just blew me away. The first article I found, I think, was his CACM paper which is an overview of many of the things that are possible. I started trying to track down other papers by Chaum. Here were all the technologies needed to make Vinge's world work, technologies which Vinge apparently knew about long before I did. It seemed so obvious to me. Here we are faced with the problems of loss of privacy, creeping computerization, massive databases, more centralization - and Chaum offers a completely different direction to go in, one which puts power into the hands of individuals rather than governments and corporations. The computer can be used as a tool to liberate and protect people, rather than to control them. Unlike the world of today, where people are more or less at the mercy of credit agencies, large corporations, and governments, Chaum's approach balances power between individuals and organizations. Both kinds of groups are protected against fraud and mistreatment by the other. Naturally, in today's society, with power allocated so disproportionately, such ideas are a threat to large organizations. Balancing power would mean a net loss of power for them. So no institution is going to pick up and champion Chaum's ideas. It's going to have to be a grass-roots activity, one in which individuals first learn of how much power they can have, and then demand it. Where do the remailers fit in? They represent the "ground floor" of this house of ideas - the ability to exchange messages privately, without revealing our true identities. In this way we can engage in transactions, show credentials, and make deals, without government or corporate databases tracking our every move as they can today. Only by securing the ability to communicate privately and anonymously can we take the next steps towards a world in which we each have true ownership and control over information about our lives. Chaum's ACM paper is titled, provocatively, "Security Without Identification - Transaction Systems to Make Big Brother Obsolete." The work we are doing here, broadly speaking, is dedicated to this goal of making Big Brother obsolete. It's important work. If things work out well, we may be able to look back and see that it was the most important work we have ever done. Hal Finney 74076.1041(a)compuserve.com

2 1

Re: Rander box and other stuff
by George A. Gleason 16 Nov '92

16 Nov '92

So we need to set up UPSs (uninterruptable power supplies, i.e. backup power) for our u-wave ovens, and build a standard interface which will set the appropriate parameters (5 sec on high cook) and start, which can be connected to a burglar alarm with panic switches and keypad with duress code. Then if the barbarians come to the door, it's one-two-three-FLUSH! Somewhat inconvenient if the barbarians come a-callin' when you're in the middle of a crypto session ("'scuse me while I put something in for dinner...") but doable... -gg

3 3

Digital Cash bibliography
by Tim Oren 16 Nov '92

16 Nov '92

As a followup to Tom's bibliography, here's a list I compiled about six months ago on digital cash, including Chaum's basic articles, others published in this area, and a list of relevant U.S. patents. - Tim O. ----------- Bibliography for Digital Cash and Checks using Cryptographic Techniques Articles Chaum, D., Showing credentials without identification: transferring signatures between unconditionally unlinkable pseudonyms. (Springer-Verlag, Berlin, West Germany, p. 246-64, 1990)(Conference: Advances in Cryptology-AUSCRYPT '90 International Conference on Cryptology. Proceedings, Sydney, NSW, Australia, 8-11 Jan. 1990) Chaum, D. den Boer, B. van Heyst, E. Mjolsnes, S. Steenbeek, A., Efficient offline electronic checks. (Springer-Verlag, Berlin, Germany, p. 294-301, 1990)(Conference: Advances in Cryptology - EUROCRYPT '89. Workshop on the Theory and Application of Cryptographic Techniques Proceedings, Houthalen, Belgium, 10-13 April 1989) Chaum, D., Online cash checks. (Springer-Verlag, Berlin, Germany, p. 288-93, 1990)(Conference: Advances in Cryptology - EUROCRYPT '89. Workshop on the Theory and Application of Cryptographic Techniques Proceedings, Houthalen, Belgium, 10-13 April 1989) Chaum, David, Security without Identification: Transaction Systems to make Big Brother Obsolete; Communications of the ACM 28/10 (1985) 1030-1044. Chaum, D. Fiat, A. Naor, M., Untraceable electronic cash. (Springer-Verlag, Berlin, West Germany, p. 319-27, 1990)(Conference: Advances in Cryptology - CRYPTO '88. Proceedings, Santa Barbara, CA, USA, 21-25 Aug. 1988) Okamoto, T. Ohta, K., Disposable zero-knowledge authentications and their applications to untraceable electronic cash. (Springer-Verlag, Berlin, West Germany, p. 481-96, 1990)(Conference: Advances in Cryptology - CRYPTO '89. Proceedings, Santa Barbara, CA, USA, 20-24 Aug. 1989) Even, S., Secure off-line electronic fund transfer between nontrusting parties. (North-Holland, Amsterdam, Netherlands, p. 57-66, 1989)(Conference: Smart Card 2000: The Future of IC Cards. Proceedings of the IFIP WG 11.6 International Conference, Laxenburg, Austria, 19-20 Oct. 1987) Tunstall, J.S., Electronic currency. (North-Holland, Amsterdam, Netherlands, p. 47-8, 1989)(Conference: Smart Card 2000: The Future of IC Cards. Proceedings of the IFIP WG 11.6 International Conference, Laxenburg, Austria, 19-20 Oct. 1987) Hayes, Barry, Anonymous One-Time Signatures and Flexible Untracable Electronic Cash, in AusCrypt '90: A Workshop on Cryptology, Secure Communication and Computer Security, January, 1990. U. S. Patents W. M. Benton, Funds Transfer System using Optically Coupled, Portable Modules, US Pat. #4,454,414, Jun 12, 1984. W. G. Bouricius and P. E. Stuckert, Method and Apparatus for Secure Message Transmission for Use in Electronic Funds Transfer Systems, US Pat. #4,302,810, Nov. 24, 1981. D. Chaum, "Cryptographic Identification, Financial Transaction, and Credential Device," US Pat #4,529,870, Jul. 16, 1985. W. S. Powell, "Information Communicating Apparatus and Method," US Pat. #4,320,387, Mar. 16, 1982. P. E. Stuckert, "Personal Portable Terminal for Financial Transactions," US Pat. #4,277,837, Jul. 7, 1981.

1 0

November 21 meeting, 12 noon, at Cygnus offices
by Eric Hughes 16 Nov '92

16 Nov '92

ANNOUNCEMENT ============ The Third Physical Cypherpunks Meeting: Project Planning It has become clear that lots of code needs to be written, and that we will be writing it. Therefore the Third Meeting will be devoted to project planning and design review. Date: November 21 Time: 12 noon Where: Cygnus Support offices Who: you, and anybody you know who wants to come, and so on. (Please do not post this announcements to public places, but do encourage private circulation.) Positive-Confimation: Please tell me if you are coming. Replies to hughes(a)soda.berkeley.edu. Please, I urge all of you on the list that can make to attend this time. This will be a pivotal meeting, since we are deciding priorities here. If you want to affect the course of development, you ought to show up. If you can't attend, corner someone on the list who will be there and convince them to represent your position. Eric Hughes AGENDA ====== 1. Key exchange. Bring a diskette with your PGP public key on it. Bring a machine which can read this diskette. Bring extra diskettes to collect keys on and to give out. Let us not be hypocrites and let us all know each other's public keys. 2. Project planning. We need a list of crypto projects and who is working on them. This will help coordination and avoid duplication of effort. We need to prioritize the projects to avoid premature development. We need to create strategies and design criteria. 3. Project logistics. We need to talk about the best ways to do widely distributed software development in this fairly anarchic environment. 4. Design review. Hal Finney and I have been duking it out behind the scenes working on a design schema for the next generation remailer. I'd like to present the design and have people critique it. (would be 5.) We won't be playing the crypto-anarchy game this time. It's not a dead duck, but this time we've got more urgent things to do. DIRECTIONS ========== Here is a reposting of the directions to the meeting place. ------------------------------------------------------------------ To: cypherpunks(a)toad.com Subject: Better directions to the meeting on Saturday at noon From: gnu(a)cygnus.com Someone asked for better directions, and the original ones were pretty skimpy anyway. Here's a better try. Cygnus Support 1937 Landings Drive Mt. View, CA 94043 There's no phone service there yet. Take US 101 toward Mt. View. From San Francisco, it's about a 40-minute drive. Get off at the Rengstorff Ave/Amphitheatre Parkway exit. If you were heading south on 101, you curve around to the right, cross over the freeway, and get to a stoplight. If you were heading north on 101, you just come right off the exit to the stoplight. The light is the intersection of Amphitheatre and Charleston Rd. Take a right on Charleston; there's a right-turn-only lane. Follow Charleston for a short distance. You'll pass the Metaphor/Kaleida buildings on the right. At a clump of palm trees and a "Landmark Deli" sign, you can take a right into Landings Drive; this gets you into the complex from the north. Or you can go slightly further along Charleston and take the next right, into a driveway with a big "Landmark" sign in the middle. No matter which way you got into the complex, follow around it until you are on the side that faces the freeway. There's a clock tower that rises out of one of the buildings, to the right (south) of the deli. Enter through the doors immediately under the clock tower. They'll be open between noon and 1PM at least. (See below if you're late.) Once inside, take the stairs up, immediately to your right. At the top of the stairs, turn right past the treetops, and we'll be in 1937 on your left. If you are late and the door under the clock tower is locked, you can go to the deli (which will be around a building and left, as you face the door), cut between the buildings to the right of the deli, and into the back lawns between the complex and the farm behind it. Walk around the buildings until you see a satellite dish in the lawn. Go up the stairs next to the dish, which are the back stairs into the Cygnus office space. We'll prop the door (or you can bang on it if we forget). Or, you can find the guard who's wandering around the complex, who knows there's a meeting happening and will let you in. They can be beeped at 965 5250, though you'll have trouble finding a phone. Don't forget to eat first, or bring food at noon! I recommend hitting the burrito place on Rengstorff (La Costen~a) at about 11:45. To get there, when you get off 101, take Rengstorff (toward the hills) rather than Amphitheatre (toward the bay). Follow it about ten blocks until the major intersection at Middlefield Road. La Costen~a is the store on your left at the corner. You can turn left into the narrow lane behind the store, which leads to a parking lot, and enter by the front door, which faces the intersection. To get to the meeting from there, just retrace your route on Rengstorff, go straight over the freeway, and turn right at the stoplight onto Charleston; see above. See you there! John Gilmore

1 0