- cypherpunks-legacy - lists.cpunks.org

Re: CDA: The Sequel -- introduced in the U.S. Senate
by Mikhael Frieden 17 Dec '03

17 Dec '03

At 05:01 PM 11/12/97 -0500, Declan McCullagh wrote: >Just when you thought the Internet was safe from government >censorship, Sen. Dan Coats has introduced a sequel to the >notorious Communications Decency Act. >The bill punishes commercial distributors of material >that's "harmful to minors" with six months in jail and a >$50,000 fine. Unlike the original CDA, it applies only to >web sites -- not to chatrooms, newsgroups, or email. On the legal side this narrowing has a modest merit in that the government has established (rightly or wrongly) the power to control publishers. It is difficult to find a reference to a website that does not make a reference to publishing. Thus it falls under a reasonable interpretation of existing law and precident (and distinguished from, the internet is a telephone as the frozen brains would have it.) The critical problem is obvious, harmful to minors. Tooth decay is harmful to minors, all product advertising that can be construed as increasing the incidence of tooth decay is harmful to children. It also brings up the German "I can trump your arguement and invent a new one" excuse for banning Zundelsite, that it was "ethically disorienting to children." If one presumes ethical disorientation is a harm then one has to hold all forms of education that promote independent thinking are harmful to children. It would therefore make huge numbers of academic sites criminal including the Gutenberg Project for carrying materials that resulted in the prosecution of Socrates for essentially the same crime. It is not a viable concept without a definition of harm to children. Given current events, any mention of air bags is not merely harmful to children but lethal to children. -=-=- I have contacted the owner with a problem. It still sends to me but does not receive. Until the mailing list problem is corrected I will try to continue participation this way. Let me know if you have a problem with this method.

1 0

Re: SWAT: A Growth Industry
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Dan Veeneman wrote: > US News & World Report 11/17/97 > Everyone gets into the terrorism game > BY DAVID E. KAPLAN > >Congress...allocated more than a billion dollars in support ... > Even the toughest critics acknowledge that many of the new programs are > needed. For example, they agree that the training of local emergency > workers to deal with a chemical or biological attack is long overdue. Are these guys with the same government that ignores the fact that the development of antibiotic-resistant *natural* diseases due to the greed of the medical and pharmaceutical industries may well lead to more death and disaster than any terrorist threat?

1 0

(Fwd) Victory For Microbroadcasting!!!!
by Ross Wright 17 Dec '03

17 Dec '03

------- Forwarded Message Follows ------- Date: Thu, 13 Nov 1997 10:45:16 -0800 (PST) From: gregruggiero(a)earthlink.net (Greg Ruggiero) Subject: Victory For Microbroadcasting!!!! Friends, This should raise the hopes of all microbroadcasters. We, who oppose the barriers against free communications and the corporate takeover of our media institutions, need to do all we can to ensure that the airwaves really become free. Support your local alternative media. Howard Rosenfeld ---------------------------------------------- ANOTHER VICTORY FOR FREE RADIO BERKELEY & MICROPOWER BROADCASTING At 7 PM on Thursday, [ed: correction - Wednesday] November 12 attorneys for Stephen Dunifer & Free Radio Berkeley received a 14 page decision via fax from Federal District Court Judge Claudia Wilken announcing her ruling in favor of Stephen Dunifer and Free Radio Berkeley. Her ruling denies the FCC's motion for summary judgement for a permanent injunction, states that she has jurisdiction in this case and that the FCC's regulatory structure is unconstitutional. Further, she orders the FCC to submit within 14 days a brief on the constitutional issues raised. Essentially Judge Claudia Wilken affirms all the merits and arguments raised by the defense attorneys for Stephen Dunifer and Free Radio Berkeley. Stay tuned for further details. The full text of the decision will be posted ASAP. A victory party will take place on Saturday evening, November 15 in Berkeley. Place to be announced as soon as one is secured. Everyone is invited. Stephen Dunifer Free Radio Berkeley ******************************************************************* NEW YORK Media for Change <<< FREE MEDIA >>> Changing the Media ALLIANCE listserve: nyfreemedia(a)tao.ca voicemail: (212) 969-TOFM website: http://artcon.rutgers.edu/papertiger/nyfma ******************************************************************* =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://ross.adnetsol.com Voice: (408) 259-2795

3 3

Think Locally...Act Globally / Re: FTC, Canada, Mexico officials launch "health claim surf day"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

> > ****************************************** > > FTC Launches North American Health Claim Surf Day > > ****************************************** > > by Michael Evers ... > > The Federal Trade Commission (FTC), its federal and state law > > enforcement partners, and public health and consumer protection > > agencies from Mexico and Canada are sending you (and hundreds of other > > Internet advertisers) this message based upon a review of the promotion > > you disseminated through the Internet. How about if you are selling something on your web site and giving pointers to information/advertisements located on a foreign website? Let me guess...hhmmm...disabled grandmothers who are selling their home-grown chamoemille tea will have their homes confiscated, and corporations with expensive lawyers will be approved for an exemption on some flimsy grounds. Anybody know of any Mexican laws I can break by putting something illegal there, but legal in Canada, on my web site? Any CypherSpics who would like to put up a "Canadian Hate" page that I could link to? CyhperCanuck

1 0

Re: Mad as Hell (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Wed, 12 Nov 1997 20:02:38 -0800 > From: Blanc <blancw(a)cnw.com> > Subject: Re: Mad as Hell > Tim May wrote: > > >Colorado state Senator Charles Duke, also in the studio audience, > >spoke about the 10th Amendment Sovereignty Resolution, a modern > >version of Magna Carta designed to force a constitutional showdown > >with the federal government. > > This sounds interesting! This is what I had in mind, in that other thread > about "What Will Revolution Look Like" > > >[...]A merchandise ine with caps, t-shirts with the blazing > >l "Mad As Hell" logo is also planned. > > However, this is unfortunate. Trinkets like these may bring in useful and > needed funds, but they take away from the seriousness of the effort, from > the respect the cause deserves. They make the wearers look like weenies > playing a child's game, rather than serious individuals in their rights > minds with the concentration and commitment to do important work for the > purpose at hand. > > (In a silly mood, I could see a gathering of such supporters in a large, > crowded courtroom, all wearing T-shirts saying, "It's *ShowTime* !!!" ) A reasonable motto should be something like: 10th? I'm all for a political faction, they really don't have to be as organized as the Big Two & Little Third would like you to believe. Perhaps the concepts of multiple political parties with their own popularist views has become truly effective because of the impact of technology in particularly on concept expression, and communications. What needs to happen is a small group of suitably inspired whiz kids need to get together and form a complete plan for creating legal cases to decide the respective aspects of the 10th. ARTICLE X. The powers not delegated to the United States by the Constitution, nor prohibited by it to the States, are reserved to the States respectively, or to the people. In some manner the question of whether the first sentence is an implicit limitation of *all* laws and regulations at the federal level needs to be tested. In other words, each and every law *must* trace its existance to a specific set of sentences in the Constitution. If it could be found to be so then each and every law and regulation at the federal would have to pass constitutional review at every stage of its existance within the federal government. Then a case needs to found of some situation say the founding of a church based on smoking marijuana was a illegal entity under the 1st where it is found that such organizations were illegal (rather trivial I suspect). At this point the wording of the 1st becomes *much* more specific. ARTICLE I. Congress shall make no law respecting an establishment of religion, or prohibiting the free exercise thereof; or abridging the freedom of speech, or of the press; or the right of the people peaceably to assemble, and to petition the Government for a redress of grievances. Under this light it becomes glaringly clear that not only is Congress not allowed to even discuss legislation respecting claims of religion. Per the 10th that would fall to the individual states to resolve under their individual constitutions. This would force many of the major social issues onto a regional basis where they could be dealt with in a plurality of ways. Issues regarding infringement of private ownership of weapons becomes glaringly clear in that light. It simply isn't a federal issue. Per the 10th it must be dealt with at the state level. Other issues such as no searches except under warrant issued with probable causes automaticaly prohibits various sorts of searches including samples of body tissue. The issue of the use of federal military troops for any sorts of operations except those respecting the operations of the defence of the US would be clearly decided. Such silliness as the Supreme Court finding that teachers have the Constitutional right to search kids because of supposed criminal wrong doing is clearly shown for what it is, an violation of an individuals civil rights. Warrants can only be issues on probably cause. Under these sorts of conditions the various consensual crimes our government now routinely practices would end. This is vary scary to the status quo crowd. And here lies the rub, the initial 10th test cast must be irrefusable concerning the 10th. The question then becomes, "What is the issue?". What law or aspect thereof is found so compelling that the Supreme Court *must* accept the case for ruling *and* must find in favor of Constitutional review. For maximum impact somebodies life must hang in the balance in such a manner that some fundamental question of legal lineage is brought forth. This reduces the issue to its most fundamental, "Is the right of the state more important than the life of the individual?" Why some lawyer has not used this basic question in the numerous murder trials is truly amazing. If he wins a legal precidence is set. If he looses and gets to appeal. Then walk that appeals train right up to the fundamental question of the 10th. Forcing the Supreme Court to either reject, stating clearly their answer in favor of the majority, or else to review and find that laws must pass Constitutional muster. Either way the question gets answered. ____________________________________________________________________ | | | The financial policy of the welfare state requires that there | | be no way for the owners of wealth to protect themselves. | | | | -Alan Greenspan- | | | | _____ The Armadillo Group | | ,::////;::-. Austin, Tx. USA | | /:'///// ``::>/|/ http://www.ssz.com/ | | .', |||| `/( e\ | | -====~~mm-'`-```-mm --'- Jim Choate | | ravage(a)ssz.com | | 512-451-7087 | |____________________________________________________________________|

2 1

CDA: The Sequel -- introduced in the U.S. Senate
by Anonymous 17 Dec '03

17 Dec '03

>Just when you thought the Internet was safe from government >censorship, Sen. Dan Coats has introduced a sequel to the >notorious Communications Decency Act. Oh joy. >The bill punishes commercial distributors of material >that's "harmful to minors" with six months in jail and a >$50,000 fine. Unlike the original CDA, it applies only to >web sites -- not to chatrooms, newsgroups, or email. ^^^^^^^^^ What defines a "web site?" "The World Wide Web" originally meant "material accessible using the HyperText Transfer Protocol." The media and Klintonkov distorted the term into something else, but that's what the term still means. USENET newsgroups do not become "Internet chat groups" just because the clueless sheeple start calling them that. Of course this is how the government thinks. If I make a posting to USENET did I post the material on a "web site?" If I make the material accessible via ftp is it posted on a "web site?" What if it's available using FSP? How about IRC? What about a Bob's Proprietary Pornography Transfer Protocol? How are they going to track this? What happens when I post this material on an Eternity server outside of the U.S.? What if I just keep posting my porn through the remailer network? What if the porn site is in Amsterdam? What if I just get tired of the totalitarians and double-blind the entire process using the remailer network and while I'm at it I accept anonymous payment? What if I bring my porn into a public computer lab and upload it somewhere without any identification or with a psuedonym? Is the P.Q.R.T. (Pornography Quick Response Team) going to bust through the door before I've done this, which takes all of about 30 seconds? What happens when people start posting such porn to sci.chem? What about sci.crypt or alt.christnet? What about misc.legal? comp.org.eff.talk? news.groups? >Like the original CDA, it's certain to be controversial. >Sen. Coats (R-Indiana), chief GOP sponsor of the original >CDA, said his bill takes into account the Supreme Court's >unanimous vote in June that struck down his first try. "I >have studied the opinion of the Court and come before my >colleagues today to introduce legislation that reflects the >parameters laid out by the Court's opinion," he said on the >Senate floor. > (ftp://ftp.loc.gov/pub/thomas/c105/s1482.is.txt) Is this bill available on the "World Wide Web?" I would argue that reading this bill is "harmful to minors" because it completely ignores the Constitution of the United States. Further, it encourages people to lie, cheat, violate oaths of office, and generally abuse power. Senator Coats, what an example for America's youth! >Coats' brainchild is strikingly similar to (and in fact not >as broad as) an ill-fated version of the first CDA that >Rep. Rick White (R-Wash.) and the Center for Democracy and >Technology embraced as a "compromise" in December 1995. >Like Coats' bill, the White-CDT measure restricted material >that was "harmful to minors." > (http://www.epic.org/cda/hyde_letter.html) >A Coats staffer said the measure requires adult >pornographers to place images behind a firewall. "If you're >involved in the commercial distribution of material that's >harmful to minors, you have to take the bad stuff and put >it on the other side of a credit card or PIN number," David >Crane said. What happens when they say "this material must be put behind a firewall?" Do I comply with the letter of the law if I firewall some random port like 49554? What if I firewall everything except port 80? What if I use a dedicated box as a network router and firewall? These things are all "firewalls." Who determines what is a "valid firewall?" Microsoft? A Coats staffer? A credit card company? What happens when these credit card numbers are sent all over the network in the clear? As it stands now you usually send a credit card number when you want to buy something. What they want here is for everybody to go send credit card numbers all over the net just to view free previews and get to text-based information. And, of course, since we have to protect society from the Four Horsemen, these credit card numbers will likely be sent in the clear or using encryption which can be cracked by a college student running a distributed cracker at idle priority on each of the several hundred machines in a lab. And getting even *one* credit card number is worth a lot. What prevents me from setting up a bogus site which asks for credit card numbers to view some nudie pictures I pulled off USENET or other sites and just storing the credit card numbers? How many of these people access just one porn site so it would be that easy to track? How can anybody prove that's what I did? Once handing credit card numbers out is as second nature as SSNs, all bets are off. And what happens when Little Johnny goes and gets Daddy's credit card and uses the number as ID? If they aren't charging, this probably won't be showing up on an invoice. And Little Johnny has plausible deniability anyway. What about stolen credit card numbers? Who determines what is "material harmful to minors?" Coats? The Supreme Court? Psychologists? Scientologists? Klitonkov? The United Nations? My hamster? Duncan McLeod of the Clan McLeod? Who? Well, I guess this outlaws any meaningful political discussions, discussions of abortions, any meaningful social discussions, any meaningful discussions about sex or romance, any discussions about the prevention of sexually transmitted diseases, any discussions of firearms, any discussions of hand-to-hand combat, any discussions of self defense, any discussions of guerilla warfare, any discussions of pyrotechnics, any discussions about chemistry, lists like BUGTRAQ where exploits are posted, et cetera ad nauseum. All of those things might be considered "harmful to minors." Damn the Constitution and freedom! If it saves the life of one innocent yet incredibly stupid child then just forget about that pesky freedom thing. After all, that's only the domain of "far right-wing nazi gun nuts and radicals," right? >But the bill applies to more than just visual pornography. >Its definition of material that could hurt minors includes >any offensive sexual "communication" or "writing" without >redeeming value. It applies to text-only web pages -- or >bookstores that place sample chapters on the web. Yeah! Go Senate! Go ahead and ban any digital copies of books like 1984 (oh the irony!), digital versions of the Christian Bible, the Torah, et cetera ad nauseum. >Since it covers anyone who "through the World Wide Web is >engaged in the business of the commercial distribution of >material that is harmful to minors," it could apply to >Internet providers and online services as well. How are they going to enforce this one? Mandate that sites only serve "government certified safe" or "independantly certified safe" sites? Turn off all phone and network access, jam all radio and sattelite communications, and legislate that anybody caught with a laser capable of communications or floppy disks with files on them which might contain stegoed data will be summarily executed? >The FCC and the Department of Justice would be required to >publish on their web sites "such information as is >necessary to inform the public of the meaning of the term >`material that is harmful to minors.'" Solveig Singleton, a >lawyer at the Cato Institute, says: "The Supreme Court >struggled for years to come up with a national defintion of >obscenity. They failed. Harmful to minors is >obscenity-lite. The FCC and Department of Justice won't >have any luck coming up with a definition of >obscenity-lite." >Not a problem, predicts former porn-prosecutor Bruce >Taylor, now the head of the National Law Center for >Children and Families. "This bill will ensure that the >hardcore pornographers don't get off the hook," he says. "This bill will ensure that our freedoms are further eroded." >Next step for Coats is to attract co-sponsors and to forward >his bill to the Senate Commerce committee. Some judges >criticized Congress for holding no hearings on the original >CDA; Coats isn't going to make that mistake again. "There >will be a concerted effort to build a substantial >legislative history," says David Crane. >This bill won't be the end of Congressional interest in >cyberporn. "You'll probably see other legislation come >forward. Introducing this is not abandoning our other >concerns," Crane says. >-Declan My fellow Cypherpunks, what we have here is best explained by an analogy like this: The government decides that the youth of America is corrupting themselves and harming their health by drinking soft drinks. The Congress introduces legislation to outlaw softdrinks. Everyone except the National Law Center for Fruit and Vegetables and some other far flung totalitarians think that this legislation is rediculous and an unreasonable restriction of rights. It passes anyway. It goes to the Supreme Court and the Court shoots it down. Two years later Congress again tries to outlaw soft drinks. Since outlawing of soft drinks en masse was not allowed by the Supreme Court, they just outlaw Coke. This passes. People start drinking Mountain Dew and JOLT instead. The Justice Department brings charges against these drinkers, the people who manufactured it, the people who sold it to them, and the truck drivers who shipped it. It goes to court and the defendants claim that the law wasn't broken. The State says that the law was indeed broken because "everybody refers to soft drinks as Coke." This, of course, begs the question of why, if "Coke" is a synonym for "soft drinks" they passed a law after the Supreme Court clearly stated that they couldn't do such. If "Coke" is not a synonym for "soft drink" then they have no charge against these people. Welcome to the Land of the Freeh.

1 0

Re: Jim Bell sentencing delayed
by Blanc 17 Dec '03

17 Dec '03

Greg Broiles wrote: >perhaps I'm just low on conspiracy juice this week, but I think that Kent's >suggestion that he's in the hospital is probably the best - his recent >letters/calls to Blanc mentioned a persistent staph infection. Ach! Greg, that was supposed to be a "secret", since Jim said he didn't want publicity over his case and I cheated by letting John post it on his web site. Although, it's not like most everyone suspected, hmh. But anyway, what do you mean by saying that John's books were returned to him? I sent a letter to Jim in the mail this past Saturday, encouraging him to call me again and update me on his situation and on the sentencing date. So I'll be waiting and will pass the info on to John. .. Blanc

1 0

Washington Times: "FCC wants to extend V chip to computers"
by Declan McCullagh 17 Dec '03

17 Dec '03

Front page: "Not content to monitor the progrom on your television set, the FCC now wants to install a vchip in your personal computer -- a move that could extend the agency's reach into cyberspace... "Lawmakers said the vchip law was intended only for TV sets..." "Some question whether this will lead to FCC regulation of the Internet..." Dave Banisar, Rep. Tauzin, Ed Black make appearances. -Declan

2 1

Re: Privacy Software
by Mix 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Adam Back wrote: >Monty Cantsin writes: >> The PGP source code is not the worst I've ever seen, but it's kind of >> odd. > >I had a go at doing something with it (I'll let you know when I get >it to work) -- I had the damnest job figuring out what was going on. >The problem I found with understanding it were all of the nested >functions called through vectors of functions and handler functions. >Makes it hard to inspect what will happen without running the code >under a debugger -- lots control flow is decided at run time. So in other words, even though we have the source code we don't really have confidence that we can tell what it is doing. Even though the source code is available, I don't think it has been studied all that carefully. For example, hardly anybody knew that the PGP 5.0 source had CAK features lurking in it. Or, remember that bug with the random number generator? As I recall (i.e., feel free to correct me), it was in Colin Plumb's code and he found it himself. This would imply that it got by whoever went over the code when it was released. Not reassuring. C is a big part of the problem. Also, PGP was originally designed to operate on some fairly slow machines and they tried very hard to optimize the hell out of it. Now, however, cycles are a lot cheaper. I think we should give up speed for clarity. Slow code that we can really trust is better. And, the PGP code does a bunch of careful things which complicate it like burning the stack all the time. In my judgement, this is misplaced. If you don't trust the platform you are using you can't fix it in your encryption code. >> We should consider a rewrite, which gives us the added benefit that >> it will be completely unencumbered. > >Sounds maybe worth doing. It's at least worth talking about. Hashing out the design is a good exercise and it can inspire other people when they are designing their own crypto systems. >> It also gives us the opportunity to write it in a language other than >> C, one which truly supports encapsulation. C code is hard to verify >> with great confidence because it is possible to obfuscate it and >> introduce security holes. This means that C requires one to trust the >> authors to a greater extent than is desirable. > >Some C programmers do have fun writing obfuscated chicken scratchings, >but you _can_ write C code optimised for readability. What's really bad is that any part of the code can betray the rest. Let's say you had somebody who was really very good who wanted to weaken things. All he or she has to do is have a little obfuscated code someplace that undermines the majority of nicely designed and implemented C code. A truly encapsulated language is a lot easier to verify because if none of the magic functions exist in the code (easy to check), you can be confident that when you have verified one piece of code that the other pieces can't interfere. >What language did you have in mind? modula-3? iso-pascal/borland >pascal? Hadn't thought of Modula-3, but that is an excellent idea. Java would be a candidate, although performance is an issue. There's been some good buzz around about Ada. It might perform well and it's here to stay. Is Modula-3 being used in any serious way by anybody? If it is, let's consider it. (I think there is a Modula-3 -> C compiler out there someplace, which means it's totally portable.) A good language choice would probably save a lot of time. >> The whole issue of compatibility is an interesting one. Would it be a >> good idea to have a cryptographic system which was completely >> incompatible with PGP, given the Big Brother risk? > >Theoretically perhaps, however I'm not sure a system will get very far >unless it can automatically interoperate with pgp2.x and 5.x. It would be nice to just shed the PGP baggage for the moment and think about how we would do a system from scratch for our own uses. Ultimately, this system could reside in an application which also speaks PGP. Or, it could just be its own thing. >You could build something which did the right thing automatically >based on public key types: > >hypothetical cpunks mail system (HCMS) We should use the acronym CMR. (Cypherpunk Message Remodel? Suggestions invited.) >HCMS -> pgp2.x use RSA/MD5/IDEA and pgp2.x message formats >HCMS -> pgp5.x use DSA/EG/3DES/SHA1 and pgp5.x message formats >HCMS -> HCMS use whatever goodies you want, stego, mixmaster, etc. CMR nee HCMS should be an independent system. The mail system you are using should decide whether to use it or some other system depending on the correspondent. While it may seem crazy to toss compatibility, it has some advantages. For instance, the only people who will use it are the hardcore types. I like the idea of an exclusive crypto system that only cool people who are fairly with it use. What do you think about mandating a key size? I like the idea that use of the protocol communicates "I am very serious about my privacy." It's also slightly cripple resistant. (And, were I to consider mass market concerns which I am not, I would say that it makes it easier for the user to make the right choice.) How about finding a way to eliminate indicators? It's nice not to leak any information at all. It also makes super-encryption stronger. If each encrypted layer looks like noise, the total key size is the sum of the bits of each layer. One way to eliminate indicators is through the prior agreement of the meaning of random bits. In effect, you can say "when you see 0x234B4D234F, it means, outside layer RSA/IDEA, middle layer 3DES/SHA1, and inner layer the Captain Crunch decoder ring." This information can be exchanged at the time of key authentication, securely, by telling your correspondent how you are encrypting everything. Later, you can send more random bits when the tank starts getting low. Super-encryption is something we should do more of. Let's say we believe, conservatively, that any particular cipher we are using has a 10% chance of falling in a particular year. In ten years, that's a 35% chance of compromise. But if three different ciphers are used, there is only a 4% chance that it will fall in a decade. Super-encryption has been unpopular because it takes too long. However, if you are using a modern OS, even if it takes five minutes running in the background it's just not a big deal. It doesn't seem unreasonable to me to break out authentication from the communication protocol. Strictly speaking they are not the same thing. Both programs can be called by the same message composition program. This naturally leads to using separate communications and authentication keys. I am not fond of PGP's signature design. The "BEGIN PGP SIGNATURE" stuff clutters things up. How about a one line signature with a previous character count? Note that this wraps beautifully without modifying the message itself. It's unobtrusive. ASCII armor also sets off alarms with me, but I'm not sure exactly how to solve this problem. It seems right to define protocols in terms of full 8 bit bytes. Perhaps just uuencoding encrypted messages is the way to go? For authentication, it would probably be okay to define an ASCII mode. I think key management is good to think of as a separate application. The right way to do this isn't clear, yet. The Web of Trust is a neat idea, but I think the concept is flawed because you are unlikely to tell something sensitive to somebody you wouldn't (or couldn't) authenticate yourself. Ultimately it relies on things like driver's licenses issued by Big Brother, which is terrible. >> Something I've never liked about PGP is their approach to encrypting >> to multiple keys. For one thing, the PGP crowd seems overly >> conservative with bit expenditure, which is silly because bits are >> cheap. This means that creating entirely separate messages is >> completely economical. > >This is more secure I agree. The real kicker with this problem is >people who turn on encrypt to self -- I don't want messages with >encrypt to self (an extra door into the message) on them in my >mailbox, nor coming over the wire headed to me. > >You can see the reason for multiple recipient though -- it's too ease >integration into mailers -- you can process the message and give it >back to the mailer, and then it can still send the message To: x, y; >Cc: z. But this is just bad design if you care about security in a serious way. Even assuming you have to reveal who you are sending the message to, why reveal that three messages are related to each other? This is yet another mass market issue. If we were to do it the right way, all the mail header fields would be contained inside the encryption envelope. >Doing away with multiple crypto recipient risk is more an issue of MUA >integration than rabid conservation of bits. I'll buy that. >> So, perhaps a protocol which does not support anything more than one >> encryption key per message would be a good idea. > >You don't have to use it. I tend not to. I never use encrypt to >self, and I get annoyed with people who send me messages encrypt to >themselves, and very rarely do I use Cc on encrypted messages. If the protocol doesn't accept multiple keys for a message it is slightly CAK/GAK resistent. And, it's a nice statement of intent. It's also nice to have tools which help you to behave securely without carefully thinking about it when you are using them. >> And, I wonder if compression doesn't actually weaken security? Let's >> say I forward a known message with some commentary. Since the >> compression tables will be known, it seems like the increased size of >> the message could provide some interesting information about the >> preceding commentary. All by itself, this probably doesn't matter, >> but combined with other information it might result in a breach. In >> any event, that which is ambiguous should be eliminated. > >I don't understand this comment. Let's say it is known with high probability that I am forwarding a particular message with some unknown prefacing comments. It seems to me that (possibly) some information is be revealed by the size of the compressed encrypted text. That is, the known message will compress to a different size depending on your prefacing comments. For example, if I use lots of words that are in the known message, it will compress very well. The result will be significantly smaller than if I use words that never appear in the known message. This might not be a problem, but I don't like "mights". Also, I like things which are really orthogonal. There's no particular reason for the compression to be part of an encryption program, if you use it at all. >One thing that some people don't realise is that the plaintext gets >mixed into the random pool as an additional source of entropy. In >automated environments (lots of MUAs which set +batchmode), this is >all the entropy you'll get -- except for the original key presses to >generate the key, and a small bit of entropy from the system clock. > >It's fairly good normally because the way entropy is mixed in is a one >way function of the randseed.bin based on IDEA. To make use of this >an attacker would need a copy of your randseed.bin before you sent the >target message, and to have suspicions of what the message is. Even >after a few known messages it would still likely be possible to >attack, because the entropy added by the clock is partly predictable >from the message headers Date: field, and because it isn't that much >entropy each time. The randseed.bin file has always bothered me. What we really want is some good sources of entropy in which we have tremendous confidence. Also, if you signed the message the Date: field won't be needed. This is bad design, in my opinion. A signature and a time stamp are two different things. For instance, I would prefer not to time stamp my messages as it reveals the state of my clock and the transit time of the messages I send. >> It would also be nice if the messages were padded to predetermined >> sizes, say 10K, 20K, 40K, etc. (Once compression is eliminated this >> is less of an issue.) > >It would be nice to have a system where you send 100k and receive 100k >per day regardless. Say in 10 10k packets which get poured into a >mixmaster node. Yes, this would be good. Although, I would think of this as being on a higher level than the encryption program itself. Probably we want an entire communications management program which tracks everything you've sent and analyzes your activity for weaknesses. >> How about a one time pad mode? One time pads are more practical than >> widely believed. Many things we talk about we *do* want to keep quiet >> for the rest of our natural lives. > >Right. > >The problem with this is that you need random numbers. How do you >generate them? You only need to generate keys once in awhile. This means that you can go to some trouble when doing it. For instance, you might have some hardware which is not routinely connected to your machine. >If you use PGP's random pool, one suspects that if IDEA becomes >attackable at some point in the future the random pool will start to >look more like a predictable PRNG to the attacker. > >I wonder how good linux's /dev/urandom would be if MD5 becomes even >more suspect. Well, neither of these would be good for a one time pad, of course. It would be neat to have, say, three sources of hardware randomness and then XOR the result with the above pseudo random output. It's hard to recognize non-randomness, so some overkill is good practice. BTW, it would be nice if PGP or CMR/HCMS would let you supply bits of entropy by hand. It takes awhile to generate 128 bits by hand, but for some things it would be worth it. >> It's clear that going the corporate route has to be handled with some >> care. Given the political implications, investors have certain risks. >> >> Also, many people seem to switch into a different mode as soon as they >> have a company. Anything which they perceive as increasing their >> profits becomes good. PGP, Inc. has gone this way, we've seen First >> Virtual do some unsavory things, > >What did FV do? I know they don't use encryption, and Nathaniel >Borenstein wrote a few hype-hype articles about the _gasp_ newly >discovered security danger of "key board sniffers". The hype article was what I had in mind. I doubt very much that Borenstein would ever have been involved with such a thing outside a corporation. It seems to have a bad effect on some people. The problem is, you don't always know where that bad effect stops once you've noticed it. >> and even good old C2 has made a few people uncomfortable. > >Only thing slightly negative C2 did was to make a dubious decision in >handling of Mr Nemesis's fabricated claims about stronghold flaws. >C2 still rocks, though right? Comme ci, comme ca. The libel suit business was uncool. Also, there was a press release relating to one of the cracks which was somewhat misleading, I thought. C2 has shown some symptoms of institutional paranoia, which is bad. Sameer's comments along the lines of "this isn't some cypherpunk hobby" are also not reassuring. All of these things arise from being in a corporation. The problem is that I'm not tapping their phones. I don't really know what they are thinking or doing. When something happens that is troubling, it's hard to restore trust. I don't give C2 five stars. That said, C2 has done some very good things. People seem to like Stronghold a lot. It really is a secure product. They publish their source code. I do like what they have to say in many of their press releases and they are getting certain ideas into the mainstream. (The Forbes article, for instance.) Sameer's one line comment "sell code" had a lot of influence on me, too. >> It doesn't have to be this way, of course. Look at Comsec Partners. >> We don't see any "conversation recovery", lying press releases, or any >> other nonsense from them, just a beautiful product. > >Quite so. C2 hasn't got "web traffic recovery" either :-) No kidding. Yes, C2 is miles above PGP, Inc. in my book. But, Comsec gets the five stars. They have never done anything or said anything that gave me less than complete confidence. >> What I like about selling software is that you could actually make >> good living by doing the right thing. And, after all, if you've spent >> six months writing something, why shouldn't the users kick in a little >> money instead of freeloading? I would like to see more crypto users >> in the habit of paying for tools and in the habit starting security >> companies. > >New payment models will need to come in. How can you extract money >from a cryptoanarchist? Copyright? Patent? Hah, hah. The important thing is establishment of the custom. Most cryptoanarchists with class will pay. The way to do this is to make it clear from day one that it is not free software. If you want to run it, you should buy it. (The problem with share ware is that people get used to "borrowing" it.) This should work well. Cryptoanarchists, in my experience, have pretty high integrity. Some people will pirate, true, but that's life. Ironically, people who honestly discuss their skepticism of intellectual property laws are probably less likely to pirate. >If we get a real eternity service going (not the poor imitation perl >script up now where all traffic goes through a server unless you >install it locally) software copyright could become a thing of the >past :-) > >Trust might be one way to go, rely on good will. Or paying for >technical support. Or mixmaster, or DC net packet delivery postage >charges. These are good ideas. You know, it would be cool to define a software architecture for remailer software. Different remailers have different properties and different strategies. They may continue to differentiate. When you decided to trust a particular remailer, it could give you a module of code with a standard external interface which prepares messages for that particular remailer. Putting your idea another way, the code is "free" but the remailers cost money. Monty Cantsin Editor in Chief Smile Magazine http://www.neoism.org/squares/smile_index.html http://www.neoism.org/squares/cantsin_10.htm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBNF1+s5aWtjSmRH/5AQFvHQf+PFXqriw8FoMMcsflEf1Jo55Myl94Luj8 UxSQ9YCq6+dedih7j/FJ3RLL0LtCTa7Sn6E/kGmgqzwcAcfzcjavpl7joNdHU9Yo pS81mXeZ3kw34Nj1hbaX2j6Shx4+46uNUskfXThi6bz3lh1OM2hy7xF63blB2m1I MVt786tah76UfveYlWR/MXK+ZN2DwUvejiPX+bP7vNqaDsXRyrW5mX1vVUuKf6po 5PRZ5wSMKQF/ULm7tOb/g8otoj2w84iir8kckLJiiSs4Xm3hk6+QbDVIhz31aPD3 D2PXIDEXz+x+Vtr5xPIurvpfEo5GpgFdMv5Ox1y796yHr6jjJ8BJjQ== =rjFe -----END PGP SIGNATURE-----

5 6

Re: Forwarded mail...
by Anonymous 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Jim Choate wrote: >> Fortunately some of these "good" lawyers already exist at the Institute for >> Justice. Basically, they are a libertarian version of the ACLU. They've >> accomplished some good things and deserve the support (read $$$) of >> freedom-minded individuals everywhere. (note: I'm not connected with them >> in any way; just letting the cypherpunk community know about an organization >> in sync with our views) >> >> "If you seek a courtroom champion for individual liberty, free market >> solutions, and limited government, look only as far as the Institute >> for Justice. When politicians pass sweepingly intrusive laws and >> bureaucrats build their empires of paperwork and power, only the >> Institute for Justice brings them to account in court." >> -- http://www.InstituteforJustice.org/ > >Thanks, I'll check them out as I am unaware of their position. I should add that they haven't done anything in the field of cryptographic or technology issues, but have focused most of their efforts on protecting small entrepreneurs from overly zealous government agencies, particularly on the local level. One item I found of particular interest was a report they published in July 1996 about the restrictive barriers New York City has erected to prevent entrepreneurship (i.e., expensive/restrictive licensing fees, tough penalties for doing business without the required permits, etc.). An earlier post on this list referred to NYC as a cesspool of socialism. There is truth to this statement. Socialist politicians tend to punish those who help themselves, all for the public good of course. [snip] >> Bill Benson has done some extensive research (his book is called The Law >> That Never Was) regarding the 16th Amendment (the so-called Income Tax >> Amendment) and how it was ratified. According to the information he has >> uncovered through exhaustive research in D.C. and all of the state capitals >> of the then 48 states, the 16th Amendment was never ratified by 3/4ths of >> the states. (see http://www.trustclarks.com/theman.html for more info) >> >> Friends of mine have spoken to Mr. Benson about this, and he says that the >> courts won't touch it with a ten foot pole. He even sells a package (or at >> least he was selling it back in 1995) of legal information about the >> non-ratification of the 16th that can be used as a defense in an income tax >> case. According to Mr. Benson (in 1995), each of the cases was dropped when >> the defense made it clear they were going to argue their defense based on >> this point. >> >> I understand that folks in the "patriot" movement have tried to take this to >> the Supreme Court without success. The Court refused to hear it. >> >> Assuming Mr. Benson's research is accurate and legitimate, the 16th didn't >> even come close to being ratified and is truly a Law That Never Was. Think >> about that next April 15th...the IRS's "lawful" authority is based upon a >> legal fiction. That's why it's called >voluntary< compliance. > >Actualy, his research is one of the reasons that I am so interested in an >actual lawsuit. > >What if somebody were to go for several years with no contact at all with >the IRS, and no intention of making contact. Then when approached that >person makes enough noise to guarantee that they will be going to court. Funny you should mention this. A few folks have this very intention. :-) >What would it then take to bush-whack the beggars? What is the absolute last >point that your defence must be revealed prior to your presenting your case >to the jury? I'm not following the wording of this last question. Could you clarify? > The reason I use the first person is because to me it seems >critical that no lawyer is actualy used in the defence. As I understand it, >and I ain't no lawyer, there are some actions that a defendent may do if >representing themselves that lawyers are prohibited from doing. Among them >is stating the obvious fact, if the jurors don't believe the law is just >they may refuse to find for that reason. If the Constitution and the actual >record of votes in concert with the general feeling of excess regarding this >matter doesn't prove the case, what will? That's exactly the point. And that, I believe, is why the Supreme Court -- or any court for that matter -- will not go near this issue. It is the pivotal point that would collapse the whole house of cards that is the Income Tax. The feds have a huge vested interest in keeping the system going as long as they can (Y2K bugs and all) and this issue is a veritable hornets' nest. Nerthus p.s. For those of you keeping tabs on nyms, this is the last time I will include my public key in the body of my email. - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: PGP for Personal Privacy 5.0 mQENAzRc0lEDFQEIALF2JX7RgDLC6nnSa7BmcczGumTRxhXx5mHoqPcGY95VGAVD 49iN/+59BBrHKxOU5JX5F9kWEsBG92KbOdB3XGCsub7AYmCl+iMrG+h+vJl9qCyc 134sq7WNfInA9TxiQ28/DldHj++gDeQJr9BvUU8Ez2Iu70uW5T7rlHFyBUWQBh3P 2dB/Q9A/dixhAzNTaeTuVH4TunoyDN6OrRrSTdZhsPs8dLVLLeqKC3qM28wLX5Mt qQCUb/pRb9TR9ygwaznAIdqSJ1qc/xqlQY6U0Vh6YVOaId+MQwzsq1ZRPlW0kYSS wgka2WXELH5ZpQLmCppM1pdkHhm54VbBl7TmNwkABRG0I05lcnRodXMgPGN5cGhl cnB1bmtzQGN5YmVycGFzcy5uZXQ+iQEVAwUQNFzSUeFWwZe05jcJAQFxVQf/WUSH ltCrUpoQwQ9oTGCJiRycTQqUzDuqaqR55xgyz8W5mARixBigd/sL63EoBlQmyHR3 NIgwIW3I8hcPfUlXi84hsZ+89/HVW3CoMk2g6692UEoKHUX6bMkeAi85hIfJVhFj EONhx3xFmdOZqkEbdFm81J/0JJIhtAe0Ut2DPu4B49yjO7NBTg97QWwO6ZymE09v BUv5esuvdxFbmn8qfPHdurs+MrvoKbhZIA8Xz03eTS1auT8pNvdEO4EDaac0njZ4 5wAbAeC79AqztS75GpT7cf0jZcYJPwtW8LPXj7SQCMimseZ7/2OxNPditI9e58CI EL/Dl0D9qn1NRPiVwA== =8W8j - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: PGP for Personal Privacy 5.0 Charset: noconv iQEVAwUBNF0knuFWwZe05jcJAQH8WAf/e/BA8ysXWf1xrxJKiNPP8oyEDHpeFxZQ LWgW/kgfDmh1Y/Tfjw0i5nnnImlXfEcX5nmL8H+HezxBxKMN2O33PftHAPYghHrI y0hSgZVmA2VOMy4Dtv0umT19RarennPVHrGDyCi2zmNF9+5v6b81CYWLEBNMYx9V kaVOBCEt0FRdDFug1FwNRHJ+gHQjbFCVCMRF2v/0AF5r9uDPzNtCo3JP6tnllcqX jSf6MKa3Kxw17c+Je+TuLwHgltvULt3KZBrweJqslKKbY24Qw/PSPPHczvL8ieI1 uknK9KTVl6OJLvaGyI6bpFFgFoPxTpF+JJkzUR1GnlLN5gUwuQ6NKw== =osod -----END PGP SIGNATURE-----

1 0