- cypherpunks-legacy - lists.cpunks.org

SHAMELESS PLUG
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Mark Chen wrote the follow about the scienter thread: ... Howard Zinn makes the same point in _Declarations of Independence_.... he concludes that law is made not by legislators and judges, but by the policman's club. But less and less every day. As Duncan and I--the official "Pollyannas of Privacy"--have been telling you, technology is on our side. As it advances, technology continues to shift the balance of power from the State to the individual. For my vision of technology in the service of civil liberties, see my upcoming article, "Support Your Digital Police," in the "Idees Fortes" section of December's Wired. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

DB Technology
by L. Todd Masco 17 Dec '03

17 Dec '03

For a good example of DB/Expert system technology used for good instead of evil ("A power so great...") check out ringo(a)media.mit.edu, body of mail "join". You tell it your musical preferences and it suggests albums that others with a similar taste to yours liked. It'll also tell you what to avoid. I intend to honor its advice, to avoid Neil Diamond, Tiffany, and Barry Manilow. -- Todd

1 0

Re: HTTP authentication efforts
by ekr＠eit.COM 17 Dec '03

17 Dec '03

Paul writes: >Does anyone know, on the off-chance, who is currently working on >HTTP authentication processes for web browsing and Mosiac? >Pointers appreciated. Philip Hallam-Baker at CERN has done some work in this area. The general name for it appears to be Shen. I don't know what the status of it is. There is also the original PEM and PGP work done at NCSA by Rob McCool. I'm given to understand that MCC has done some work with Kerberos integration. (Microcomputer and Electronics Corp, or whatever). In addition, I believe that both Spry and Mosaic Communications Corp have announced that they have their own security solutions but haven't announced any technical details... And.....Shameless plug follows: Allan Schiffman and I here at EIT have developed an extension of HTTP called 'Secure HTTP' which provides for end-to-end security and authentication. (Mainly by recycling a lot of the preexisting work in cryptographic messaging, particularly PEM and PKCS7). The protocol is publicly specified and basically consists of wrapping the entire transaction inside privacy enhanced messages, using a variety of cryptographic message formats. It also includes support for systems in which only one party has a public key pair. [By exchanging an encrypted session key to be used for the return transaction]. Disclaimer: While there will be some free distribution of the software based on this protocol, and the protocol is completely nonproprietary (except, of course, that it uses public key) EIT (and I) have a financial interest in selling products based on this technology. You can get a copy of the current (though slightly outdated) version of the protocol via: WWW: http://www.commerce.net/information/standards/drafts/shttp.txt Email: shttp-info(a)commerce.net (Automatic response) Anonymous FTP: ftp.commerce.net/pub/standards/drafts/shttp.txt The next rev should support (though the released software probably won't for a while) Diffie-Hellman and Kerberos. -Ekr

1 0

Linux and PGP
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I'm starting to take Linux for a "test drive", and am looking for a couple pointers on using PGP. Some time ago, I saw a couple of vaguely-related messages regarding PGP; one of them was editing a header file (?) to compile properly under Linux, the other was a patch (command-line switch?) to increase the available number of bits for the second part of the key (increasing it from 5 [!!] bits). Could someone either email me the info, tell me where it's hiding, or (if necessary) tell me I'm full of fertilizer? Thanks.... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

THOSE DARNED HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Tim May writes with regard to anonymous contract killers: ... And the risk of losing the digital cash can be made vanishingly small by use of anonymous escrow services, which act solely as holders of the digital cash.... I don't buy it. Anonymous digital assassins, murder escrows and all that work fine in an artificial, abstract, game-theory world. I doubt we'll see much--if any--of it in the Real World. Why? Because the market is too richly textured not to come up with its own cultural, ethical and digital fixes. Would you do business with a escrow that was the bag man for contract murders? I wouldn't, you wouldn't and the vast majority of people in the world wouldn't. That wouldn't stop some escrows from performing that service, but it would run up the cost. When the costs rise high enough, profitable opportunities are created for false escrows to enter the business. That's just one problem that can interfere with such an odious endeavor; there are more. I think the best way to illustrate that the anonymous murder business is nothing more than a bugaboo, is to set the best minds on the planet--Cypherpunks--to work on the problem. Let's all put our thinking caps on, and come up with answers to the follow hypothetical situation: Let us assume a world with totally anonymous communications and payments (strong crypto, remailers, digital cash, etc.). 1) How would YOU scam money from the system without actually knocking anyone off? Or in the alternative, 2) How would YOU use technology to address the problem from police/private investigator perspective? I'm betting that with no more than a few moments of thought, Cypherpunks will come up with a ton of hacks. To get the ball rolling, here are two from me: SCENARIO ONE I set up a meat-and-potatoes escrow business. I keep my nose clean. I honor my obligations. I build up a good reputation. At some point, I'll be approached by a murderer and the person who is hiring him or her. I'll accept the payment. When the murder is committed, I won't pay off. The murderer will (a) sue me (I don't think so), (b) damage my reputation (I'll leave this one as an exercise for the student), or (c) murder *me* (ah, but first he has to find me; in the world we posit, that won't be very easy). If this scenario happens very often, it'll take all the profit out of the murder business. Of course, the murderer can get the money face-to-face from the customer, but then we're back to today's square one. SCENARIO TWO I set up a phoney murder-for-hire business. Someone contracts with me to bump-off their rich uncle. The client deposits my payment with a reputable escrow company, "Murder Escrows R Us." I go to the uncle and tell him the whole deal. Using digital technology, bribed coroners, etc., we fake his death. When the news hits the Net, the escrow pays me off. The uncle comes back to life, disinherits whomever he suspects wanted him dead. And I laugh all the way to the digital bank. I create a new pseudonym, place another murder-for-hire ad, and do it all again. Given our Brave New World, nobody can touch me. Okay C'punks, it's your turn. How would you subvert Tim May's vision of anonymous murder-for-hire for fun and profit? (Feel free to take potshots at my two scenarios as well. Cypherpunk cleverness cuts both ways, I'm sure.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Reserved DC-Net IP addresses - NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes): > Speaking of long-term integration on the internet, might it not be a > good idea to get some IP address range assigned for dc-net use? I don't agree. Apart from the IP address crunch that already poses a problem for the IETF, I don't see why DC-Nets should be limited to specially allocated addresses. DC-Nets should be implemented a layer over protocols such as IP, or as extensions to them. It should be possible for _anyone_, regardless of IP address (officially allocated DC-Net number) to connect with _any_ others on a DCN, with some software or other interfacing. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2

Re: Laws Outside the U.S.
by Carl Ellison 17 Dec '03

17 Dec '03

>From: usura(a)vox.xs4all.nl (Alex de Joode) >Date: Tue, 20 Sep 94 22:24:56 +0200 >There are basicly four scenario's that a state can follow to >regulate crypto: > - outlaw it totally > - key depositing > - try to develop a standart > - do nothing >The most prosperous scenario. Crypto use will boom, but >lawenforcement agencies will be deprived from a useful >tool, they can't bug phones any more. I think this is wishful thinking on our parts. Crypto would have to be built-in and automatic (not even a button push required to activate it) before I think you'd see much of a user community. Even then, some people might encounter key exchange problems and beg for a button to *disable* crypto. Until you see a substantial percentage of the population using crypto, I don't think law enforcement will have any problem. They'll worry about drug dealers as a new potential threat, but have them read Kahn about Rum Runners (in a chapter with that in the title). -------------- To me, it's obvious that this isn't a real LE problem. That leaves open the question of why the US and others want to limit crypto. I think part of the answer comes from the USACM report, in the second paragraph of chapter 4. "The development of telecommunications in the 19th century, first via cable and later by radio, presented a challenge to national security so severe as to challenge the very notion of national sovereignty. Nations could still regulate the flow of people and products across their borders, but in a process that continues unabated, news, ideas, and information began to travel in channels far harder to control." This sounds like either a Cypherpunk or Clint Brooks wrote it. I'd guess the latter but I think they'd both be wrong. Since when have nations seen their people as imprisoned? We limit the speech of prisoners, but of citizens? When did nations ever care about limiting the speech of citizens, before the middle of this century (with the advent of OSS/CIA thinking)? Was travel prohibited? Were private conversations with foreigners prohibited? -------------- So -- the argument is bogus. Why advance it? My answer: because the Agency advancing it (with cypherpunks as unwitting accomplices) wants to create the perception of a threat of loss of power in those who have power (Congress, President) so that they'll give state-of-emergency powers to the appropriate Agency to fight back. Net result: no real threat; real increase in power for one Agency. +----------------------------------------------------------------------------+ |Carl M. Ellison Phone: (301) 854-6889 | |Trusted Information Systems, Inc. FAX: (301) 854-5363 | |3060 Washington Road | |Glenwood MD 21738 E-mail: cme(a)tis.com | | | |RIPEM MD5OfPublicKey: 39 D9 86 06 86 A9 F0 75 A9 A8 3D 49 58 9C 67 7A| |PGP 2.6.1 Key fingerprints: E0 41 4C 79 B5 AF 36 75 02 17 BC 1A 57 38 64 78| | 61 E2 DE 7F CB 9D 79 84 E9 C8 04 8B A6 32 21 A2| +----------------------------------------------------------------------------+

2 1

Re: MAIL: crime and remailers
by Lile Elam 17 Dec '03

17 Dec '03

>From blancw(a)microsoft.com Wed Sep 21 16:28:31 1994 > Well, you know, there was that threat from the NSA guy to run him over . . . > wonder if the offer still stands. >Would that make you feel better? > >:>) >Blanc Yes! I would feel like the air was cleaner and the skies bluer. :)

1 0

Re: HIT MEN
by merriman＠metronet.com 17 Dec '03

17 Dec '03

>~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > >C'punks, > >Okay, back to basics. David Merriman wrote: > > But if the system is set up for total anonymity, _who > would know_ that an escrow agent was the "bag man"? Just > like no one would know who the contractee was, or the > contractor: > >The escrow agent is a publicly known entity. That's how it gets >a reputation. How do you imagine an escrow agent could get a >reputation for being a murder's bag man if it didn't advertise >as such. If the escrow agent has a reputation for reliability, honesty, integrity, etc, then the nature of the transaction is irrelevant. Any reasonably intelligent hit man would have sense enough not to commit all his 'business' to any single escrow agent, just as no reasonably intelligent C'punk would trust all his/her mail to a single remailer. I still don't see the problem: the whole process is anonymized. There is no reason that the escrow agent would have to know *why* the "money" is in escrow, nor who the financer is, nor who the recipient is to be. All that is necessary is for the hit man to provide suitably disguised/encrypted evidence that the terms have been met. Presumably, the person contracting the hit would be aware of how to go about setting all this up would have sufficient wit to establish a means of independent validation; if not, then the hit man would certainly have sufficient motive to do so :-) > If it advertises as such, I believe most people would >refuse to do any business with it. If it doesn't advertise, how >will it get those sorts of clients? The only *fundamental* feature of an escrow agency is it's reputation for reliability/stability/security/etc. The nature of the transactions simply don't matter, just as a remailer's reliability is based on it's up-time, cycle time, input/ouput isolation, etc, regardless of the nature of the messages passing through it. What sorts of clients? The ones that pay the escrow fee? Doubtless, the escrow agency would have a means of ensuring their own payment :-) > There is no reputational >incentive to perform the loathsome service, and plenty of >incentive to (a) just keep the money, or (b) blow the whistle to >the cops and the intended victim (and keep the money). Please >note, this was all intuitively obvious from my previous post. True enough - *but only as long as the nature of the service could be identified*, which would not apply to a properly operated escrow agency. Dave (adjusting Nomex undies under asbestos coveralls) Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: Tedious Chomsky arguments, some small remailer relevance.
by chen＠intuit.com 17 Dec '03

17 Dec '03

In response to James Donald: The Hayek quote is correct, and an example of what Reinholdt Niebuhr called "manufacturing consent" (where have I heard this?). I am not going to get into your Chomsky argument, except to say that your excerpt explicitly contradicts your conclusions: > "The Chomsky reader" Pantheon books, 1987, p.201, quotes > a paper written by Chomsky in 1975: > > "When the *New York Times* editors and U. N. Ambassador > Moynihan castigate Idi Amin of Uganda as a "racist > murderer," perhaps correctly, there is a surge of public > pride throughout the country; and they are lauded for their > courage and honesty. No one would be so vulgar as to > observe that the editors and the ambassador, in the not > very distant past, have supported racist murder on a scale > that exceeds Amin's wildest fantasies. The general failure > to be appalled by their hypocritical pronouncements > reflects, in the first place, the extremely powerful > ideological controls that prevent us from coming to terms > with our acts and their significance and, in the second > place, the nation's profound commitment to racist > principle." For which you graciously provide a vigorous, trenchant "analysis": > 1. Whatever Idi Amin is, he is morally much better than > Moynihan and the NY Times editors. There is no mention anywhere of moral superiority. There is a statement of the demonstrable fact that "the editors and the ambassador, in the not very distant past, have supported racist murder on a scale that exceeds Amin's wildest fantasies," referring, perhaps, to the (then) recent Indonesian slaughter in East Timor, or to the secret genocide in Cambodia (the one that happened *before* Pol Pot), or to any number of other U.S.-_Times_-backed atrocities. > 2. Only a country steeped in racist principle will fail to be > appalled when hearing Idi Amin called a racist murderer, even > when he is. This is simply nowhere to be found. "The general failure to be appalled by their hypocritical pronouncements" clearly has nothing whatever to do with Idi Amin. I know that it's difficult for you to conceive, James, but life is not always a football game. Hating the Rams doesn't imply loving the Packers. > ** 3. Only powerful ideological controls can prevent the > public from being outraged when someone truthfully calls a > black man a racist murderer. This is the same as your #2, and again, it is neither said nor implied. I would suggest that you read the passage again, but I don't think it will help. You're evidently quite intent on tilting at Chomsky as some sort of symbol of all that is threatening to your special brand of proto-Malthusian machismo. And it's really an extraordinary conceit to suppose that anyone else cares. You say elsewhere: > This coming thread will actually have some very slight > relevance to remailers, (gasp) in that I point out that the > same reasoning that enables Chomsky to define the > government to be the people, and individuals to be the evil > Capitalist Conspiracy, can be used in the same way; to > conclude that the eradication of Remailers and eradication > of the sort of thoughts that remailers are often used to > communicate, and the eradication of the kind of people that > are on the cypherpunks mailing list, represents a triumph > for liberty and civil rights, a triumph that would prove > how far civil liberties have advanced from the bad old > days. Before doing the service of "pointing out" all of these grandiose things to us, perhaps you should work on your reading comprehension. Your original claim was: > Of course Noam Chomsky is optimistic - he favors limitless and > absolute state power and the forcible and violent silencing of all > those who deviate from political correctness. The "analysis" which you present, apart from being factually wrong in every imaginable way, does not move one inch toward supporting this. If the only purpose of your claim was to serve as a platform for launching vapid diatribes, then knock yourself out. Otherwise, we would all appreciate it if you'd stick to the point. This is the last I will say on the subject, unless the thread assumes the shape of something vaguely relevant. -- Mark Chen chen(a)netcom.com 415/329-6913 finger for PGP public key D4 99 54 2A 98 B1 48 0C CF 95 A5 B0 6E E0 1E 1D

1 0