- cypherpunks-legacy - lists.cpunks.org

Re: Apple people on the list
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 16:15 8/6/96, John Young wrote: >What would you offer to set off Tim's simmering crypto-anarcho-volcano, >make it heard round the planet? Bottle o' Scotch (my private stash). Free Ecash account. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re[2]: SSNs (was Re: Internal Passports)
by Steve Coltrin 17 Dec '03

17 Dec '03

Simon Spero <ses(a)tipper.oit.unc.edu> wrote: >one silly thought: lots of people use cypherpunks as the username and >password for all those websites that want an id. What about a cypherpunks >3-2-4 number for those cases where an SSN isn't appropriate. Anyone know >what J. Edgar Hoover's SSN was? According to one of "George Hayduke"'s books, Richard Nixon's was 567-68-0515. -spc

1 0

Talking about Crypto Anarchy
by tcmay＠got.net 17 Dec '03

17 Dec '03

I'm going to use John's comments as a jumping off point for some things I probably should have said a while ago. At 11:15 PM 8/6/96, John Young wrote: >I'd like to hear Tim, too, in this Big Apple. RealAudio, perhaps. > >Tim's views are far more substantial and worthwhile than those play-it-safe >Pro-Code dronings. > >And his pith should go out far and wide, around the world, not only out >there on its edge. > >Vinnie, Robert, All Appledom, do your global duty, don't miss this chance >to leapfrog the small-beans promoters of the crypto industry. > >What would you offer to set off Tim's simmering crypto-anarcho-volcano, >make it heard round the planet? As I think I made clear, there is little either Vinnie or Bob have "failed" to do. I'll explain this below. It is true that I am not much of a fan of Bob's writing style, with nuggets of truth buried in bloviations about sacks of grenades, rubber rafts, shaking trees, pieces of the true cross, ad nauseum, but, then, "style" is something I tend to react to perhaps more than most. (Not the variations in style of the hundreds of folks who post here, but the florid excesses so common in "neo-journalism," where it seems the writers are paid by the word--as perhaps they are--and wrap their few nuggets in stock phrases and cutesy pastiches of Chandler, Wolfe, Gibson, Joyce, and the whole Sick Crew. Back to important issues. Let me summarize: 1. A while back there was an announcement (I thought by Vinnie, but he denied it to me) of a "Mac Crypto" mailing list. This announcement, which I no longer have (not in my own archives, and not in the few CP archives that seem to still be reachable on the Web) mentioned that the list would focus on "real" cryptography, and _not_ on political issues (including, presumably, the main topics that have motivated my contributions for the past several years, and longer). Fair enough, as the owner/maintainer of a list is free to set his policies. I of course did not join this list, as I don't think a list which only discussed quadratic residues and elliptic curve methods is exactly my cup of tea...there are plenty of textbooks and other lists for this. 2. So, when Vinnie sent me his "Mac Crypto Needs You!" mini-rant, my natural conservatism toward such things kicked in. I am not, as must be clear now, one of those "Rah rah rah! We need to evangelize crypto!" folks. I take a neo-Calvinist position on such things. Hustling memes is distasteful to me. (Some will say my posts here are an attempt to sell my ideas. Fair enough, but this is a forum I find acceptable.) 3. I told Vinnie I was not interested, that giving a "pep talk" to Mac developers is not my thing, and that if my views on politics, crypto anarchy, the undermining of governments, money-laundering as a tool of liberation, etc., were not deemed acceptable for his list, then I would not feel welcome at Apple Computer talking about the same. (In his reply, he said he'd never said any such thing about politics not being welcome on Mac Crypto....I could have sworn I saw such a thing, but, like I said, I can't find this message anywhere I've looked.) 4. Blah blah blah. That is, you saw my longer article I sent to Vinnie, explaining why I was not too interested. I won't repeat the points here. 5. I thought the subject was closed, as Vinnie then said that perhaps I was _not_ the right person after all. I agree with this. I am not an "evangelist," at least not one in the mold of the ever-bubbly Guy Kawasaki. Nor am I in the mold of a Robert Hettinga. Maybe I'm more like H.L. Mencken, or, at least I'd like to be. Evangelists disgust me. I can't read anything Kawasaki gibbers about, nor can I read the neo-journalism of "Spencer Katt," "Mac the Knife," or "Robert X. Cringely." (If you don't recognize these names, these are the terminally-hip gossip columnists and "rumormongers" of the three leading trade rags. The style is pretty similar to that used by Brock Meeks, Robert Hettinga, and the like.) Now on the the Big Issue. 6. I've given up on discussing crypto anarchy in short talks because nearly nobody in the audiences I've done it for has the foggiest notions of what I'm talking about, and I've found no short, sweet, simple methods of getting across the implications. Many audiences have no idea of how public key encryption even works, let alone how digital money might work. (Thus, panel discussions on "cryptography" bog down almost immmediately on basic issues. There's no way to get to the "juicy" stuff when 20 minutes is spent trying to educate an audience about what a prime number is!) Consider how long it takes a new subscriber on this list, one who presumably heard about this list from a background of some familiarity with the idea of encryption, to get to the point of understanding what the terms and phrases in my sig mean. I'd say it takes at least several weeks, with detours into Schneier to read up on the basics, and some mental effort to think through how anonymous remailers work, what digital money might mean for tax collection, etc. Even at the Hacker's Conference, which I last attended in 1993, the discussions of cryptography were deeply unsatisfying to me. My panel, on crypto, bogged down in trying to get across to a technically pretty competent audience the implications of strong crypto. Clearly, the hour or so we had was not enough, and people could only get the barest glimpses. 7. In several radio talk shows I have done, the same is true. Given that there just isn't enough time for a careful explication of the necessary background, the discussion and the questions from callers to the show stay at the most basic level. While I am not dismissing the importance of basic questions, it's clear that the discussion can never move on. Thus, discussions tend to never get beyond the "think of crypto as envelopes...would you want your messages all on postcards?" level. (This envelope-postcard analogy is of course due to Phil Z., and he seems more comfortable than I in giving this kind of talk over and over again.) 8. Even articles in "Liberty" and "Reason" magazines (plus more obscure magazines like "Extropy") have to spend most of the article explaining the basics, ending with a glimpse into a few topics of more recent vintage. Mostly, it is hopeless to get into "crypto anarchy," when the article is about how public key encryption works. (Note: This observation is part of a larger issue about the difficulties of building on past work. It is why so many fractious debates never get beyond the opening salvos...over and over again. The debate over nuclear power (or gun rights, or...) comes to mind, and I have, as with crypto anarchy, given up on trying to "convince" groups of the truth of my views: nearly everyone I talk to is so ignorant of the basics of radiation, containment, half lives, ionizing radiation damage, alternatives, etc., that all discussions bog down at the most basic of levels. When I used to have the energy--and the foolishness--to bend someone's ear about nuclear power for a couple of hours, I could _sometimes_ see the glimmerings of a change in positions, the flicker of a change in preconceived notions. Mostly there was only blankness and hostility. I get the same reaction when I try to explain the techno-libertarian implications of strong cryptography.) 9. So, while John Young and others might want like that my "pith should go out far and wide, around the world, not only out there on its edge," the plain fact is that it can't go out in a talk lasting only a few hours, or, much more likely, lasting less than an hour. Certain after dinner speakers are adept at getting one or maybe two simple points across in a talk--usually with some judicious humor to drive the point home--but I am not one of them. Maybe one of you is, but not me. In any case, getting "one or two ideas across" is not of much interest to me. (I've also seen David Chaum struggle to just get the basic idea of "credentials without identity" across to a tecnical audience...even when he concentrates on only getting a single facet of his ideas across, the light bulbs just don't go off in the heads of the audience members...at least this was what I witnessed.) I know there are some lawyers and law professors on this list, so the analogy to law might be useful. To wit, can a lawyer or professor be expected to really explain to a lay audience some complicated subject? Or is a series of ground-laying lectures needed first? While there are presumably lawyers willing to give pleasant after-dinner speeches on, say, "tort reform," I suspect that very little information is conveyed to lay audiences. (And, as I've said, I am not a talented dinner speaker.) 10. Finally, I am not a "motivational coach." I don't give pep talks to people at companies to help them save their companies, or their platforms. Thus, I am not interested in giving a "go out and win one for the Gipper!" pep talk at Apple. I hope this makes things clearer. And bear in mind that I actually _did_ spend a vast amount of my time putting together a compendium of my thoughts and ideas in my "Cyphernomicon." [ URL: http://www.oberlin.edu/~brchkind/cyphernomicon/ ] At more than a megabyte, and with various chapters on crypto anarchy, anonymous markets, remailers, and all sorts of implications, it is the fullest embodiment of my thinking extant in any one place. Some say it would make for a start on a book, but I can't see any publishers rushing to publish such a book (one publisher asked me to "submit a proposal" for a book on how to use PGP...this is the level of what publishers want from me...needless to say, I discarded his business card immediately). And so it goes. I'm not interested in giving a pep talk to Apple or its developers, I outlined my reasons in other messages. And I don't believe there's any way to adequately explain the collection of ideas I call "crypto anarchy" in much less than a lecture series. Even if someone were to sponsor or arrange such a lecture series, as has been done for things like nanotechnology, I'd have to think long and hard about committing to this. My inclination is to tell those who ask for such a talk or lecture series to "RTFM." Regards, --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

NSA Elint Memoir
by John Young 17 Dec '03

17 Dec '03

One of the earliest reports on NSA's global electronic interception program appeared in Ramparts magazine in 1972, which published a lengthy interview with a young former NSA analyst, "U.S. Electronic Espionage: A Memoir": http://jya.com/nsa-elint.htm (84K) James Bamford, Duncan Campbell, Nicky Hager and others have since confirmed what the analyst revealed then and greatly extended what was at the time doubted as a young man's anti-war exaggeration. NSA, according to Bamford, decided to not prosecute in the hope that no one would believe such astonishing claims of electronic violation of friends and foes. See The Puzzle Palace, p. 334 (paper editon). Bamford says Perry Fellwock was the name of the anonymous analyst, first called Winslow Peck, a pseudonym. Would anyone happen to know where Fellwock is these days? That's on the assumption that Fellwock is not a deeper pseudo than Peck. What knocked me over was Fellwock saying that the location of the NSA training school was at Goodfellow Air Force Base, San Angelo, Texas, from whence this counterspy originates. We were told the base was mothballed, kept pickled only for local pork. No doubt, NSA was never there, and "Fellwock" was just continuing to do his disinfo job via Ramparts.

1 0

Re: Censorship through proxy
by jim bell 17 Dec '03

17 Dec '03

At 06:12 PM 8/6/96 -0700, Timothy C. May wrote: >Sing Sing (the country is now a prison, so...) is one of the states we >should think about targetting for "special attention." Not in the sense of >violence, but in the sense of offering help to freedom fighters, those who >want to use stego, web proxies, etc. > >I wonder what would happen if "Computers, Freedom, and Privacy '98" was >held in Sing Sing? A friend of mine, who occasionally visits Singapore on business, told me this Singaporean joke: "Singapore is a fine place. There's a fine for this, and a fine for that,..." Jim Bell jimbell(a)pacifier.com

1 0

****Developer Recants Hostile Java Applet Story 08/06/96
by reagle＠rpcp.mit.edu 17 Dec '03

17 Dec '03

SAN FRANCISCO, CALIFORNIA, U.S.A., 1996 AUG 6 (NB) -- By Patrick McKenna. Finjan Software of Israel, which earlier said its Java security software detected what the company called a publicly available hostile Java applet at a game site on the World Wide Web, has issued a statement changing its earlier claims. In the first story on the Java applet labeled "hostile" by Finjan, Newsbytes reported early Tuesday that the Java applet in question is part of a game available on the Web and connected to America Online. Shmulik Suhami, spokesperson for Finjan, told Newsbytes at the time, "We were contacted by one of our users who detected a hostile Java applet and we have confirmed the user's experience." Newsbytes reported Sun Microsystems' JavaSoft division reply as saying, "This issue is totally and completely bogus. Security features built into Java do not allow an applet to read or write to another computer without issuing a warning message and this applet in question is not a hostile Java applet. An individual at AT&T, acting independently of the company, developed the applet. We suspect a file for the applet was placed on a second system and that is probably why Finjan's software incorrectly read it as a hostile application. Actually, this is a flaw in Finjan's software. There is no bug or hostile application at all." In its early story, Newsbytes also quoted a JavaSoft spokesperson as saying, "What is going on is that the person's applet called an audio file from a second machine and Java's security features are so strong and restrictive that an exception is raised whenever a second machine is called. Finjan's software appears to have read the call to the second machine as a hostile bug." In recanting its initial claims, Finjan released the following statement: "We want to issue a clarification on the media alert we sent out yesterday describing a potentially suspicious Java applet. We were perhaps mistaken to describe the applet discovered as a 'hostile applet,' since we did not know if it did anything damaging to a person's system. The activity of applet described was harmless. We misunderstood the extent of the security exception based on information we received. Though in principal the way the app was created could constitute a risk, in practice this was a relatively harmless breech of security, which the Java Security Manager dealt with appropriately." (19960805/Press Contact: Mary Jo Wagner, Successful Marketing Strategists, tel 510-644-3837; E-mail Address: maryjo(a)successful.com; or Paul Karr, KVO, 415-961-1550)

1 0

Re: Internal Passports
by Bill Stewart 17 Dec '03

17 Dec '03

At 07:37 PM 8/5/96 -0700, you wrote: >Personally, I don't care. In fact, when employing gardeners and yard works >I prefer Mexicans. But the law says, these days, that I must verify the >legality of workers *if* they appear to be dark-skinned, Mexican, Latin, or >the like. I say "if" because there are no requirements in general for >white-skinned, Anglo workers....no work permits, no proofs of citizenship >(such a document is currently lacking in the American pantheon...I, a mixed >descendant of Mayflower colonist and Scandinavian immigrants, lack such >"proof"). If you're _employing_ Anglos, you're currently required to disrespect their honesty and demand proof that their papers are in order to fill out the I-9 form. There's a list of "one from column A or one from columns B and C" of acceptable papers, such as passports, birth certificates, driver's licenses, US Military ID, etc., which the government uses to determine whether they want to give you permission to hire them and give them permission to work. If you don't have these, you can join the Army, and they'll give you some papers. I hope you weren't Un-American enough to be born at home, though - without that government-issued birth certificate, the Army won't be able to verify your age. None of that is really proof of citizenship - after all, you could have renounced your US citizenship and become stateless or joined a foreign government. But President Buchanan's loyalty oath requirements should take care of that, as well as help with the problem of all these immigrant Brits and Irish and Canadians flooding our shores - I mean, look around you, they're everywhere. Y'all can't walk into a 7-11 these days without some clerk speaking funny-soundin' English at you. And the reason you can't legally just hire contractors and not have them count as employees has a lot to do with Senator Frank Lautenberg (D-NJ), who made a lot of money running ADP, a computer-services bodyshop, that wanted to preserve its advantages against more flexible competition. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> Defuse Authority!

6 6

announce: WEAK S/MIME support for netscape messenger
by Anonymous Sender 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hello all, here's a new weaken patch, this time for netscape's mail client with S/MIME support. when you send an encrypted email, it is first encrypted with a secret key. the secret key is then encrypted with the recipient's public key. this patch will modify netscape's mail client so that whenever it generates a new key, it generates an all 0x72s key. i hope i'll find time to release an S/MIME encrypted message parser... so that anyone can verify the info. the magic sequence : look for : 51 6a 00 e8 86 27 00 00 83 c4 0c 8b f8 and change with 6a 72 51 e8 b5 98 94 77 83 c4 0c 33 ff by just changing 9 bytes, you can read all the encrypted emails ! like the previous sequence, this substitues a call to GenerateRandom to a memset of course it may be possible to do something more clever, like hashing a 16 bits random key to produce a 128 bit one ! my ex-boss is already doing that. here's how to know if the weaken sequence works on your browser: use the md5 in fortify distrib md5 -r 0x400-0x32ca00,0x384a00:0x58400 ...\program\netscape.exe that should produce aea2aba6f731468e34fd1141f603ea20 the md5 for the whole program (netscape.exe) is : 294dfe9a5e941d12b04e10adafb0c769 -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQCVAwUBNTKmWpVRLpSyKBl9AQGVAgP+Opot5VnJOouhwcS58JIdur1Q+xd2twWR /1q0SlpfsaTi99YIgFBrDpoVhqrW+wQWJmFmGppR5wZtyMNbSm3GPaRm0m9wAOiK vXsxS9VapEgjVh50caeTEh7e6GEwNBhNEENKbt1WvGWTrnh7K8dqiC3Pla7kmG3Q syimJN1toCs= =GIYU -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i mQCNAzUuVR4AAAEEALkjQwGKIsBT16nqJbZsWiPOH6gfRkzFav0RmWgjBu/bjDKe PmC2aGoQV2FXFYGGnX0bHyBz8Qjewdb7aDg/MQsAXjxsSZvqxNEkXGa6bH4U/Fe8 32WBddLrScc6vikaPv0o3D8bgzr+qQM0s9FSP4n5Jb+N/y2YjJVRLpSyKBl9AAUR tAVtYXJrb4kAlQMFEDUuVR6VUS6UsigZfQEBI9AD/RM6l/Gmw3+IPNQ1fRSFAME3 ZLoWUC6mAW5kUP0IaOFD/tXGXT+ekehcFojHpk9/QIO1mVpxr3bp97/ETZb1ZJiS EHTEjAP/85gja/YlRubfihUUb5/MoIz94a+MWsoDB0qLDJbQ48vyNsftNDrolUFf KUdCME7v3al/m6c0wufP =Bnx/ -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Corporate e-mail policy
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I used to work for a company which had a surprisingly liberal policy about e-mail.The gist of it was: "Private e-mail will not be read by anyone other than the recipient. The only exceptions to this are: 1) Systems personnel may examine mail messages to determine if the mail system is working correctly; [e.g., checking mail logs against users' mailbox contents to verify delivery] 2) [basically said e-mail would be treated like any other system files in the event of a criminal investigation, etc.]" The policy specifically required authorization from the line VP for either of these actions, and reinforced that the systems people were to treat the e-mail as administratively confidential data. The only time I heard of anyone even asking for e-mail was when a project manager wanted a copy of a message that a sponsor sent to one of his subordinates, who was on vacation. The systems folks cited the policy, the line VP backed them up, and the manager went away empty-handed. (He wound up calling the subordinate at her hotel and browbeating her into authorizing the computer center folks to forward a copy of the message to the manager. But that's another story.)

1 0

THAT BRIT AGAIN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Phillll came up with an excellent weasel this time. He's offered to "bet" on the Foresight Exchange. The relevant part of their FAQ says: How is FX different from a bookie? Besides the obvious fact that FX isn't real money, it differs from placing bets with a bookie in that FX is a market. In other words, it really isn't a bet at all. Instead of putting his money where his mouth is, Phillll has decided to put his mouth where his mouth is once again. Nice try guy. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0