- cypherpunks-legacy - lists.cpunks.org

Re: Regarding employee rights on company equipment
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:32 AM 2/9/96 -0800, lunaslide wrote: >A day or so ago, I reasoned incorrectly that university students and >employees were free to encrypt mail they sent through their student or work >accounts. This was in response to a statement that the govt could retain >at least some control of internet traffic through the universities and >businesses. I would credit the person who called me on it, by I do not >remember who it was. It seems that, at least for employees, it is totally >up to the employer: > >>From Edupage Feb 8, 1996, > >INTERNET USAGE POLICIES >Neal J. Friedman, a specialist in online computer law, says that "employees >are under the misapprehension that the First Amendment applies in the >workplace -- it doesn't. Employees need to know they have no right of >privacy and no right of free speech using company resources." According to >Computerworld, a number of employers are adopting Internet usage polcies, >such as one developed at Florida Atlantic University: < >http://www.fau.edu/rinaldi/net/netpol.txt > (Computerworld 5 Feb 96 p55) I don't think this issue is as simple as Friedman wants to make it sound. (Then again, he may have been quoted out of context.) In any event, what he said is true, modulo explicit or implicit contracts to the contrary, rules about union activity, common-law privacy rights, Title VII, the ECPA and similar state statutes, and so forth. The quote sounds like a self-serving statement intended to scare people into believing that their rights are as limited as the speaker wishes they were. That's not so unusual, but it's not always useful to get legal advice from someone who sees their interests as adverse to yours. (We've gone over the "I think the law regarding employers rights vis-a-vis employees rights *should* be 'x'" ground a zillion times, and another rehash seems unproductive. I don't intend to respond to messages along those lines.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Bill Stewart 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, you wrote: >Probably the easiest way of ensuring that personal information isn't >wantonly distributed by credit agencies or (anyone else) is to update >our Privacy Act - which is ridiculously out-of-date and badly in need of >being re-written. It is also hampered by its apparent lack of teeth. The parts of the Privacy Act that I remember are all restrictions on _government_ actions, not private actions. It's an important distinction; even though TRW may know way too much about you, it's all information that you voluntarily released to somebody, unlike data that the government requires you to give them. And, yes, it's out-of-date and toothless. ... >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: ... >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. If you're going to propose laws, you should not only think about whether they'll do what you want, but also about what else they'll do, how they'll be enforced, what are the side effects of that enforcement, etc. How is the government going to ensure _non_existence of databases? If I'm a prosecutor, and claim that you _might_ have personal data about somebody on your machines beyond the Politically Correct Data Elements, can I get a search warrant for _all_ your databases? What about that encrypted file on your PC at work? Such things have been used to hold personal data before (even by police like the LAPD or Stasi.) No thanks. If you want to require that a database exists, then a business can demonstrate that they have it by producing it (though proving whether or not in really includes all transactions is still difficult.) On the other hand, if you don't make the law adequately enforceable, you're encouraging violation and selective enforcement. >o the promotion of the use & implementation of encryption - including > the possibility of ITAR being reduced or eliminated for the export > of encryption products Yes! GAKed encryption, to be sure - once there's a requirement that you be able to produce your data for the government, they'll discover that they need guaranteed access to data that would otherwise be guaranteed inaccessible by strong encryption. >o reduced propagation of personal information A much stronger way to increase privacy is to eliminate one of the most popular unique keys used by these databases - the Social Security Number which the government requires you to give almost anybody who gives you money. Give each taxpayer a pile of taxid numbers (either cryptographically related, or just randomly generated and stored in a big tax-department database) so you can use a different taxid for everyone who needs one, making it impossible for anybody but the government to correlate them. #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs

1 0

Re: What is really happening in Oregon
by Alan Olsen 17 Dec '03

17 Dec '03

At 04:29 PM 2/9/96 -0800, Joe Zychik wrote: >Excerpted from today's Zychik Chronicle > >The Los Angeles Times writes: "rivers raged through Oregon" [should say >"Oregon taxpayers sunk by Oregon government"]. "the regions worst flooding >in three decades" [should say, "State of Oregon has been wasting tax payer >money for 30 years"]. "At least 3 deaths were attributed to the flooding >[should say, "State of Oregon kills 3 more innocent citizens"]. "13 counties >were declared a disaster area [should say, "State of Oregon has been >screwing these 13 counties especially"] "And the worst is yet to come" [the >citizens will blame the weather]. "Rats by the hundreds started crawling out >of Portland's sewers" [should say, "The parents of Oregon's politicians and >bureaucrats came forward."] You need to cut back on your medication (or increase it). The water damage in oregon has little to do with the action or inaction of government. It has much more to do with a strange set of weather patterns in Oregon. (Mainly a whole lot of snow and ice followed by heavy rains.) Right now the weather here is just creating lots of land slides and flooding. The worst seems over for now. Time to wait for the water to recede and then clean up the mess. How this can be blamed on the Oregon State government is beyond me... What it has do do with Cypherpunks, I have no idea... (Not even much of a conspiracy there.) Sounds like someone just wnats to rant. --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "I, Caligula Clinton... In the name of the Senate and the people of Rome!" - Bill Clinton signing the CDA with the First Amendment bent over.

1 0

Win a free Apache-SSL-US Commercial license
by sameer＠atropos.c2.org 17 Dec '03

17 Dec '03

See http://apachessl.c2.org/ for more details. Thanks, -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.org/ (or login as "guest") sameer(a)c2.org

2 1

Truelly Random Numbers
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

>The number of randomly selected 768 bit primes that you would need for a >reasonable chance of a birthday collision is 1.708E104 True however the current mechanism of generating PGP keys which consists primarily of pseudo-randomly pounding on a keyboard is hardly "truely random. Have no idea of the true number but expect it to be significantly less than that quoted above, even for a 1024 bit key like mine. Warmly, Padgett

3 2

Gates v 2.0
by Anonymous 17 Dec '03

17 Dec '03

Besides the FBI's DNA database, in today's (Oct. 12th, 1998) New York Times is a John Markoff commentary " Memo Offers a Glimpse of Gates 2.0" about a 14 page memo written by Bill Gates in Sept., entitled "The Era Ahead". In this memo, Gates "describes a new system to be called Megaserver which will provide computer users with access to their personal information and electronic mail wherever they have an Internet connection." Holy Hotmail Batman! That Bill is right on top of things! Further along, the article paraphases Bill that that the operating system "will play an increasing role in protecting intellectual piracy against from data piracy by tracking the use of information and preventing illicit copying." I can see my future now, logging into Windows 2000 with the handy keyboard DNA sampler. However, all of my software is registered to my dog. Here boy...

1 1

Re: Truelly Random Numbers
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:11 PM 3/2/96, Adam Shostack wrote: >A. Padgett Peterson P.E. Information Security wrote: >| True however the current mechanism of generating PGP keys which consists >| primarily of pseudo-randomly pounding on a keyboard is hardly "truely random. >| >| Have no idea of the true number but expect it to be significantly less than >| that quoted above, even for a 1024 bit key like mine. > > Accroding to Stephan Neuhaus's 'Statistical Properties of IDEA >session keys in PGP,' the session keys are very well distributed, when >tested for equidistribution and serial correlation. > > This does not demonstrate that the RSA keys are as well >distributed, but it does generate some confidence that the key >generation methods of PGP are not very broken. Testing for RSA >generation would be more difficult, since there are some practical >difficulties in getting a large sample of RSA private keys. In some PK code I did several years ago in Mathematica, the primes for the RSA modulus were found by picking a "random" (more on this later) starting point and then counting up from there, testing for primality (actually, pseudoprimality, technically). As one would expect, primes are found fairly quickly. The "randomness" of the resulting primes--and hence the randomness of the modulus and hence the "RSA key"--is set by the randomness of the starting point. With a reasonable amount of entropy, such as picking the next digit from several keyboard timings, I expect the 150-decimal-digit number to be *very* random! (In fact, I'd venture that merely asking people to type in digits would produce starting points that essentially would be very random...maybe some clustering here and there, or an unequal number of digits, or too equal a distribution, but adequate. An since an attacker could not know what the sources of randomness were for some particular person, I doubt strongly that factoring the modulus would be any easier.) Suppose a = 4801747274372727828487361830183561393615106551195496693610351528409257572926 659 2027575902673957001560102249600798767153757681546836352857811107361291541511 (which is about 140-150 digits, "randomly" entered by me) and p is computed as the first prime larger than this. q found the same way Now, is the modulus, n = pq, any more factorable than if a "more random" source of p and q were used? (I am actually asking this as a real question. Does anyone know if factoring is significantly easier for such not-completely-random numbers? I would expect that in theory it is, but in practice this is not a useful point of entry into factoring n. Just a hunch.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: M A F_i o s
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:27 PM 3/1/96 -0500, John Young <jya(a)pipeline.com> wrote: > 3-1-96. TWP: > "Expert Panel Wants Intelligence Director to Hold More Power." > The commission finds that the patchwork of 14 separate > intelligence agencies is functioning well in its current > form. To meet tbe growing threat of worldwide criminal > activity the panel suggested creation of a high-level > policy group run out of the White House, called tbe > Global Crime Committee. But they've already _got_ the Pentagon! The title does remind me somewhat of "Buckaroo Banzai against the World Crime League".... #-- # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com / billstewart(a)attmail.com +1-415-442-2215 # http://www.idiom.com/~wcs Pager +1-408-787-1281

1 0

Re: Is there any work on entropy-lowering schemes?
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

On Fri, 1 Mar 1996, Mutant Rob wrote: >So it seems possible to create a scheme that given a key will take a >block of n bits and expand it to 1.5n or 2n bits, recoding it in such >a way that determining the key is difficult even if one suspects such >a scheme has been used... but that using the scheme will make the data >look more like the MSBs of graphical data rather than encrypted data. Stealth 1.3 (or is it 1.2?) does that, but it only makes the data look more like the MSBs, and not *exactly* like the MSBs. I think it's available from Adam Back's WWW site (http://dcs.ex.ac.uk/~aba/stealth/) Mark

1 0

Random keys ?
by A. Padgett Peterson P.E. Information Security 17 Dec '03

17 Dec '03

> This does not demonstrate that the RSA keys are as well >distributed, but it does generate some confidence that the key >generation methods of PGP are not very broken. Testing for RSA >generation would be more difficult, since there are some practical >difficulties in getting a large sample of RSA private keys. True but do not need private keys, just public ones (one to one relation), should be able to get a large sample (20,000 in one place did I hear ?) of those. Warmly, Padgett

1 0