- cypherpunks-legacy - lists.cpunks.org

Re: A word on "emergencies" [WAS Re: Final Solution to the Crypto ]
by John Young 17 Dec '03

17 Dec '03

Michael Froomkin wrote: >Rather, my point is a simple one. The fact that the President has >declared an emergency here is primarily a technical legal event. It is >not a sign that martial law is about to be declared, that they are coming >to take you or your [fill in blank] away, or that anything fundamental has >changed. Multi-year emergencies in which the executive uses one statute >to compensate for the Congressional decision/failure to pass another >statute is not, I submit, a particularly telling sign of a mature and >healthy democracy. But this goes to large and gradual processes, not to >anything that suddenly happened. Thanks for the steady-hand reassurance. Your papers are balm. Was it not Hal's original ironic lament about the current charade -- that it's business as usual among the jaded insiders who are confident that they know how power really works. The disdain for public accountability -- cynical extension of declared emegencies well past their time -- is what breeds the desire of outsiders to protect themselves from insiders. Hence, the desire for crypto, especially the cryptanalytic kind that ventilates those privileged inside communications. The battle may be between cryptogologists and lawyers, it seems to me, the struggle for supremacy between privacy-protecting code and privilege-protecting secrecy. Hoary national security proclamations have become much more lethal munitions than cryptography, and it is these incitements that need ... what, X-rating? What can be done to supplant these thrilling, crowd- rousing proclamations of national threats -- ancient, vulgar strategems around the globe?

1 0

Re: AGA'S LIMITED VOCABULARY
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:37 ðì 17/11/1996 -0500, aga wrote: >> about the use of technology to protect privacy. Perhaps you >> were confusing it with that other list you are on: >> alt.sex.yourmother. > >No, it is your mother I have been fucking. Pity! Aga should respong to this lady's needs FIRST! :-) BTW, (paraphrasing Speedy Gonzales)... I think she really fucks for money, but since you are an aga she'll fuck you for nothing! :-) >> > What year did you graduate from Law School? >> >> Irrelevant, but it was 1975. More importantly, though, when did >> YOU graduate from law school? > >1975. And my school was better than your school. > >I was the fucking class President in Law School. We >fucked on Library tables at Pitt. Where the fuck did >you go to school? I can see the beginnings of an... S/M cyber-romance in these lines. ROTFL!!! Aga should not forget to carry a... cane in his briefcase. The more arrogant they sound at first, the more submissive their fantasies are! (ALL masochists in fact). :-) Love and Jelly Babies George P.S. My first guess is that Sandy is a Piscean, and Aga is a Taurus. It would work out better with him being a Scorpio or a Leo, however. (My second guesses on Aga). My second guess on Sandy is that she's a Virgo, however. In this case avoid her at all costs! ROTFL!!!!

1 0

Strong Encryption for International Versions of Netscape
by Scott Weisman 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE: November 17, 1996 ANNOUNCING STRONG ENCRYPTION FOR INTERNATIONAL VERSIONS OF NETSCAPE JERUSALEM, Israel -- SecureScape Technologies announces the alpha release of its first product, SecureScape. This revolutionary program offers international users of Netscape Navigator the same strong encryption as that enjoyed by users in North America. All software encryption products developed in the United States are subject to export restrictions. Such exported software is subject to an arbitrary 40-bit key length, compared to the 128-bit (or greater) key length commonly found in domestic software. This weakened software is in certain ways inferior to no encryption at all, since it gives users a false sense of security. The Executive Order by President Clinton on November 15, which modifies U.S. Government policy on export restrictions, still requires requests for export permits to be considered on a case by case basis. Furthermore, it is very likely that strong encryption products will be granted export permits conditional on key-escrow or other compromise arrangements, because the Executive Order states, "the export of encryption software . . . must be controlled . . . such software shall not be considered or treated as 'technology'." Implying that encryption software is still considered a form of munitions. The irony, of course, is that strong encryption has been widely and easily available outside of the U.S. for years. SecureScape was developed using the freely available SSLeay library, developed by Eric Young of Australia. SecureScape Technologies was founded by Scott Weisman, a software developer residing in Jerusalem, to develop and market Internet security products. The company is seeking investors interested in a strategic partnership. The SecureScape home page is located at <http://www.SecureScape.com/secscape/>. SecureScape currently works with Netscape versions 1.1 or later on the Windows 95 and Windows NT platforms. CONTACT: Scott Weisman P.O.B. 31194 Jerusalem 91311 ISRAEL sweisman(a)SecureScape.com © 1996 Scott Weisman - All Rights Reserved. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation. SecureScape uses software developed by Eric Young (eay(a)mincom.oz.au)

1 0

RE: The Utility of Privacy
by blanc 17 Dec '03

17 Dec '03

From: Hal Finney You suggest that the main motivation which someone might have for protecting privacy is that they are engaged in some illicit activities: page 45: "Why should I really care if someone sees this? I have nothing to hide." ..................................................... This statement from David Brin impressed me with the consistency of a certain way of thinking that some people have: "I think that having a minimum standard of living is good, therefore everyone should be coerced to contribute to the general welfare." On the other hand, "I myself have nothing to hide, therefore no one should be concerned (read: permitted) to do so." The issue for them in regard of what everyone should/should not do, is whether anything is logical as far as they themselves can see - and the logic revolves around what they themselves think is right; the extent of their own vision is considered sufficient to determine the parameters of everyone else's life & actions, and therefore sufficient cause to have their measures imposed over all. But this letter of Hal's brought up an important point: that even if a person has nothing to hide, it is not the openness or closedness of information which is of concern, but the *responses of others* to that information. When an individual wants to live a free & open life, they expose themselves to dangers. In order to be free to roam, they must have a way to protect themselve from all manner of destructive influences - the weather, predatory animals, vicious strangers, etc. There must be a way to protect what is one's own in order to preserve it. If it was easier for everyone to defend themselves against attacks on their person or reputation, maybe there would not be as much concern about privacy. Perhaps if a person could "get away" from others, could continue to have a normal life without too much disruption, once some exciting bit of info was out in public, if they could maintain command over the effects upon their life despite living in a fishbowl, then no one would worry quite as much (although the principle of personal control over one's property remains the same). But in the meantime, we have but few ways to protect ourselves under the centralized arrangement for protection (police, defense agencies). Anyone in a government position is aware of how their public expressions can result in public outcries against them; the secret agencies protect their information files because of what "the enemy" would *do* if they found out about these - even if the agency itself does not consider its activities immoral. If Information is like munition, privacy is like defense - it is a form of self defense. .. Blanc

1 0

Re: Giving Kill Files a Workout...
by Dave Hayes 17 Dec '03

17 Dec '03

Dimitri Vulis writes about unwanted noise: > They feel compelled to silence it altogether. They claim altruistically > that they don't want the noise to bother anyone else, such as the clueless > newbies who keep subscribing to this mailing list and don't know how to > use mail filters. (Sandy Sanford's concern for them was soooo touching...) Misplaced altruism is one of the primary causes of social injustice, authoritarian regimes, and security measures. It is not possible to be "altruistic" until one realizes that one doesn't know what true "altruism" is. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't follow in the footsteps of the ancients, seek what they sought.

1 0

Re: Members of Parliament Problem
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:39 PM 11/17/1996, Simon Spero wrote: >On Fri, 15 Nov 1996, Rich Graves wrote: >>Peter Hendrickson wrote: >>> There are times when one wishes to speak anonymously, yet speak >>> as a member of a group. >> You either need to trust a shared server to know and then blind your >> identity, or trust the people with whom you share a secret key not to >> give that key to non-group members. > Why not use blinding for obtaining the certificate? > Create a number up public/private key pairs, blind them, then do the > cut-and-choose thing with the security officer. He signs the blinded key, > then returns it. Unblind the remaining pubic key, and you've got a public > key with the appropriate signature on it. Okay, this would work. But, it requires that all (or at least many) of the Members of Parliament cooperate. If not, then the security officer will be able to make very good guesses about who is speaking. Parliamentarians may not cooperate for a variety of reasons. They may not wish to be attacked by terrorists for the words of others. They may believe that cowardice is not to be encouraged. They may not believe in anonymity. It might be too hard for them. What I would like to see is a method which relies only on published public keys and no other cooperation from the people who are (more or less) being used as shields. This may be impossible. (A number of people have posted references to other ways of doing this. I have yet to track down the references they gave so I don't know if any of them fit the bill.) Peter

3 2

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

> This is backwards logic; when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. hmmm... Now that _completely_ depends on the system. Now for the system I administer, the level of security really isn't _that_ high (on the grand scale of things). It is, however, high enough that I inconvenience the users with a pro-active password guesser, and passwords that expire occasionally. I suppose that this is a _minor_ inconvenience, but it raises the level of security a very large amount. On a less mundane system (one run by the government, say), security is only _slightly_ less important than being able to use the system in the first place. :) On this type of system almost any inconvenience is worth the cost. > > You have previously said that the passwd file should not be available > > for public consumption. Though this is certainly true, it does not > > hurt that even if the passwd file is available, nothing particularly > > useful can be done with it. > Hince you use pseudorandom password generators and crack. If you count on > somebody not being able to preform an opperation quickly, they'll usually > prove you wrong. whoa... didn't you just say: > when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. I think that psedu-random password generators would almost certainly "hinder in the functionality of the system"... :-) I want to make it so that users can use passwords > 8 characters, and I want to use something a bit better than FreeBSD's solution. Whether or not this is necessarily the One True Way (TM) to security, it will increase security. I'm not saying "Hey everyone. Here is a spiffy new password system that will make your entire system completely secure!" I'm saying "Could everyone please look at this algorithm that I'm thinking of using. Could you please comment on it, so that I can make it better." That's it. All questions on whether or not passwords should shadowed, crackable, not crackable, or consisting only of the letter "e", aside. Is this algorithm secure, and if not, why not. Joshua > --Deviant > The Macintosh is Xerox technology at its best. I very much like your signature... very nice... -----------------------------Joshua E. Hill----------------------------- | Allen's Law: | | Almost anything is easier to get into than out of. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

2 1

Re: Censor John Gilmore -- EFF is a disgrace!
by Dave Hayes 17 Dec '03

17 Dec '03

[Multiple CC's trimmed, I don't think anyone at msn.com cares...] > #From Phrack 49, file p49-09 published this month: ... > File 09 of 16 > by Dr.Dimitri Vulis (KOTM) > A Content-Blind Cancelbot for Usenet (CBCB) ... > And what follows, is Dr. Dimitri, defender of freedom of expression, > champion of the anti-censors on the net, posting code to the world to > engage in exactly those activities that everyone has been ranting about > as being so utterly "horrifying (forged cancellations etc)" as it > were. You call yourself on cypherpunks, and you blithely assume that a Phrack author actually signs his real name? Either I thought you guys were *real* hackers and you aren't, or this is a very funny troll. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "Better to be safe than to be sorry" is a remark of value only when these are the actual alternatives.

3 2

HP's crypto technology
by Hal Finney 17 Dec '03

17 Dec '03

I was poking about on the hp web server, trying to get some more hints about the technology they are pushing: <URL: http://www-dmo.external.hp.com/gsy/press/sevcik.html> > Date: 7/11/96 > > Rich Sevcik, vice president and general manager of the Systems > Technology Group, testified to a U.S. Senate subcommittee June 12 on > the importance of cryptography to Hewlett-Packard's ability to compete > in the international marketplace and to the nation's high-technology > competitiveness. > > [...] > > In conclusion, he introduced HP's technology called the International > Cryptography Framework (ICF). Products based on ICF would contain a > suite of cryptography capabilities of various strengths and types, > all non-functional. A customer then could enable the desired types and > strengths of cryptography in conformance with export and host government > regulations by obtaining a stamp-size smart card (known as a "policy > card"), programmed to turn on the particular cryptography capability > allowed. This would protect the right of each nation to establish an > independent policy governing cryptography in digital communication and > storage. Sevcik showed the subcommittee members a prototype cryptography > unit and several policy cards. He said HP plans to have an initial > ICF product available later this year as part of a total smart card > system solution offered due to an alliance with Informix and GEMPLUS, > with other ICF-based products planned for next year. > > U.S. export license authorities are finishing their review of this > first-phase implementation of ICF. "We have been extremely pleased with > the responsiveness and cooperation of these agencies in the review of > our technology," Sevcik said. "We have every reason to believe that > the cryptographic unit and host systems will be granted liberal export > authorization consistent with our expectations for ICF." <URL: http://www.hp.com/csopress/95sep26.html> > Press Release > > HP Announces Alliance with Gemplus and Informix to Deliver Personal > Information Cards for Consumers > > U.S. Government Reviewing Industry-backed HP International Cryptography > Framework > > September 26, 1995 > > PALO ALTO, Calif., Sept. 26, 1995 -- Hewlett-Packard Company, Gemplus > and Informix today announced the formation of an alliance to develop a > secure infrastructure that will enable corporations to speed new services > to consumers via a credit-card-sized personal information card. > > These cards will carry several thousand times the amount of data carried > by currently available smart cards. Additionally, the data on these cards > will be fully encrypted for secure international communication, so the > card will be able to be used anywhere in the world. HP believes that > the U.S. government will authorize the export to commercial enterprises > of products in Phase I(1) of HP's international cryptography framework > standard -- one of the underlying technologies in the infrastructure > that will enable the international use of personal information cards. The > framework is based on HP's open cryptographic structure. > > [...]

1 0

Emergency powers
by Charles Platt 17 Dec '03

17 Dec '03

Of course, Michael Froomkin is right in everything he says about presidential emergency powers. But an unconstitutional abuse of power is surely not acceptable merely because it has become a routine method for accomplishing everyday legislative tasks. First, it allows significant possibility for future abuse; and second, if the Constitution is routinely circumvented, this diminishes its general power (as any law loses its power when it is routinely flouted). The situation is all the more troubling because it receives so little publicity, outside of militant "extremist" groups (i.e. those that are crazy enough to believe that presidential power should be limited in accordance with the law of the land). When a president can take almost action under the excuse that it's a "national emergency" (when in fact there is no emergency), and he doesn't have to answer questions till later, and most citizens are unaware of this, we have a potentially dangerous situation. They key word here is "potentially." Michael Froomkin seems relatively sanguine because the potential for great harm has not been realized. I am not so easily reassured. --Charles Platt

2 1