- cypherpunks-legacy - lists.cpunks.org

FOUR TIMES AROUND THE WHEEL
by Jeff Gostin 17 Dec '03

17 Dec '03

Sandy Sandfort <sandfort(a)crl.com> writes: > Today is my birthday. I've circled the Chinese zodiac four > times--from Year of the Dog 1946, to Year of the Dog 1992. Happy Birthday to ya!! Here's wishing for many more!! :-) --jeff PS: How'd that PRZ get-together work out? -- ====== ====== +----------------jgostin(a)eternal.pha.pa.us----------------+ == == | The new, improved, environmentally safe, bigger, better,| == == -= | faster, hypo-allergenic, AND politically correct .sig. | ==== ====== | Now with a new fresh lemon scent! | PGP Key Available +---------------------------------------------------------+

1 0

Laws Outside the U.S.
by usura＠vox.xs4all.nl 17 Dec '03

17 Dec '03

tcmay(a)netcom.com (Timothy C. May) writes: : > It would be interesting for those in other jurisdictions to comment about : > how *their* rulers might view anonymous communications and strong crypto. : : I heartily agree with Duncan here! There has been very little said by : the good residents of France, Germany, Sweden, Holland, Italy, etc. : about just what the crypto-related laws of their countries are. [..] : So, I appreciate that some of our European readers may be tired of : hearing about U.S. policy or proposed laws, but the proper solution is : _competing speech_. That is, give us something new to talk about. Tell : us about what *your* country is doing. Tell us about any laws limiting : what kind of modems can be hooked up to your PTTs, as a concrete : example. Tell us about the raids on BBSs in Italy. Tell us about the : rumor that the Netherlands plans to ban unapproved crypto. There was a draft for a proposal for a law that would have outlawed crypto in the Netherlands. It would only be legal to use crypto if you had deposited the KEYs and if you had received a license. The use, trade and possesion of crypto was forbidden. It would be illegal (to dutch law) to have cryptosoftware available at some ftp-site (somewhere in the world) that would be accesable from the Netherlands (really!). (laws and enforcement of those laws are two -totally- different things in Holland :)) The draft was revoked, due to the huge amount of protest', the good thing is that we are in the proces of founding the dutch equivelant of the EFF: "de db.nl". -- Some loose thoughts any comments ? -- There are basicly four scenario's that a state can follow to regulate crypto: - outlaw it totally This was the path Holland choose briefly. - key depositing This is what the US is trying to do with Clipper et al. - try to develop a standart This is what the US did with DES and is trying to do now with Clipper. - do nothing The most prosperous scenario. Crypto use will boom, but lawenforcement agencies will be deprived from a useful tool, they can't bug phones any more. That will hinder their investigations but advancements in hardware/software could balance that: it is more easy to localise phonecalls, bugging equipment has become smaller and more powerful. Lawenforcement agencies have computerised databases that can link fingerprints, names etc in near "real-time". Large scale use of crypto could balance out some of the recent advancements in information technology that have given them a clear edge. -- Exit! Stage Left. Alex de Joode <usura(a)vox.hacktic.nl>

1 0

Frothing remailers and trust
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- kevin(a)elvis.wicat.com writes: > It strikes me as critical; right now, a user has to choose to trust a > set of remailers, given no assistance other than a list of "reliable" > ones. Given an extended web of trust between remailers, the user can > choose to trust one remailer (I have no idea how to make this process > more palatable) and immediately gain the security of a large web of > remailers (maybe you are right about that instant gratification > thing...) For what it's worth, I'm a remailer operator and I don't know any of the other operators well enough to say that I'm sure that they're trustable with respect to preserving privacy. (no offense intended.) I do, for the most part, trust them to forward almost all messages but my conclusion is based in large part on Raph's list. Absent that list, I don't think I'd have enough information on delivery reliability to comment about that either. This "web of trust" thing sounds nice but I can't participate because I don't know the other people involved. I think other remailer operators may be in a similar situation. Your scheme seems to conflate two tasks/roles I think are separable - remailing messages and specifying a trustable path for messages to take. The latter requires more information than I have - but it is information someone could gather. I think it'd be possible for someone to perform "remailer audits", and then report their findings. Some part of that report might be in the form of a "Anon-To:" chain, or probabilites for creating your own chain of messages; or maybe the auditor would serve as a first-hop-but-never-the-last remailer, passing the message along to remailers it believes to be reliable and trustworthy. Premail seems to be a step in this direction, but it chooses hops on the basis of reliability, not reliability + privacy. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLzCm8X3YhjZY3fMNAQEjnwP/T//KwPuvnzlRYgV8MgltJIaisM78zMjU J+Q+ARuvBudBS9ah8Z2p/MtxClj6nBYXEMFWtqwQbICBzDwxfpQAwahz5Vlay3qi QouRKx0ZJonvdi1LpIYYS8ElH8SdWEERMItfDyFDe2HDjFTXjL6fUbrIyLBvdzdl PCSmID/WYq0= =ukpf -----END PGP SIGNATURE-----

1 0

Re: On the crime bill and remailers
by Alex Strasheim 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hal said: > I strongly disagree with this. Anonymous remailers as presently > constructed will be almost completely ineffective against any significant > government attempts to surveil email traffic. The government does have > the resources today to defeat most uses of remailers. Since present-day > remailers lack padding features, the correspondence between incoming and > outgoing messages, even with encryption, is relatively easy to establish. > This is made worse by the lack of general support for reordering, which > renders the task almost trivial. Although it does seem that the government ought to be able to track remailer traffic, is there any evidence that they are actually doing it in the real world? I've seen posts on usenet which would have presumably provoked a reaction from police, but I can't remember hearing of any cases in which such surveilance occured. == Alex Strasheim alex(a)omaha.com -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLn9tpREpP7+baaPtAQHrewQAvJW8zUIQb57XwHHsdGC7gJo9UyFfds4o hu1vTUEsZvzyYJL7BIVgDEnHowVZ6vWyKky2QW+CiYli6Ulo8zFN5zoeWS09vLx2 /pANQPxXC+o61C1rypiR85D/esJ7a7ZRJu8OI5sa98+eLmDDad/j/768OMmFwR8c iI8ZnV2PCbQ= =DwQt -----END PGP SIGNATURE-----

4 3

SHAMELESS PLUG
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Mark Chen wrote the follow about the scienter thread: ... Howard Zinn makes the same point in _Declarations of Independence_.... he concludes that law is made not by legislators and judges, but by the policman's club. But less and less every day. As Duncan and I--the official "Pollyannas of Privacy"--have been telling you, technology is on our side. As it advances, technology continues to shift the balance of power from the State to the individual. For my vision of technology in the service of civil liberties, see my upcoming article, "Support Your Digital Police," in the "Idees Fortes" section of December's Wired. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

DB Technology
by L. Todd Masco 17 Dec '03

17 Dec '03

For a good example of DB/Expert system technology used for good instead of evil ("A power so great...") check out ringo(a)media.mit.edu, body of mail "join". You tell it your musical preferences and it suggests albums that others with a similar taste to yours liked. It'll also tell you what to avoid. I intend to honor its advice, to avoid Neil Diamond, Tiffany, and Barry Manilow. -- Todd

1 0

Re: HTTP authentication efforts
by ekr＠eit.COM 17 Dec '03

17 Dec '03

Paul writes: >Does anyone know, on the off-chance, who is currently working on >HTTP authentication processes for web browsing and Mosiac? >Pointers appreciated. Philip Hallam-Baker at CERN has done some work in this area. The general name for it appears to be Shen. I don't know what the status of it is. There is also the original PEM and PGP work done at NCSA by Rob McCool. I'm given to understand that MCC has done some work with Kerberos integration. (Microcomputer and Electronics Corp, or whatever). In addition, I believe that both Spry and Mosaic Communications Corp have announced that they have their own security solutions but haven't announced any technical details... And.....Shameless plug follows: Allan Schiffman and I here at EIT have developed an extension of HTTP called 'Secure HTTP' which provides for end-to-end security and authentication. (Mainly by recycling a lot of the preexisting work in cryptographic messaging, particularly PEM and PKCS7). The protocol is publicly specified and basically consists of wrapping the entire transaction inside privacy enhanced messages, using a variety of cryptographic message formats. It also includes support for systems in which only one party has a public key pair. [By exchanging an encrypted session key to be used for the return transaction]. Disclaimer: While there will be some free distribution of the software based on this protocol, and the protocol is completely nonproprietary (except, of course, that it uses public key) EIT (and I) have a financial interest in selling products based on this technology. You can get a copy of the current (though slightly outdated) version of the protocol via: WWW: http://www.commerce.net/information/standards/drafts/shttp.txt Email: shttp-info(a)commerce.net (Automatic response) Anonymous FTP: ftp.commerce.net/pub/standards/drafts/shttp.txt The next rev should support (though the released software probably won't for a while) Diffie-Hellman and Kerberos. -Ekr

1 0

Linux and PGP
by merriman＠metronet.com 17 Dec '03

17 Dec '03

I'm starting to take Linux for a "test drive", and am looking for a couple pointers on using PGP. Some time ago, I saw a couple of vaguely-related messages regarding PGP; one of them was editing a header file (?) to compile properly under Linux, the other was a patch (command-line switch?) to increase the available number of bits for the second part of the key (increasing it from 5 [!!] bits). Could someone either email me the info, tell me where it's hiding, or (if necessary) tell me I'm full of fertilizer? Thanks.... Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

2 1

THOSE DARNED HIT MEN
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, Tim May writes with regard to anonymous contract killers: ... And the risk of losing the digital cash can be made vanishingly small by use of anonymous escrow services, which act solely as holders of the digital cash.... I don't buy it. Anonymous digital assassins, murder escrows and all that work fine in an artificial, abstract, game-theory world. I doubt we'll see much--if any--of it in the Real World. Why? Because the market is too richly textured not to come up with its own cultural, ethical and digital fixes. Would you do business with a escrow that was the bag man for contract murders? I wouldn't, you wouldn't and the vast majority of people in the world wouldn't. That wouldn't stop some escrows from performing that service, but it would run up the cost. When the costs rise high enough, profitable opportunities are created for false escrows to enter the business. That's just one problem that can interfere with such an odious endeavor; there are more. I think the best way to illustrate that the anonymous murder business is nothing more than a bugaboo, is to set the best minds on the planet--Cypherpunks--to work on the problem. Let's all put our thinking caps on, and come up with answers to the follow hypothetical situation: Let us assume a world with totally anonymous communications and payments (strong crypto, remailers, digital cash, etc.). 1) How would YOU scam money from the system without actually knocking anyone off? Or in the alternative, 2) How would YOU use technology to address the problem from police/private investigator perspective? I'm betting that with no more than a few moments of thought, Cypherpunks will come up with a ton of hacks. To get the ball rolling, here are two from me: SCENARIO ONE I set up a meat-and-potatoes escrow business. I keep my nose clean. I honor my obligations. I build up a good reputation. At some point, I'll be approached by a murderer and the person who is hiring him or her. I'll accept the payment. When the murder is committed, I won't pay off. The murderer will (a) sue me (I don't think so), (b) damage my reputation (I'll leave this one as an exercise for the student), or (c) murder *me* (ah, but first he has to find me; in the world we posit, that won't be very easy). If this scenario happens very often, it'll take all the profit out of the murder business. Of course, the murderer can get the money face-to-face from the customer, but then we're back to today's square one. SCENARIO TWO I set up a phoney murder-for-hire business. Someone contracts with me to bump-off their rich uncle. The client deposits my payment with a reputable escrow company, "Murder Escrows R Us." I go to the uncle and tell him the whole deal. Using digital technology, bribed coroners, etc., we fake his death. When the news hits the Net, the escrow pays me off. The uncle comes back to life, disinherits whomever he suspects wanted him dead. And I laugh all the way to the digital bank. I create a new pseudonym, place another murder-for-hire ad, and do it all again. Given our Brave New World, nobody can touch me. Okay C'punks, it's your turn. How would you subvert Tim May's vision of anonymous murder-for-hire for fun and profit? (Feel free to take potshots at my two scenarios as well. Cypherpunk cleverness cuts both ways, I'm sure.) S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

3 2

Reserved DC-Net IP addresses - NOT!
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

hughes(a)ah.com (Eric Hughes): > Speaking of long-term integration on the internet, might it not be a > good idea to get some IP address range assigned for dc-net use? I don't agree. Apart from the IP address crunch that already poses a problem for the IETF, I don't see why DC-Nets should be limited to specially allocated addresses. DC-Nets should be implemented a layer over protocols such as IP, or as extensions to them. It should be possible for _anyone_, regardless of IP address (officially allocated DC-Net number) to connect with _any_ others on a DCN, with some software or other interfacing. ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "Clean the air! clean the sky! wash the wind! rishab(a)dxm.ernet.in take stone from stone and wash them..." Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

3 2