- cypherpunks-legacy - lists.cpunks.org

Re: Disappearing Cryptography
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>A book by Peter Wayner (pcw(a)access.digex.com) >of interest to cypherpunks. >(OK, cypherpunks mailing list subscribers then) > >There is more info at Peter's home page: >http://www.access.digex.net/~pcw/pcwpage.html >but I couldn't get to it when I tried just now. Yes, my service provider, DIGEX, is really terrible about providing access to my net page. I'm sorry about this, but if you need more information, feel free to write me. > >I got my copy from Border's in Houston on Sunday. > >He describes mimic functions, a particular interest of >mine. He also covers basic encryption, error correction, >secret sharing, compression, context free grammers, >anonymous remailers, reversible computing, etc. > >There is an evaluation of several stego packages, and >an inclusive (there isn't enough published about >steganography to call it extensive) bibliography. > >The presentation is at an introductory, but not trivial >level. I wish there had been more technical explanations, >but I suppose the author would have lost a sizable fraction >of an already tiny audience. > Yes, this was one dilemma I faced with writing the text and I decided that a "Scientific American" level text would be more likely to appeal to more people. In fact, my hope is that many people will be interested in a presentation of this level because of the political implications. If you can't find the information, you can't censor it. I think, though, that there will be plenty of meat on the bones of this book for many people. Anyone who reads cypherpunks carefully and works through the mathematical details won't find much new here, but I don't know if there is much else out there. The proceedings from the information hiding workshop in Cambridge will generate some more papers, but that's in the future. >By the way, "the people who participate on the cypherpunks >mailing list" get a nice "thankyou" in the preface. Of course this should be repeated and amplified. Many people post great stuff to the cypherpunks list. I couldn't have done it without you. My only regret is that the best people on the list might not learn much new from the book. Sigh. > >Rick F. Hoselton (who doesn't claim to present opinions for >others)

1 0

Re: Why I Pay Too Much in Taxes
by nobody＠replay.com 17 Dec '03

17 Dec '03

Black Unicorn wrote: >Where does the company get the funds to pay you? >From Tim's day work. It's a consulting company, i.e. it sells his services to whomever is employing him today. The whole idea was to hide Tim's income sources, or that's what he asked for anyway. You can hide your income by putting it in another jurisdiction. >What pay? I don't get it. Where does this friend gets his money? As a cut from the money Tim's employer gives him. >> By the way, are there any PGP encrypted mailing lists for >> discussing serious tax fraud? > >If such a list existed, would we tell an anonymous poster/fed? >If your above scheme is intended merely to conceal funds it is a fairly >poor example as it depends on the secrecy of each and every 'employee' of >the company. No it doesn't. One person knows where they money went when it left the country (and he is getting paid for the risk of doing time). Nobody knows where the funds are concealed. Probably in a trust that you can access when you are on vacation abroad. Mr.X.

2 1

Re: remailer-in-a-box
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 3:51 PM 5/7/96, anonymous-remailer(a)shell.portal.com wrote: >No one answered me. >What's the best remailer-in-a-box. >I'd like to run one. I would think people would be falling >over eachother to tell me. The reason for the quiet may be twofold. First, I and many others delete unread list messages with out subjects. Second, remailer-in-a-box does not really exist. Mixmaster, and most of the other remailers are fairly easy to set up for anyone with UNIX experience. I run Mixmaster + Ghio + reorder scripts. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: misunderstandings of PICS
by Clay.Olbon＠dynetics.com 17 Dec '03

17 Dec '03

At 5:31 PM 5/7/96, Joseph M. Reagle Jr. wrote (in part): >>my fear is that the supposed "failure" of self-ratings could be twisted >>by its opponents as evidence that it is inadequate to deal with the >>real problem. > > I think your fears are a little too paranoid here, but maybe they >aren't. The question is how much of this hoopola stems from fundamentalist >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better >educated and feeling pretty secure their kids won't get their hands on >naughty material. And then if self labeling had some failures, that's an >incentive for others to provide third party services (as others have >argued). PICS had to sell itself to the net as much as to the masses. >Self-labeling appeals to the net, it may appeal to the masses, but there are >other things in there to sweeten the deal for them if not. I disagree - paranoia is warranted here. One problem with our legislative process is that is is vulnerable to emotional issues. It is very easy to bring up issues that sound horrible (child porn, terrorist info, flag burning), then create legislation controlling them. Being opposed to this legislation for whatever reason brands you as "anti-family" or "soft on crime". It is clear to me that improperly labeled material will be paraded before congress and the media as justification for stricter control over this material. Congressmen, not wanting to face attack ads claiming that they support pornography (or terrorism, or whatever), will pass silly laws such as the CDA. It has happened before, it is naive to think that it will not happen again. There are only three solutions: 1) Vote in congressmen that support the first amendment. 2) Hope that judges protect our rights. 3) Deploy technological solutions that make any laws passed ineffectual. The first solution is improbable and the second is risky. Only the third solution actually provides a method where we can really have an impact. I think PICS is a great idea, and I think it may have an impact on judicial decisions. It should be implemented because it puts the control over information where it belongs, in the hands of the end-user. I would hope that it is a good-enough solution to avoid further control over the internet, but I have my doubts. Remember, if congress can try and legislate against something as innocuous as flag burning, what else would they be willing to do to curb our right to free speech? Clay --------------------------------------------------------------------------- Clay Olbon II | Clay.Olbon(a)dynetics.com Systems Engineer | ph: (810) 589-9930 fax 9934 Dynetics, Inc., Ste 302 | http://www.msen.com/~olbon/olbon.html 550 Stephenson Hwy | PGP262 public key: on web page Troy, MI 48083-1109 | pgp print: B97397AD50233C77523FD058BD1BB7C0 TANSTAAFL ---------------------------------------------------------------------------

1 0

Re: Transitive trust and MLM
by Raph Levien 17 Dec '03

17 Dec '03

I'm really glad to see this thread. I think this is a problem that is well worth thinking about. I think what is really called for is a model of when keys are likely to be bogus, and when signatures, etc., are likely to be correct. Before going into the math, I'll go through some examples. Any key that's "well connected" in the MIT keyring is likely to be good. Specifically, if it's signed by lots of people, and each of those people is reachable from my trust root, then I'm pretty much willing to believe the key is good. Unfortunately, there are a fair number of reasons why a key may be bad. A really _cool_ thing to do with a compromised machine would be to sign a big bunch of bogus keys. Given how easy it is to compromise a machine, this is a very real worry. I don't know if this attack has been realized yet, but it's best to assume it could be and will be. Another weakness is the "clueless user" who signs keys gotten from the Net, or otherwise not properly verified. I don't claim to know all of the vulnerabilities, but I do think it would be a good idea to quantify them before designing a key distribution system. Hal calls into question the value of signed keys. To me, this points to the pressing need for better manual verification of keys, by communicating secure hashes through the phone and on physical channels, including business cards. These channels are more secure than the Net, are more convenient for all but the most hardcore net.heads, and would actually work quite well, I think. But I do think it would be nice to have access to "probably good" keys for casual e-mail. With luck, a densely connected Web of manually obtained keys can serve as a good foundation for the latter. Now for the mathematical model. Signatures can bind keys to e-mail addresses, or act as assertions that the signed public key is trusted to transitively sign other keys. Let's assume that each signature has a certain probability p of being good, and a 1-p probability of being bogus, and that all probabilities are independent. These are probably bad assumptions in the real world, but that's the difference between theory and practice. Now we can actually evaluate the probability of a given key being good. Consider a Monte Carlo process in which each edge in the graph is present with probability 1-p. For each run, we determine whether the recipient's public key (actually the binding between public key and recipient's e-mail address) is reachable from our trust root. The probability over a large number of runs is (given our assumptions) the probability of the key being good. One encouraging consequence of this model is that densely connected subgraphs can result in highly trusted keys even if p itself is quite small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For example, if p is a mere 50%, then in a clique of size 10, each key in the clique is trusted with a probability of 99.9%. This computation is (I think) known as the network reachability problem, and is probably quite hard to evaluate. In practice, you'd probably want to compute upper and lower bounds instead, Let's see if we can come up with a model that preserves this property of giving high trust values to densely connected keys, yet is also highly resistant to (some plausible model) of attacks against the Web of trust. Raph

1 0

Mandatory Voluntary Self-Ratings
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:31 PM 5/7/96, Joseph M. Reagle Jr. wrote: >thought police, or concerned but ignorant parents/congressmen. If >self-labeling worked (which I see few cases in which it wouldn't) I can't >see the concerned but ignorant being unhappy. Rather they'd be a bit better Regarding this "(which I see few cases in which it wouldn't)" point, I have a different view. Should "voluntary self-criticism" become widespread, I expect to rate all of my posts as suitable for children of all ages, suitable for hypersensitive feminists, suitable for Jews and Gentiles alike, and so on. Regardless of whether I'm advocating post-birth abortions or forced encheferation of Muslim girls. Then we'll see what happens. (This is an old debate, here and on the Cyberia-l list, to wit, what happens when people/perverts/libertarians choose to subvert the voluntary ratings by deliberately mis-rating their stuff? Or what if they genuinely believe, a la NAMBLA, that youngsters should be exposed to certain things?) I believe the whole debate about PICs-type ratings and other "voluntary self-labeling" has taken us astray. I don't see calls for authors to voluntarily self-rate their print works, nor do I see calls for newspapers to have articles rated. Nor speech in general. However, the drumbeat of "V-Chip" advocacy is now spilling over into cyberspace. I say it's a waste of our time to even be thinking or worrying about how to implement an infrastructure for ratings. In fact, building such an infrastructure could make later imposition of "mandatory voluntary ratings" (Orwell would be unsurprised) a greater likelihood. --Tim May THE X-ON CONGRESS: INDECENT COMMENT ON AN INDECENT SUBJECT, by Steve Russell, American Reporter Correspondent....You motherfuckers in Congress have dropped over the edge of the earth this time... "the sorriest bunch of cocksuckers ever to sell out the First Amendment" or suggesting that "the only reason to run for Congress these days is to suck the lobbyists' dicks and fuck the people who sent you there," ....any more than I care for the language you shitheads have forced me to use in this essay...Let's talk about this fucking indecent language bullshit.

3 2

MD5 weaknesses
by Bill Stewart 17 Dec '03

17 Dec '03

Perry Metzger posted a note to coderpunks about >A paper by Hans Dobbertin dated May 2 in private circulation has found >an easy method for generating collisions (not pseudocollisions as was >done in previous work) in the MD5 compression function. I was told >that this was public information. And somebody provided a URL to http://www.cs.ucsd.edu/users/bsy/dobbertin.ps The coderpunks discussion has been titled Re: Favorate flavor of hash? for which I suppose there are alternative interpretations :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: Complaints about spam are TRUE theft of services
by Ross Wright 17 Dec '03

17 Dec '03

On or About 19 Mar 98 at 15:31, Ian Briggs wrote: > >Spam is not crime, it's commerce. Shut up and hit that delete key, > > you fucktard. > > Its not commerce, its collect calls and fuck you. Fax bombing is > illegal. > > Unsolicitated e-mail of this nature will eventually also be. Is that *really* what you want? >> Not because its "dangerous" to the internet, there are a lot more > dangerous issues facing todays Internet, because organized ISP have > enough power to tell cluless lawmakers it is. Again, I ask: "Is that *REALLY* what you want?" You want stupid congressmen and women to make new laws about spam??? Are you nuts? *Really*, you want them sticking their small minds into the internet? *REALLY*?????? You and all your "organized ISP" brothers should just shut up and hit the delete keys, you bunch of fucktards. Thanks. =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://ross.adnetsol.com Voice: (408) 259-2795

3 3

hacktic.nl is down!!
by Jim Byrd 17 Dec '03

17 Dec '03

I just heard on IRC channel #scientology from Karen Spaink that hacktic.nl will be down as of 5/20 because of pressure from Scientology. I don't have any more details yet.

3 2

ENIGMA
by Carl Ellison 17 Dec '03

17 Dec '03

>From: danmec(a)inet.uni-c.dk >Date: Wed, 08 May 1996 13:05:24 +0200 >Subject: ENIGMA >To: cme(a)ACM.ORG > >X-Personal_name: Rag > >You may be interested in knowing that a 4 rotor U-boot ENIGMA is up for sale >at Sotheby's in London 30th May. > +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0