- cypherpunks-legacy - lists.cpunks.org

Re: Taking crypto out of the U.S.
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 25 Sep 1996 06:26:31 -0500 (EST), Adam Shostack wrote: >| >Theres a personal use exemption. Michael Froomkin's web page has a >| >pointer to it. >| What if your laptop gets "stolen"? Or you sell it for a plane ticket home >| after your wallet gets pinched? >You're required to report it to the Feds. RTFU. Yeah, but you can't be persecuted. So what happens if Joe-Cryptographer writes a *great* NSA-stumping crypto program - not for export - and it just happens to get pinched (The police might even recover it!)? Outside distribution w/o penalties... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY"

1 0

Re: A daily word of caution in reference Tim C[unt] May
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Wed, 25 Sep 1996 18:11:22 -0400, PhneCards(a)aol.com wrote: >Did you know this company is using your email address as part of >an unlawful email bomb? >I would advise you to write to them at cypherpunks(a)toad.com >and owner-cypherpunks(a)toad.com and advise them to stop >using your email address for this type of activity. Hmmmm... Unlawful email bomb? My understanding is that the entire problem of spaming, which you reportedly enage in (and admitted such in another message), is at best a grey area. Otherwise you'd probably be needing that legal department to defend yourself. I'd suggest you read up on the concept of a mailing list. cyperpunks(a)toad.com is one of those. If you send a message there, it'll reach all 1400 people who've actually signed up (note the difference from spamming? They *requested* it!). To me it looks like you got subscribed. send a message to majordomo(a)toad.com with the text of "unsubscribe cypherpunks" and you'll be removed. Speaking of which, remove me from the list you mentioned in your other message.... >It is illegal to use a invalid return email address. Really? I must have missed the E-Mail Regulations Act of 1996 . . . Speaking of which, Reply-to: adamsc(a)io-online.com (Chris Adams) must be a valid address; your inane message reached me, right? >Below is the letter that I received in my email box [Deleted] Hmmmm... The message I sent to the list actually got distributed to the list. That majordomo thingie must work, after all... # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY"

1 0

Re: A word on "emergencies" [WAS Re: Final Solution to the Crypto ]
by John Young 17 Dec '03

17 Dec '03

Michael Froomkin wrote: >Rather, my point is a simple one. The fact that the President has >declared an emergency here is primarily a technical legal event. It is >not a sign that martial law is about to be declared, that they are coming >to take you or your [fill in blank] away, or that anything fundamental has >changed. Multi-year emergencies in which the executive uses one statute >to compensate for the Congressional decision/failure to pass another >statute is not, I submit, a particularly telling sign of a mature and >healthy democracy. But this goes to large and gradual processes, not to >anything that suddenly happened. Thanks for the steady-hand reassurance. Your papers are balm. Was it not Hal's original ironic lament about the current charade -- that it's business as usual among the jaded insiders who are confident that they know how power really works. The disdain for public accountability -- cynical extension of declared emegencies well past their time -- is what breeds the desire of outsiders to protect themselves from insiders. Hence, the desire for crypto, especially the cryptanalytic kind that ventilates those privileged inside communications. The battle may be between cryptogologists and lawyers, it seems to me, the struggle for supremacy between privacy-protecting code and privilege-protecting secrecy. Hoary national security proclamations have become much more lethal munitions than cryptography, and it is these incitements that need ... what, X-rating? What can be done to supplant these thrilling, crowd- rousing proclamations of national threats -- ancient, vulgar strategems around the globe?

1 0

Re: AGA'S LIMITED VOCABULARY
by George A. Stathis 17 Dec '03

17 Dec '03

At 11:37 ðì 17/11/1996 -0500, aga wrote: >> about the use of technology to protect privacy. Perhaps you >> were confusing it with that other list you are on: >> alt.sex.yourmother. > >No, it is your mother I have been fucking. Pity! Aga should respong to this lady's needs FIRST! :-) BTW, (paraphrasing Speedy Gonzales)... I think she really fucks for money, but since you are an aga she'll fuck you for nothing! :-) >> > What year did you graduate from Law School? >> >> Irrelevant, but it was 1975. More importantly, though, when did >> YOU graduate from law school? > >1975. And my school was better than your school. > >I was the fucking class President in Law School. We >fucked on Library tables at Pitt. Where the fuck did >you go to school? I can see the beginnings of an... S/M cyber-romance in these lines. ROTFL!!! Aga should not forget to carry a... cane in his briefcase. The more arrogant they sound at first, the more submissive their fantasies are! (ALL masochists in fact). :-) Love and Jelly Babies George P.S. My first guess is that Sandy is a Piscean, and Aga is a Taurus. It would work out better with him being a Scorpio or a Leo, however. (My second guesses on Aga). My second guess on Sandy is that she's a Virgo, however. In this case avoid her at all costs! ROTFL!!!!

1 0

Strong Encryption for International Versions of Netscape
by Scott Weisman 17 Dec '03

17 Dec '03

FOR IMMEDIATE RELEASE: November 17, 1996 ANNOUNCING STRONG ENCRYPTION FOR INTERNATIONAL VERSIONS OF NETSCAPE JERUSALEM, Israel -- SecureScape Technologies announces the alpha release of its first product, SecureScape. This revolutionary program offers international users of Netscape Navigator the same strong encryption as that enjoyed by users in North America. All software encryption products developed in the United States are subject to export restrictions. Such exported software is subject to an arbitrary 40-bit key length, compared to the 128-bit (or greater) key length commonly found in domestic software. This weakened software is in certain ways inferior to no encryption at all, since it gives users a false sense of security. The Executive Order by President Clinton on November 15, which modifies U.S. Government policy on export restrictions, still requires requests for export permits to be considered on a case by case basis. Furthermore, it is very likely that strong encryption products will be granted export permits conditional on key-escrow or other compromise arrangements, because the Executive Order states, "the export of encryption software . . . must be controlled . . . such software shall not be considered or treated as 'technology'." Implying that encryption software is still considered a form of munitions. The irony, of course, is that strong encryption has been widely and easily available outside of the U.S. for years. SecureScape was developed using the freely available SSLeay library, developed by Eric Young of Australia. SecureScape Technologies was founded by Scott Weisman, a software developer residing in Jerusalem, to develop and market Internet security products. The company is seeking investors interested in a strategic partnership. The SecureScape home page is located at <http://www.SecureScape.com/secscape/>. SecureScape currently works with Netscape versions 1.1 or later on the Windows 95 and Windows NT platforms. CONTACT: Scott Weisman P.O.B. 31194 Jerusalem 91311 ISRAEL sweisman(a)SecureScape.com © 1996 Scott Weisman - All Rights Reserved. Netscape and Netscape Navigator are trademarks of Netscape Communications Corporation. Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation. SecureScape uses software developed by Eric Young (eay(a)mincom.oz.au)

1 0

RE: The Utility of Privacy
by blanc 17 Dec '03

17 Dec '03

From: Hal Finney You suggest that the main motivation which someone might have for protecting privacy is that they are engaged in some illicit activities: page 45: "Why should I really care if someone sees this? I have nothing to hide." ..................................................... This statement from David Brin impressed me with the consistency of a certain way of thinking that some people have: "I think that having a minimum standard of living is good, therefore everyone should be coerced to contribute to the general welfare." On the other hand, "I myself have nothing to hide, therefore no one should be concerned (read: permitted) to do so." The issue for them in regard of what everyone should/should not do, is whether anything is logical as far as they themselves can see - and the logic revolves around what they themselves think is right; the extent of their own vision is considered sufficient to determine the parameters of everyone else's life & actions, and therefore sufficient cause to have their measures imposed over all. But this letter of Hal's brought up an important point: that even if a person has nothing to hide, it is not the openness or closedness of information which is of concern, but the *responses of others* to that information. When an individual wants to live a free & open life, they expose themselves to dangers. In order to be free to roam, they must have a way to protect themselve from all manner of destructive influences - the weather, predatory animals, vicious strangers, etc. There must be a way to protect what is one's own in order to preserve it. If it was easier for everyone to defend themselves against attacks on their person or reputation, maybe there would not be as much concern about privacy. Perhaps if a person could "get away" from others, could continue to have a normal life without too much disruption, once some exciting bit of info was out in public, if they could maintain command over the effects upon their life despite living in a fishbowl, then no one would worry quite as much (although the principle of personal control over one's property remains the same). But in the meantime, we have but few ways to protect ourselves under the centralized arrangement for protection (police, defense agencies). Anyone in a government position is aware of how their public expressions can result in public outcries against them; the secret agencies protect their information files because of what "the enemy" would *do* if they found out about these - even if the agency itself does not consider its activities immoral. If Information is like munition, privacy is like defense - it is a form of self defense. .. Blanc

1 0

Re: Giving Kill Files a Workout...
by Dave Hayes 17 Dec '03

17 Dec '03

Dimitri Vulis writes about unwanted noise: > They feel compelled to silence it altogether. They claim altruistically > that they don't want the noise to bother anyone else, such as the clueless > newbies who keep subscribing to this mailing list and don't know how to > use mail filters. (Sandy Sanford's concern for them was soooo touching...) Misplaced altruism is one of the primary causes of social injustice, authoritarian regimes, and security measures. It is not possible to be "altruistic" until one realizes that one doesn't know what true "altruism" is. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet Don't follow in the footsteps of the ancients, seek what they sought.

1 0

Re: Members of Parliament Problem
by ph＠netcom.com 17 Dec '03

17 Dec '03

At 1:39 PM 11/17/1996, Simon Spero wrote: >On Fri, 15 Nov 1996, Rich Graves wrote: >>Peter Hendrickson wrote: >>> There are times when one wishes to speak anonymously, yet speak >>> as a member of a group. >> You either need to trust a shared server to know and then blind your >> identity, or trust the people with whom you share a secret key not to >> give that key to non-group members. > Why not use blinding for obtaining the certificate? > Create a number up public/private key pairs, blind them, then do the > cut-and-choose thing with the security officer. He signs the blinded key, > then returns it. Unblind the remaining pubic key, and you've got a public > key with the appropriate signature on it. Okay, this would work. But, it requires that all (or at least many) of the Members of Parliament cooperate. If not, then the security officer will be able to make very good guesses about who is speaking. Parliamentarians may not cooperate for a variety of reasons. They may not wish to be attacked by terrorists for the words of others. They may believe that cowardice is not to be encouraged. They may not believe in anonymity. It might be too hard for them. What I would like to see is a method which relies only on published public keys and no other cooperation from the people who are (more or less) being used as shields. This may be impossible. (A number of people have posted references to other ways of doing this. I have yet to track down the references they gave so I don't know if any of them fit the bill.) Peter

3 2

Re: RFC: A UNIX crypt(3) replacement
by Joshua E. Hill 17 Dec '03

17 Dec '03

> This is backwards logic; when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. hmmm... Now that _completely_ depends on the system. Now for the system I administer, the level of security really isn't _that_ high (on the grand scale of things). It is, however, high enough that I inconvenience the users with a pro-active password guesser, and passwords that expire occasionally. I suppose that this is a _minor_ inconvenience, but it raises the level of security a very large amount. On a less mundane system (one run by the government, say), security is only _slightly_ less important than being able to use the system in the first place. :) On this type of system almost any inconvenience is worth the cost. > > You have previously said that the passwd file should not be available > > for public consumption. Though this is certainly true, it does not > > hurt that even if the passwd file is available, nothing particularly > > useful can be done with it. > Hince you use pseudorandom password generators and crack. If you count on > somebody not being able to preform an opperation quickly, they'll usually > prove you wrong. whoa... didn't you just say: > when security begins to hender in the > functionality of the system, the security needs to be gotten rid of. I think that psedu-random password generators would almost certainly "hinder in the functionality of the system"... :-) I want to make it so that users can use passwords > 8 characters, and I want to use something a bit better than FreeBSD's solution. Whether or not this is necessarily the One True Way (TM) to security, it will increase security. I'm not saying "Hey everyone. Here is a spiffy new password system that will make your entire system completely secure!" I'm saying "Could everyone please look at this algorithm that I'm thinking of using. Could you please comment on it, so that I can make it better." That's it. All questions on whether or not passwords should shadowed, crackable, not crackable, or consisting only of the letter "e", aside. Is this algorithm secure, and if not, why not. Joshua > --Deviant > The Macintosh is Xerox technology at its best. I very much like your signature... very nice... -----------------------------Joshua E. Hill----------------------------- | Allen's Law: | | Almost anything is easier to get into than out of. | -------jehill@<gauss.elee|galaxy.csc|w6bhz|tuba.aix>.calpoly.edu--------

2 1

Re: Censor John Gilmore -- EFF is a disgrace!
by Dave Hayes 17 Dec '03

17 Dec '03

[Multiple CC's trimmed, I don't think anyone at msn.com cares...] > #From Phrack 49, file p49-09 published this month: ... > File 09 of 16 > by Dr.Dimitri Vulis (KOTM) > A Content-Blind Cancelbot for Usenet (CBCB) ... > And what follows, is Dr. Dimitri, defender of freedom of expression, > champion of the anti-censors on the net, posting code to the world to > engage in exactly those activities that everyone has been ranting about > as being so utterly "horrifying (forged cancellations etc)" as it > were. You call yourself on cypherpunks, and you blithely assume that a Phrack author actually signs his real name? Either I thought you guys were *real* hackers and you aren't, or this is a very funny troll. ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet "Better to be safe than to be sorry" is a remark of value only when these are the actual alternatives.

3 2