- cypherpunks-legacy - lists.cpunks.org

Info on Netscape's key escrow position
by Jeff Weinstein 17 Dec '03

17 Dec '03

I had lunch with Jim Clark today, and explained the furor that was currently going on in cypherpunks and elsewhere. After lunch he sent me the e-mail that I've attached below to pass along. I think the gist of it is that if governments require key escrow, we will have to do it in order to sell our products with encryption into those countries. We've actively lobbied against the government's proposal through our participation and support of industry efforts by the ITAA, BSA, SPA and others. Next week we will be sending two representatives to the NIST key escrow conference in DC. In preparation for that meeting we have been formulating an official company position on key escrow and export restrictions. Phil, myself, and other folks with cypherpunk leanings are involved in writing the policy statement. We are planning on taking a firm position against the government's key escrow proposals. Some time next week we will be posting our statement publicly, and will welcome your comments on it then. After the NIST meeting we will also be talking to folks in congress and the white house about our position, looking for help in getting the current export limitations removed. We will also be looking for help in getting the government's position on export controlled FTP sites clarified so that we can make the US version of the Navigator with 128-bit crypto available for download by those people who are legally allowed to use it. We don't have any plans to stop doing separate US and export versions of our software. As long as our customers want strong crypto and the government lets us sell it, I think we will keep doing it. --Jeff Jim Clark wrote: > > I made some pragmatic comments. > > I said that if we are to use this encryption technology in business, we must > have a better solution than to limit keylength or put keys in escrow. All > governments of the world have a valid concern about terrorism and other > activities of concern to the security of their nations. All of them will > continue to restrict our ability to provide products to their markets unless > we build in some mechanism that allows them to legally access > information that is in the interest of their national security. (We obviously > cannot be involved in determining what is legal by the laws of that country.) > This is not just a US government problem. Until recently, France did not even > allow us to sell products with 40-bit keys, much less 128-bit keys. > > A lot of ordinary citizens are rightly concerned about their own privacy. I > am one of them. I do not want the government to snoop on me, but in fact the > government, through the FBI, can now tap my phone without my knowing it by > simply getting sufficient evidence that I am conducting illegal activities, > then presenting this evidence to a court to get permission. I have no say in > the matter. > > If we as a company were to take the position that in no case will we allow > a government to get access to our encrypted messages, or refuse to allow > key escrow with our products, the governments of the world will quickly put > us out of business by outlawing the sale of our products in their countries. > The fundamental issue is how do we accommodate the requirements of governments, > while protecting our rights as citizens. > > None of this represents the position of Netscape with respect to what we > will do. But if we do not come up with a solution to this problem that is > acceptable to each government, we will not be able to export our products, > except with a short key length (e.g. 40 bit keys), and that will not be > acceptable to corporate customers in other countries. They will create their > own solution, and we will not be able to sell to a larger world market. In > fact, we could even be ordered by our own government to establish a key > escrow system for its use inside the US. > > Ironically, anyone in the US may import unbreakable encryption technology from > another country -- we just cannot sell it back to them. No one ever accused the > government of being rational. > > I chair an industry group called the "Global Internet Project", with members > from almost twenty companies, including companies from Asia and Europe. This > was the central issue we all agreed upon this morning, and we are putting > together a policy statement whose purpose is to educate lawmakers on the > importance of quick resolution of this matter. > > Thanks for your concern. Let me know what you like and don't like. Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

6 6

update.250 (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message:

1 0

Re: ALERT: On Monday, call Congress to stop Big Brother amendment!
by Shabbir J. Safdar 17 Dec '03

17 Dec '03

At 12:27 PM -0400 9/19/97, Carl Ellison wrote: > -----BEGIN PGP SIGNED MESSAGE----- > > At 02:47 PM 9/18/97 -0400, you wrote: > >3. Say that you're calling to urge the Congressman to pass SAFE (HR695) > > without amendments. > > Does that mean Goodlatte's original bill, or the bill as amended already by > the National Security Subcommittee? > > I believe you should be more specific in your instructions -- suggesting > that people ask for the bill to be voted against unless it is exactly as it > was prior to the Natl Sec involvement. As each committee gets their hands on the bill, they do their own changes to versions and then they are all merged later before going to the floor. So, no, we're not asking people to urge passage of the SAFE bill with all the awful National Security amendments. It's a good suggestion, which we'll make clearer next time. -S

1 0

Re: Info on Netscape's key escrow position
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"jsw(a)netscape.com" "Jeff Weinstein" 2-DEC-1995 02:26:13.63 I had lunch with Jim Clark today, and explained the furor that was currently going on in cypherpunks and elsewhere. After lunch he sent me the e-mail that I've attached below to pass along. I think the gist of it is that if governments require key escrow, we will have to do it in order to sell our products with encryption into those countries. > If we as a company were to take the position that in no case will we allow > a government to get access to our encrypted messages, or refuse to allow > key escrow with our products, the governments of the world will quickly put > us out of business by outlawing the sale of our products in their countries. > The fundamental issue is how do we accommodate the requirements of > governments, while protecting our rights as citizens. > > None of this represents the position of Netscape with respect to what we > will do. But if we do not come up with a solution to this problem that is > acceptable to each government, we will not be able to export our products, > except with a short key length (e.g. 40 bit keys), and that will not be > acceptable to corporate customers in other countries. They will create their > own solution, and we will not be able to sell to a larger world market. In > fact, we could even be ordered by our own government to establish a key > escrow system for its use inside the US. ---------------------- I believe that the central question at hand is whether Netscape will incorporate mandatory GAK into any of its products if you have an economic (governmental purchase) rather than physical (governmental threat of violence) reason to do so. I would hope that the upcoming statement will clarify this position, and in the proper direction. -Allen

3 3

Re: [NOISE] Barring access to Netscape
by Robert A. Rosenberg 17 Dec '03

17 Dec '03

At 15:41 12/1/95, Herb Sutter wrote: >At 14:26 12.01.1995 -0500, Robert A. Rosenberg wrote: >>If you want to see one way of locking out Netscape users, check out this >>URL which points at a Web Page that will not allow access by Netscape Users > >Just a personal note... while I am strongly in favour of security, this >seems rather petulant and knee-jerkish. > >JeffW: Please add a configuration option to let users override the "Mozilla" >ident, so that they can continue to use Netscape at all sites. I personally >won't use the override, though; if a site is going to insist on trying to >frivolously exlude me as a user based on nothing but the browser I choose to >use, they aren't serious anyway. > >>(the guy is ticked off at them trying to establish their own standards) - > >The _market_ establishes standards (been proven time and time again). His >reaction sounds pretty childish to me, but YMMV... > >Herb I am not advocating his gripe (or the security question) - My message was posted to provide an example of how to treat Netscape users special by locking them out IF you have a need/desire to do so (which was what was being requested).

1 0

Re: Getting a copy of the Jim Clark speech
by Alan Olsen 17 Dec '03

17 Dec '03

At 09:47 PM 11/29/95 -0800, you wrote: >At 09:43 PM 11/30/95 -0600, Frank Stuart wrote: >> I'm working on an "obnoxify" program to convert >> normal html documents into documents that look >> normal to non-netscape browsers, but are too painful to >> read with netscape (</BLINK>, <FONT SIZE=1>, etc.). >> I think tomorrow evening would be a good time to decide >> whether or not to distribute it. > >Is there any way one could set up a dirty pictures web >page in such a fashion that it would be difficult, painful, >and impractical to get at the pictures through that page >with a netscape browser? It would not be very hard. You just need to have all connections go through a CGI script first. There is a variable that reports the client to the server. Just bounce them to an error if the variable starts with "Mozilla". Also, you do not need access to the server code to do this if you are using NCSA. There is a way you can force execution of CGI scripts from your local directory using an .htaccess file. (It requires using an "addtype" command to enable the cgi parsing.) I will have to dig out the exact mime type required. If I get some working Netscape bounce code, I will post it here. (Actually I want one that bounces AOL users to the Mr. Rogers home page on pbs.org.) | Poly wants *more* than one cracker! | alano(a)teleport.com | |"It's only half a keyserver. I had to split the | Disclaimer: | |other half with the government man." - R. Rococo | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | <fnord> |

1 0

Questions
by rmarquis＠umich.edu 17 Dec '03

17 Dec '03

Hello. I was wondering if anyone would be able to help me out. I am writing a research paper and I need some interviews for it. If you could answer any of these questions about security, I would greatly appreciate it. Thanks for your time. --Bob Marquis Please send responses to rmarquis(a)umich.edu - How can PGP help secure something like e-mail? - Are there any encryption schemes which are "unbreakable"? - What would someone need to do to send an e-mail message which cannot be read or altered by anyone else, or is it not possible? ____________________________________________ Robert Marquis, Jr. University of Michigan - Dearborn e-mail: rmarquis(a)umich.edu www: http://www.umd.umich.edu/~rmarquis

2 1

Re: Info on Netscape's key escrow position
by James A. Donald 17 Dec '03

17 Dec '03

At 11:01 PM 12/1/95 -0800, Jeff Weinstein wrote: > > I think the gist > of it is that if governments require key escrow, we will have to do it > in order to sell our products with encryption into those countries. Jim Clark wrote: >> But if we do not come up with a solution to this problem that is >> acceptable to each government, we will not be able to export our products, >> except with a short key length (e.g. 40 bit keys), and that will not be >> acceptable to corporate customers in other countries. I read it as saying: "Let us help the government invade the privacy of our customers, so that the government will do us some favors in export licensing", rather than "Well if they stick it to us at gunpoint, we will submit." I would appreciate some further "clarification". --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

Re: Info on Netscape's key escrow position
by tcmay＠got.net 17 Dec '03

17 Dec '03

I say "Hear, Hear!" to Hal Finney's message about why we should be mad at Netscape and Jim Clark. (Although I still have a bit of hope that Netscape and Clark will see the importance of not simply giving up.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Jim Clark, "Mr. Bubble"
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Dan Weinstein: >You have just proven your self to be a hypocrite. If you expect of >others more than you expect of your self, you need to reevaluate your >own life. If you are not willing to risk your life, fortune, and >reputation on your beliefs, how can you expect Mr. Clark or anyone >else to do the same. And you've just proven yourself to be "a little bit slow"; hypocrites, at least, can change their ways. This discussion is about the effects that Jim Clark, someone who is assessed as a billionaire and who heads a Wall St.-bedazzling multibillion-dollar corporation, can have on USG crypto policy; yet you would get into a tawdry comparison of "personal failings." I will continue not to trumpet the specifics of any crypto-promoting illegalities which I may or may not have engaged in, and I'll thank you to do the same. Hieronymous >"I understand by 'freedom of Spirit' something quite definite - >the unconditional will to say No, where it is dangerous to say >No. > Friedrich Nietzsche BU was right: there's gotta be a self-help book called something like "Learning to Say YES!" that would provide you with a more appropriate .sig. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQBVAwUBMMJeX73g0mNE55u1AQEiqAH+IXva02/4rIoegkaQEUzF9X/2nTQhGKFm TEO6RjrN1vuegeUtBs3oNfvs4bq6Rxrnras+9EJfVCaxZam51dWDRQ== =pRWz -----END PGP SIGNATURE-----

1 0