- cypherpunks-legacy - lists.cpunks.org

Re: Effects of S.314 (Communications Decency Act)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:02 PM 2/8/95, Robert Rothenburg Walking-Owl wrote: >Of course geographic community standards are problematic too with >telecommunications since postal inspectors from Tennessee can call >up adult bulletin boards in California... This reminds me of a joke I finally grew tired of, prescient though it may have been given current legal events in Tennessee: It's illegal in Cambridge to smoke in Boston... Most non-smokers, especially the reformed-smoker non-smokers, didn't think that that one-liner was very funny. Most small-l libertarians had a hoot or too about it though. (Just like the punchline about how many radical feminists it takes to screw in a lightbulb [A: That's really *not* funny.]) I guess I'll sit down now... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

[CRYPTO] web-of-trust, signatures, and anonymity
by Ted Garrett 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ok, People... Let's say that I receive a message via a mailing list from an entity. This message is signed with a PGP public key. Being that I am interested in some of the ideas proposed by this entity, I respond to the message, but I fat-finger my mailer and it sends out the message unsigned. However, my .signature is reasonably automated and my public key id is included there. I obtain the the public key associated with the original entity from the keyservers and the signature verifies, but the key on the servers is not signed. Concurrently, I receive a message in response to a message I sent to this entity, which comes to me encrypted with my public key and signed with the private key paired off to the public key I obtained for this entity from a keyserver. Being a believer in anonymity, I feel that whatever person, machine, or thing which placed the key on the keyserver and kindly responded to my message is reasonably expected to be the owner of the private key associated with the public key I obtained. Is this a fallacy? Am I wrong to sign the public key I got from the keyserver and return said key to the address purported to be the entity of ownership? What the entity does with the signature is, in my opinion up to it. Is it unrealistic to assign the probability of two entities being able to generate signatures for the same public key as close to zero? (consider that this is a 2047 bit key) Am I opening myself to attacks? By this, I mean to ask whether or not MY key is in any way possibly compromised in the exchange described. I keep a separate and 'unpublished' keypair to be used for physically met individuals. The public key of this keypair is NEVER sent by any means other than physically. This key signs only the keys of the people I meet in person or have extensive telephone conversations with. While people who recieve the signature of this key also get a copy of it, I only distribute this key to those I trust not to disseminate it further. - --- "Obviously, the US Constitution isn't perfect, but it's a lot better than what we have now." - Unknown PGP key id - 0xDEACDFD1 - Full key available from pgp-public-keys(a)pgp.mit.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: cp850 iQEVAwUBMowSJc1+l8EKBK5FAQEg2Af/agcalrlyDK+Ku+Qq7cnODOJjFIcsDAjh LLuA6KG2DeDQUiAH72uL5WgdiHQaZroAhqRsFGDic3zmc0YGDQkI4W2KTTsVFi08 ubcX9JCnOGuDWxLIwvBdCX/FxDsPyrhTeEUNjjkXp+5k+BdxzLTfbUgbnLgM/BGJ wD3Bq+evmTr86ul0SLUs3KL5h0488LhalPYTKtm9hdO9f3K01kz5W+FLUK3lXKJb YH2e2Ob2Nr/uSH6ElluSMVGtU09i+s40uloqokzAyB7NuTStSCupqUw0nHQKFIY7 Or8uwmZF6c7ivtacstViZ7/6xM0km7wmoyWsee3gxe63LH/Mqr25/A== =0HFl -----END PGP SIGNATURE-----

1 0

It is getting easier
by Lucky Green 17 Dec '03

17 Dec '03

[From an infowar article on the list] >(ENN) A free service called "Flight Trax" is now available on the >World-Wide-Web. >This new information resource allows one to track the progress of any >domestic airflight within the contigious 48 states. > >Call up: http://www.amerwxcncpt.com/ with your favorite internet >browser. The program will ask you for the flight number, the airline, and the destination airport (using the FAA designated three-letter code). >The program will >then show you the kind of aricraft used, its flight's path, its location >on that path (accurate to within two or three minutes), and its expected >time of arrival at its destination. It will not tell you why it may have >been delayed. >The information is provided by Flyte-Comm of Ft. Lauderdale, FL, which >uses data from the FAA to produce the flight estimates. Might be prove If I remember correctly, some of the newer transponders used on commercial aircraft actually transmit GPS data back to the controller in real time. I wonder how long it will be before the FAA will include such information in their database. "To obtain the position of any passenger flight in the US within 10 meters, click here." -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

1 0

Denning and Clipper...
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>> One thing this shows, even if the application of the technique turns out >> to be too difficult to be practical, is that Dorothy Denning's evaluation >> of the design was worthless. That team should have found this themselves. >> No wonder she was trying to play it down in the NYT. > >It was my understanding that Denning was just looking at the Skipjack >algorithm, and not the clipper unit as a whole. I wouldn't be too quick >to condemn her on this point. Of course, Dorothy Denning could simply say, "Gosh, the Blaze result shows how to make Clipper _more_ secure for the average user. Now they don't have to worry about the government. I stand by my assessment that it is secure."

1 0

Re: The drumbeat against anonymity continues....
by rparratt＠london.micrognosis.com 17 Dec '03

17 Dec '03

Allen B. Ethridge wrote: > The technology to reduce cellular fraud, through encryption and > authentication, is easily implementable, but for some reason neither > the operating companies nor the manufacturers want it. > > In contrast, European cellular (GSM) products do implement > encryption and authentication (at least as far as laws allow). > GSM mobile phones can be equipped with a slot for a card that > identifies the subscriber. Billing is based on the subscriber's > identity, not the phone's. Actually, all GSM phones use a smart card to ID the subscriber. There was at one point the idea that this card would be useful for other things, e.g. you could plug it into a fixed line phone and have that phone take on your personal number, or even use it as a payment card. However, the desire for ever smaller phones means that the credit card form factor is dying out for SIM cards, and one doesn't want to keep popping a 0.5" x 1" mini-SIM out of the bowels of the phone. GSM uses less than strong encryption, by the way. I forget the technical details, but it is of the level that governments can fairly readily crack, but beyond the reach of most private organisations. (So no more 'Squidgy-gate'). It would, however, be quite feasible to add additional second stage encryption to phones (since the dataflow is digital point-point). I wonder if Nokia, a Finnish company well outside the scope of COCOM, might offer a feature like this. Incidentally, is there likely to be any adoption of GSM in the US in the near future? -- Richard Parratt

1 0

Re: One Big Telecoms Company
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:02 PM 11/14/96 -0800, Dave Del Torto wrote: >Um, a _better_ one, now that government monopolies are largely out of the >way, leaving significant infrastructure for them to use? There's this one >little company called MCI, see, and there's this _other_ little company >called BT, and... There are now 150 Long Distance telephone companies in the US vs 1 when I was a kid. There are now 5 or 6 broadcast and 150 cable TV networks in the US vs 3 when I was a kid. There will soon be 5 cellular and PCS companies in NYC vs 0 when I was a kid. There are now 6000 ISPs vs 0 when I was a kid. DCF

3 2

No Subject
by John Young 17 Dec '03

17 Dec '03

Declan, Cypherpunks does not seem to me to be anything like the well- regulated lists you ascribe to Prof Volokh. Could you, with Professor Volokh, expand on the application of "editorial control" on "unmoderated" lists? (See Netly below) As well as amplify "the power to kick folks off a list ... if conversation veers too far from the list's charter." (See your quote below) Isn't this power the black heart of free speech racketeering? And what makes the glands of secret authoritarians thrill with benevolent suppression of assent on behalf of the disorderly, fuzzy-minded citizenry? Media moguls and list runners share commonalities, to be sure, but I wonder if it's not cruel to compare John Gilmore to Professsor Volokh, and both to, say, Rupert Murdoch. -------- [Netly News] Eugene Volokh, a law professor at UCLA, runs a number of mailing lists and has kicked people off to maintain better editorial control. Volokh says that the most valuable publications are those that exercise the highest degree of editorial control. [Your post of 11-13] In my experience, and I've talked about this at some length with Prof. Volokh who runs a number of lists himself, the best and most valuable discussion lists are those that are unmoderated but have a list owner who has the power to kick folks off a list and can try to steer the direction of a conversation if it veers too far from the list's charter.

3 2

Re: Mandatory key registration
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 1:56 AM 7/19/95, rick hoselton wrote: >In the event of legally required key registration, >I would like to continue to use PGP. My private RSA >key is my own business, so I would like to comply >with the requirements by registering my IDEA keys >instead. There are approximately 2**128 of them, and >I'm not quite sure which one will be used next, so >can I just register ALL of them? Can I do this on-line? >If all the cypherpunks use the same key set, must we each >register all of them, or will a single list do? It seems likely to me that an actual GAK system will require some fee per key. For example, one might have to send in a form, maybe a diskette, and a $25 per key fee for "handling costs." This is the way automobile registrations are handled (and they have become a "revenue source"..I pay $450 per year to register my truck!!!). This makes trying to register 2^128 keys rather expensive. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: Distribution of FAQ to CompuServe, American Online, etc.
by jazz＠hal.com 17 Dec '03

17 Dec '03

I considered suggesting that I strip Tim's email address out of the text; then I realized there are probably dozens of copies of it scattered through the document. Even if the Cyphermonicon were written by Sy Ferpunq and not by Tim, there are enough email addresses in the body of the document that this wouldn't save him from email. Completely sanitizing the document with respect to contact info (i.e. using names/nyms only and no addresses) would be something of a project. And it still wouldn't help. The only counterpoint I could make is that CompuServe users are unlikely to join cpunks (too much mail == too much money) and the service is illequipped to help a member find an internet mail address for a person given just a real name. Sanitization might be enough in that environment. Jason

1 0

Re: "Hey Phil! Stop telling people *not* to use PGP!"
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 02:00 PM 7/19/95 -0500, Robert A. Hayden wrote: >> I am fond of saying that we PGP enthusiasts have two choices ahead of us >> within a couple of years: either 5,000 enthusiasts using PGP with >> MAXIMAL SECURITY at all times, or 5,000 enthusiasts with MAXIMAL >> SECURITY and 10,000,000 computer-illiterate e-mail users using PGP with >> push-button interfaces and multi-user remote systems. >I said it last week, and I'll say it again. From a sociological >standpoint, it's those 10,000,000 computer-illiterate e-mail users that we >need to focus all of our efforts towards. Those 5,000 literate people we >really don't have to care about. But there are two different classes of issues here - the convenience-only issues, which can be fixed with bells and whistles and GUIs and audio-enhanced-RTFM-buttons, and the security-related issues. For security, there are three classes of users: 1 - folks with standalone systems and dial-up mail - no problem This is a _lot_ of users - AOL, Compuserve, etc. 2 - folks with single-user systems on networks - they need to make sure they've got PGP installed right (relatively easy, with local disks, but fancy install widgets may help), but beyond that they've got to know that PGP is only as secure as their machine and network configuration. Mostly ok, and to the extent it's not, they've got other serious problems. This is also a lot of users. 3 - folks with shared machines - these folks (mostly Unix users and college students, plus people who have web-space they need to telnet to, like me) do need to know their limitations, and currently have the most problems with convenience, having to haul files back to a secure machine to encrypt securely. The first step is education - manuals that say "Don't Panic Unless You Need To Be Paranoid" instead of "Panic Immediately", that can make them aware of the risks and tradeoffs. It's about two pages of well-written stuff, if someone wants to write it. The next step is either building convenient tools to help them with encryption, or building convenient installation scripts for the tools that already exist (e.g. mail, or scriptable terminal emulators which can automate a lot of the hauling around.) The big payoffs are for groups 1 and 2, but a lot of the technically savvy people who read manuals and have to convince system administrators to install stuff are in group 3. So this is basically a writing job, plus talking the PGP 3.0 people and maybe Phil into including the discussion with the manuals. Remailers, btw, are in this class, since they need to leave their passphrases out in relatively unprotected shell scripts. I used to run PGP on a diskless workstation (at least I was one of the people with the root password :-), but I was aware of the risks. I'm now using it both on my Netcom+Eudora+PrivateIdaho system and on the machine where I have web space, which I have to telnet to across Netcom. I take care of the trust problem there by using a short key with a big ugly "untrustable" string in the user name, and using S/Key to log in; if I had an encrypted telnet to run on both ends I'd probably want to use it, so I'm watching the Stel and other new stuff coming out. Bill Stewart -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: You can get PGP by anonymous ftp from ftp.ox.ac.uk iQBVAwUBMA4HvfthU5e7emAFAQFrMwH9Hh1oYQKvsuV/IyVUskv2aZbmuh8fXQgK XpSpucrJV27tlFbjIDVqmapMR77arZVOm2Hs0/NTB2uT2jDG1r5+Lw== =fRtS -----END PGP SIGNATURE----- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0