- cypherpunks-legacy - lists.cpunks.org

Helping the Crypto-Clueless
by Bruce Baugh 17 Dec '03

17 Dec '03

While talking with Alan Olsen about the impending Telecommunications Decency Act, a thought struck me: one of the groups that's really going to be hurt by this is pagans. Me, I'm one o' them Christian types; it's my anarchism that'll get me on lists. But insofar as cypherpunks have contact with pagans (and aboriginal American groups and the like), probably there are a lot of folks who should be ramping up for privacy right away. Bruce Baugh bruce(a)aracnet.com

2 1

More on crypto from Bonn
by Donald Weightman 17 Dec '03

17 Dec '03

Another story in today's FINANCIAL TIMES http://www.FT.com describes a "clash" between USCommerce Sec'y Daley and German economic minister Rexrodt on strong crypto. Because the speakers' choices of words are interesting, I quote from the FT article by Ralph Atkins: On coding technology, however, Mr Daley insisted, "there are certain legitimate areas where governments have to be involved". Encryption should be used to protect credit card numbers or detailed contracts from being read. But, he went on: "We must also make sure national security is safeguarded by applying those rules sensibly, so that potential terrorists or other sophisticated criminals cannot hide their work." Mr Rexrodt hinted the European ministers regarded US policy on exporting encryption technology as discriminatory. He backed "strong" encryption procedures, which he said were "offering users the only protection that they have, the only certainty, that their data is not going to be divulged or misused on open networks". Mr Rexrodt was backed by Mr Ron Sommer, chairman of Deutsche Telekom, Europe's largest telecommunications group, who said: "Anyone who uses the point of public security as an argument in this [encryption] issue has not realised or acknowledged that any such legal requirements stand in the way of the further spread of electronic commerce." Questions for the reader: What's a "potential" terrorist? (Is the occasional apparent c'punx paranoia justified?) How is the US export policy discriminatory? Why is DT coming out on this issue? Who are their strategic partners for ecommerce among US telecomms? (I'll have to ask around about that ...) cheers ......................................... Donald Weightman dweightman(a)radix.net

5 4

Re: RC2 Source Code - Legal Warning from RSADSI
by Patrick Lamb 17 Dec '03

17 Dec '03

At 11:06 2/1/96 PST, you wrote: > >WARNING NOTICE > > It has recently come to the attention of RSA Data >Security, Inc. that certain of its confidential and >proprietary source code has been misappropriated and >disclosed. Despite such unauthorized use and disclosure, >RSA Data Security reserves all intellectual property rights >in such source code under applicable law, including without >limitation trade secret and copyright protection. (Remainder of warning elided.) Does this mean RSADSI is claiming copyright infringement on the RC2 source code? Pat -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzACleQAAAEH/2+41W3bZPuWU1gv6A0bq3a57bgCiCAbU1QY41f+NI1I8i/+ a/L314RIpCR0iCZhsNMHNI9rVovsbmOQE4Cf9YYL3cClUoE2VAsLOi9LAjlN8qYc kmAqpsGQ39eaKrnlC/0lxJtFZgypT4m9UIsTU986y3gyy+ZTWwxtbDaLBEdsTiH/ e+zosoBiXmwWYY1n+5yvaKLGMUwa20AKdoRCUgqhJQpkW0nAvItU6WhaqxwH6JXp KCNsuP6k8FBmcKZfSSvUphSOIJnARAq9K9UPhj5BeAy1vKZ416jfgeYQUTxHQOMT rTiQOYR/oAR35gBpGYg6p1lu6Ma5eDPtpBPadUUABRG0IFBhdHJpY2sgTGFtYiA8 cGRsYW1iQGlxdWVzdC5jb20+ =DZzp -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Schlafly on crypto
by Chris Adams 17 Dec '03

17 Dec '03

On 14 Aug 96 09:11:30 -0800, bdolan(a)use.usit.net wrote: > Amendment guarantees our right to speak in public but not in > private. It would be just as ridiculous to say that we have > freedom to speak in words that the government can understand, but > not in words the government can't decipher. This definitely does beg the question of what the FBI would ask us to do if, for instance, the drug dealers started hiring Navajo speakers to play "Code-talkers" over a GAKed phone... | Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! | http://www.io-online.com/adamsc/adamsc.htp | Autoresponder: send email w/subject of "send resume" or "send PGPKEY"

1 0

Dr. Dobbs Dev. Update 1/5 July 94 & Schneier
by NetSurfer 17 Dec '03

17 Dec '03

Once again DDDU has an encryption News Brief re the Standards & clipper, and Bruce Schneier has an article on Eurocrypt '94 with some highlights from the same. As he is on the list (yes?) perhaps he might upload it here... -NetSurfer #include standard.disclaimer >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>> == = = |James D. Wilson |V.PGP 2.4: 512/E12FCD 1994/03/17 > " " " |P. O. Box 15432 | finger for full PGP key > " " /\ " |Honolulu, HI 96830 |====================================> \" "/ \" |Serendipitous Solutions| Also NetSurfer(a)sersol.com > >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>

6 5

Censorware Summit Take II, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

*********** http://pathfinder.com/netly/opinion/0,1042,1173,00.html The Netly News (http://netlynews.com) July 16, 1997 At The Censorware Summit by Declan McCullagh (declan(a)well.com) If you host a web page or publish online, be warned: soon your site might become invisible. Search engines won't index it and web browsers won't show it. Unless, that is, you agree to attach special labels to your web pages identifying how violent, sexually explicit, or inappropriate for kids your site is. This was the thrust of today's White House censorware summit, where President Clinton sat down with high tech firms and non-profit groups in a private meeting to talk about pressuring the Net community to make cyberspace childsafe through labels. "We need to encourage every Internet site, whether or not it has material harmful to minors, to rate its contents," Clinton said after the meeting. Vice President Gore was there, too, giving a quick demonstration of how labeling works. Spooked by the threat of a revised Communications Decency Act, high tech firms are seriously backing labels for the first time. Joining Clinton in coercing Internet users and businesses to label all their web pages were Yahoo, Excite, and Lycos. "I threw a gauntlet to other search engines in today's meeting saying that collectively we should require a rating before we index pages," Robert Davis, the president of Lycos, told me. Translation: if you don't play ball, and label your site, search engines will ignore you. As will future users of Microsoft's Internet Explorer browser. The next version of IE will default to displaying only properly labeled web pages, according to Ken Wasch, the president of the Software Publishers Association. Since many users won't turn off that feature to reach unrated sites, many large web sites now are facing hefty pressure to self-label. Other high tech firms rushed to join the presidential limelight. Netscape promised to join Microsoft and include label-reading software in the next version of its browser. America Online's Steve Case thanked Clinton for "backing industry's efforts to make cyberspace a safer place." IBM announced a $100,000 grant to RSACi, a PICS-based rating standard originally designed for video games but adapted for the Web. The industry giant also pledges to incorporate RSACi into future products. [...]

4 3

Beware of keystroke capture tools!
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

I want to remind folks of another _practical_ security weakness in using PGP or any other crypto program: keystroke capture utilities. These are small utilities (inits in Mac terms, perhaps TSRs in DOS terms, and who knows what in Windoze terms) that record all keyboard input. Very useful for recovering from crashes and such. These started in the Unix community, where I've forgotten the name ("history"?). In the Mac community, "Last Resort" has been doing this for a couple of years, and now several other packages offer similar capabilities (QuicKeys has "GhostWriter," or somesuch). Many's the time I've forgotten I had thse things enabled, only to find in my System Folder a folder marked "Saved Work" or the like, containing files of all the histories from each rebooting. The security risks are obvious: * passphrases (and perhaps even the original key generation process, in toto) are captured over and over again. * the stored history files may be tucked away in odd places on one's disk, on various backup tapes made, and so on. (Easily recoverable with search warrants.) * anyone with access to one's machine (a snoopy coworker, an employer, a spouse, even an NSA black bag job) can insert this harmless-looking utility and then pick up the results later. There are commands to bypass such keystroke capture--specifically intended to head off these breaches--but most people will forget sometimes, and may not even know the program is installed. (And there are at least 3 of these for the Mac, so confusion is increased.) This is a well-known security concern, but I thought it important to mention. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Cypherpunks Purity Test
by tcmay＠got.net 17 Dec '03

17 Dec '03

It seems that none of us are "pure enough" for Anonymous. In the real world, and in the world of crypto experts, programmers, and legal folks, people have real jobs. Sometimes with Microsoft, sometimes with AT&T, sometimes with the Justice Department. To exclude them from our discussions because they are not pure enough and have not done as Anonymous has (who may actually be working for anyone, of course), is self-defeating. By working for Microsfoft, Justice, or TPC, they can probably do more for "the cause" (in its many dimensions and facets) than some warez-junkie living with his parents can. Specifically, At 2:45 AM 9/10/95, Anonymous wrote: >wei dai patents algorithms - for microsoft!!!!. that should >fucking help us a lot. whos he gonna sue first? Wei Dai's work is impressive...I'm not surprised Microsoft hired him for the summer. Patents are a way of life. They may not always be, and different people have different views on them, but meaningless insults like this are a waste of our time. >according to sci.crypt mat blaze can prove that clipper has no back >door. right. that sure helps us. david sternlights new hero. If Anonymous believes this claim by Sternlight, he didn't read the rest of the discussion and he knows as much about crypto as Sternlight does. Matt Blaze made a much more finely-nuanced point about this (I wasn't at the Crypto meeting, but read his comments in sci.crypt, and they directly dispute this point by Anonymous.) >pat farrel signs up with the nsa to make the key escrow rules easier >for us morons to understand. hey thanks. maybe theyll give you a >nicer room in the concentration kamp. Pat Farrell and several other members of our list attended the NIST key escrow meeting. I would have also if I lived near D.C. Is silence the only acceptable behavior at such meetings? Perhaps Anonymous feels that even _attending_ such a meeting is disgraceful? Most of us disagree. > >a whole shitload of socalled cypherpunks jumping over each other to help and >defend him. They "defended" him in the sense that they questioned the motives (and perhaps the emotional age) of Mr. Anonymous. We on this list have had a long interest in key escrow, dating back to the first weeks of this list's existence, and 6 months prior to the public disclosure of Clipper. Much discussion of key escrow in various forms (Clipper, SKE, CKE, GAK) has occurred, and even lists of changes/improvements have been made. >brian davis trys to convinice us that key escrow isnt so bad (who signs >your paycheck davie?????) > I recall Brian Davis asking a well-formed question about whether our objections to key escrow would be lessened under various circumstances. A perfectly reasonable thing to do. Several of us responded. What this list is for. >that guy from rand corp tells us words of wisdom from robert morris the nsa guy >as if we should write them down and pray three times a day to them. > ??? This one escapes me. Robert Morris Sr. has written many interesting things. That he worked for, or still works for, the NSA is no reason to ignore what he has said. Anonymous would probably be thrown into an apoplexy were he to learn that more than one current Cypherpunk actually worked for the NSA. >carl elison designs key escrow for tis and acts like hes one of us. > He _is_ one of us. His work on commercial key escrow (CKE) is not inherently bad. After all, there are many legitimate reasons people and corporations would _choose_ (emphasis on "choose") to split keys, store them with trusted agents, etc. CKE, if done right, may be the way many of us protect ourselves, from loss of keys in various circumstances. Even protect ourselves from having to give keys to others (imagine offshore CKE depositories which have instructions on under what circumstances they will comply....). I ask Anonymou, is it better that an active researcher and developer of CKE be on this list, or that we cast him out (as if we could) and continue in ignorance? >bruce schneier is copyrighting crypt programs and >threatining to sue people who use it. > Like it or not, copyrights and patents are the way things are now being done. It sometimes takes having a patent portfolio before one can "trade" with those having other patents. Longterm, this will likely change (crypto anarchy and all that), but for now.... I'm not going to defend software patents, but insults like this, for someone who has worked so hard on crypto education, are uncalled for. >even phil zimmerman is selling the rights to pgp. what about all the >people who contributed code (like me). not a dime for us because phil is >famous >and your not alowed to say anythingn bad about him. sorry i forgot phil is god. >no one dares to complain. ask phil about me and when i asked about sharing >profits from the code i conrtibuted. also about the deal with >r.f... Now we know that Anonymous is actually a plant from the One Worlders! Insulting Saint Phil is too much. >lets get back to being punks. fuck these traitors. do crypto and fuck the nsa. > Articulate words. Or, as Anonymous woud put it: "fuck this noyze. get back to hacking commodore 64 warez. crypto rulez, d00d!" Amazing what the cloak of Anonymity brings out in people. Almost enough for me to start to believe the doubters of anonymity, the skeptics. But, with good filtering (and especially with positive reputation filtering), no big deal to send Anonymous to the oblivion he so richly deserves. I've written a lot in my time on this list, and no doubt Anonymous will find many items he thinks prove I am working for the NSA, or Chobetsu, or am an agent for the Beast. So be it. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: [NOISE] Futplex makes the news!
by John Young 17 Dec '03

17 Dec '03

Lewis, Take heart and wisdom from this experience of being caught up in public events. Being used, and abused, by institutions for their impersonal, otherwordly, purposes. Public disputes are like that, when your personal advocacies are distorted, twisted back in unexpected forms in assault on your seemingly impregnable position. Well done for this foray. But be prepared for shrewd opposition again as you continue behaving responsibly to challenge the day's short-sighted conventional wisdom. I think you shouldn't worry about thesis advisors, the thoughtful ones will understand your action and its underlying principles. They may be less daring and more cautious than you -- such is the burden of maturity -- but I suspect they will admire your audacity, and remember when they did the same in younger days when public disputes seemed more alluring and tractable -- as I do. Thanks much. John

1 0

Re: free speach and the government
by James A. Donald 17 Dec '03

17 Dec '03

At 10:52 PM 2/3/96 +0000, Stephan Mohr wrote: > But do > you fighter[s] for free speech, in principle, think that nothing, really > nothing, [should] be prevented [from] being published? Yes: > [...] > >I know, of course, that by accepting that there is something that >shouldn't be available on the net, we would need something to decide what >and how to ban. So I wonder what would be a more 'net'-like way of handling >this type of thing and how to prevent that some 'strong-armed' governments >take the net over. There is no "net-like" way of preventing people from communicating when one wishes to speak and another wishes to listen. To attempt to achieve such a goal violates the principles that made the internet possible, such as the "no settlements" rule. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0