- cypherpunks-legacy - lists.cpunks.org

Re: Taxing Churches for their views? Bad idea. (fwd)
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Jim Burnes wrote: > On Wed, 5 Nov 1997, Anonymous wrote: > > Churches, like governments, corporations, or any other organized > > entity, have some wonderful people in them, doing wonderful things. > > The problem, as always, is what our founding fathers realized--these > > types of organizations/structures tend to grow and attain power which > > is then used for the purpose of self-sustained growth (survival). > > Humanity tends to evolve, while organized humanity tends to de-volve. > > Biped humans, walking upright, form organizations which move toward > > becoming quadrapeds dragging large clubs. > Ha! This is pretty interesting. Rather than the typical cypherpunk > approach of eliminating such inefficient and corrupting methods as > income taxation and tax exemption we are playing by their game. Taxation and exemptions are, conceptually, no different than a tribal agreement that those who bring home the deer will share with those who guard the campsite, and that the shaman who keeps the evil spirits at bay has to do neither. When one strips the semantics from various cypherpunks posts, there is usually an underlying agreement that there should be no 'free rides' and no 'oppressive burdens.' <-- generality> > The whole of HG Wells warning to society was that by systematically > altering the language, you alter the things that can be discussed. I believe that half of the disagreements on the cypherpunks list, and the vast majority of disagreements in the world in general, are the result of disputes over semantics, rather than beliefs. > rather than bitch and moan about how the Churches are exempt, why > not rejoice in the fact that at least the churches are free from > taxation. We are part of the way there. Revolutionary idea! Instead of calling for Churches to be subject to the same oppressive taxation as the rest of us, call for the rest of us to be given the same exemptions as Churches. I vote Jim Burnes the honorary title of 'CypherPunks Chief Taxation Spokesperson' (Norman Vincent Peale Chapter). > Or start your own church. ;-) I agree. TruthPastor "CypherPunks Church of One" (All donations declared by myself to be tax deductible--check with the authorities in *your* jail cell (*after* sending me money) as to their views in this regard.)

2 2

PGP 5.5 CMR key examples, mini-review
by Greg Broiles 17 Dec '03

17 Dec '03

An acqaintance of mine received an evaluation copy of the new PGP For Business Security 5.5 suite, and I was able to generate some test keys to play with the message recovery features. I've uploaded them to the cert servers so folks with the 5.0 client software can experiment with them for interoperability, etc. The recovery key is "Little Brother <snoop@localhost>", fingerprint 26A5 667A 97D4 7018 1B18 2B15 D631 4776 B670 E1D0; a test user whose incoming and outgoing mail is forced to include the recovery key is "CMR User <snooped@localhost>, fingerprint EC79 A170 8BAE 60A1 3CAC C517 34A4 6056 EE42 30E3. Both keys are 768-bit DH keys, as I don't expect that anyone will use them for anything other than testing. Installation of the package involves multiple steps - there's an "administrator install package" (my term, not theirs), which installs a version 5.5 of PGP, including the PGPTools, PGPKeys and PGPTray apps, as well as a PGPAdmin program. To implement CMR, the ordinary PGPKeys app is used to create an otherwise ordinary PGP key pair; the administrator then runs the PGPAdmin app, which asks questions about security/recovery policy. The admin can force incoming messages to use a recovery key, can force outgoing messages to use a recovery key, can enable/disable conventional encryption, can enable/disable key generation (and RSA key generation), can force a key to be trusted and to act as a trusted meta-introducer. The admin can also force the user to use a strong passphrase. (PGP 5.5 includes a neat passphrase-strength-meter which changes depending on the length and apparent alphabet-space used in the passphrase for user keys.) Finally, the admin can force the user to sign/trust a designated Corporate Signing Key. After the administrator sets those policy choices, the PGPAdmin tool can be used to generate a customized installer application for distribution to users. That installer creates a local copy of PGP, which will enforce the policy choices made by the administrator. The user is warned upon key generation that a message recovery key will be used (if the app is thus configured) and that the behavior isn't optional. The recovery key ID is displayed but not modifiable. The user interface for 5.5 is much improved over that in 5.0, which was a big improvement over the command line. There's an indicator (initially preferenced to OFF, along with other information) in the PGPKeys application which marks CMR'd keys with a red button; the interface between PGPKeys and the key server is much improved. It's now possible to mark & retrieve many unknown keys, then approve adding them to the local keyring in one step, instead of approving the addition of each additional key. The icons & screen design have been updated and are now more colorful and easier to decipher. When a user with CMR-only client software encrypts data, the ID of the recovery key appears in the "encrypt to" box, and cannot be dragged out. A CMR-client will (apparently) still do conventional encryption with no recovery key if the admin allows this. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | Export jobs, not crypto. http://www.io.com/~gbroiles | http://www.parrhesia.com

1 0

See the Seasons's Hottest Video Games on VideoGameSpot!
by announce＠lists.zdnet.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- ZDNET ANNOUNCEMENT 10/22/97 ----------------------------------------------------------------- Video games are going to be on everyone's Christmas list this year, and there are so many hot titles coming out, it'll make your head spin. If you need help finding something for yourself or the right gift for someone special, there is one site that will be your guide to the best games of the season - VideoGameSpot: http://www.zdnet.com/chkpt/zdna971022001/www.videogamespot.com/ VideoGameSpot is the leading video game information site on the Web. With the largest editorial staff in the business, you'll find everything you need to be in the know this holiday season. VideoGameSpot gives you: * Hard-hitting, critical reviews of the latest games played on the Sony PlayStation, Nintendo 64 and Sega Saturn console systems * Previews of games you've been waiting for and other new releases * Hints and strategy guides to help you play better and win * Custom Quick Time trailers so you can see games before you buy them * Monthly contests and promotions with thousands of dollars in prizes given out each month If you like video games (or know someone that does) and want to buy smarter and play better, then click on the URL listed below (or enter it into your browser): http://www.zdnet.com/chkpt/zdna971022002/www.videogamespot.com/ You'll also find us on the Games Channel at ZD Net: http://www.zdnet.com/chkpt/zdna971022003/www.zdnet.com/games _________________________________________________________________ ZDNet Announcements are periodic notices of new features, special events and free offers available to members of ZDNet. --To subscribe to ZDNet Announcements, please send mail to: announce-on(a)lists.zdnet.com You can leave the subject and body blank. --To unsubscribe to ZDNet Announcements, please send mail to: announce-off(a)lists.zdnet.com You can leave the subject and body blank. _________________________________________________________________ Powered by InfoBeat: http://www.infobeat.com

1 0

Re: the migration path (was Re: Your "RIGHT" to Speak to Big Brother)
by Blanc 17 Dec '03

17 Dec '03

Adam Back wrote: >Perhaps this is what they are busy building at their top-sikrit crypto >software development/research center at Cambridge, UK under the >guidance of new head of research cryptographer Roger Needham. >Looks like an export embargo end-run by Bill Gates. > >Maybe Bill Gates is a cypherpunk after all, well we can live in hope, >anyway. ................................................................. He's no anarcho-cypherpunk: he and his father just contributed a great amount of money to support a gun-law initiative which would place all sorts of requirements on gun-owners (mandatory licensing, mandatory training, mandatory gun-locks, and many privacy-intrusive reductions of personal authority, etc.) in Washington state. I don't precisely know where he stands regarding crypto, but I know that he puts business requirements and customer acceptance above the arguments of GAK advocates, as do the VIPs who work in encryption and who totally reject the idea of Big Brother. .. Blanc

1 0

Re: Copyright commerce and the street musician protocol
by John Kelsey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks, Perry's Crypto List ## Date: 11/03/97 ## Subject: Re: Copyright commerce and the street musician protocol ] >Subject: Re: Copyright commerce and the street musician protocol >From: Marc Horowitz <marc(a)cygnus.com> >Date: 03 Nov 1997 16:03:34 -0500 >Someone recently told me that game manufacturers have >stopped worrying about piracy. Why? Because most new games >come on CD-ROM, and copying a CD-ROM is an expensive, >time-consuming operation. Bulk duplication of CD's is >substantially cheaper than one-off duplication, and since >games are cheap, people will usually buy them rather than >copy them. This is a nice situation for CD-ROM-based video games. However, it's probably a temporary situation. Currently, downloading a novel, even over modem lines, isn't all that time-consuming. If available bandwidth and storage capacity keeps getting cheaper, the same will soon be true for digital audio, and later, for digital video. The number of bits required to hold a twenty-minute piece of music at CD quality isn't going to increase over time. >While the cost of one-off CD duplication will certainly >drop, I see no reason that media will not change form in the >future. As long as it's cheaper or more convenient to buy >digital media from the publisher than to copy it yourself, >the piracy problem basically doesn't exist. Separate the medium from the information. For computer programs, it's possible to just keep bloating the data to keep piracy from paying. (To some extent, anyway.) For novels, music, and video, that's not going to work. The unit of music I'm interested in listening to will probably not change much. >This is exactly >what makes copyright work for books: I can duplicate a book, >but it will cost more than buying it legitimately. (There >is still the problem of systematic large-scale piracy, but >this is relatively easy to notice and prosecute under >existing law.) But once someone has scanned in the text from the book, it costs approximately nothing to make another copy. This works as well for digitized music, video, and images. Once the data is available somewhere in digital form, it's almost free to copy. In a world with jurisdiction-shopping, eternity servers, high-quality anonymous e-mail, anonymous payment mechanisms, and cheap, high-bandwidth connections, that digital data has to get onto the net *once*, and it is free forever to anyon who will take the trouble to find it. For books, one reason this doesn't happen more often now is that the display technology for most computers is not nearly as easy to read as even cheaply-printed paperbacks. This is sure to change with time. Widespread use of DVDs will get rid of the advantages of CDs and cassettes for listening to music. >Short works (newspapers, magazines, journals, etc.) will >need a different mechanism, such as advertising, but that >infrastructure is creating itself today. It's essentially the same problem for text works. A text work you can't fit on one CD with compression is unlikely to be something you can get many people to read all the way through. (The exception is reference material, where you want *everything* of interest to be there, even though you will surely read only a tiny fraction of the material.) The real distinction here is timeliness. If some information is only valuable when it's timely, then it's probably going to make sense to get the information from its source, even if it costs money or you have to look at some ads. If the information is valuable weeks later, then it may be hard to charge much money for access to it. > Marc --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNGDdkUHx57Ag8goBAQH0TwP/ZKJMdO1klPSI0W/UWxzX3B+2sWGp2lUT JAkSrHC6ha3JAq+NECF2Cwmf8wuu+mmdyy6laFTljGJ9uuxnfrZZ4QfJAR0S0KbM 8swifaqDkryQtu3dpJOzDV8Kc7B7QYiF3HyiW0NYDHI+VwO9hgFAq/+XkQA5Yhb8 erGdU+e5cwQ= =uFfo -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

1 0

Re: Protocols for Insurance to Maintain Privacy
by John Kelsey 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: cypherpunks ## Date: 11/03/97 ## Subject: Re: Protocols for Insurance to Maintain Privacy ] >Date: Mon, 3 Nov 1997 10:26:03 -0700 >To: "John Kelsey" <kelsey(a)plnet.net>, > "cypherpunks" <cypherpunks(a)Algebra.COM> >From: Tim May <tcmay(a)got.net> >Subject: Re: Protocols for Insurance to Maintain Privacy >Such insurance is now common. A boat owner doesn't buy >insurance for iceberg collisions if he is never in arctic >waters, a small plane pilot doesn't buy cargo insurance if >he doesn't ferry cargo, and so on. Yes, I understand this. Nobody with a grain of sense insures himself for things he knows will never happen. >>the point of having insurance, which is to protect yourself >>from low probability high cost things happening. That is, >I have a different view of what insurance is than John does. >What insurance is, and how it is priced, is too long a topic >to get into here. Suffice it to say that the insurance >company makes its profits by charging more for coverage than >it pays out. And the customer, of course, tends to lose the >differential. An insurance broker and a bookie are in the same business. A bookie takes a bet from me, at 1000 to 1 odds, for some unlikely to occur event--which he thinks has a probability of less than 1/1000. An insurance broker does the same thing. The only important difference is my purpose in placing the bet. When I take out medical insurance, I am placing a bet that I will get sick enough to spend more than my deductable on doctors. The insurance broker estimates (based on whatever information is available) the probability that this will happen, and makes me a bet at odds that are in his favor, if his estimate is true. If I get sick, I get some money (or my doctors do). If I stay well, I lose the bet. This is just paying someone to take some risk off my hands. >Each side tries to get as much information as possible. If >Joe Client knows he never pilots a cargo plane, he doesn't >opt for cargo insurance. If Joe Client knows he never >engages in unprotected sex with diseasy prostitutes, etc., >he skips HIV insurance. The fact that some "low probability >events," like meteor strikes, are uncovered is part of the >price of keeping Joe's premiums tolerable. >>before I've taken the test for genetic disease X, my best >>estimate of the probability that I will test positive is >>very low. Once I have taken it, I know the result. If I >>sign up for a-la-carte insurance for this disease, the >>insurance company effectively knows I must have tested >>positive for a predisposition to it, and so either won't >>give me insurance, or will give me insurance only at an >>extremely high rate (corresponding to a 1/10 chance of >>getting the disease, rather than a 1/1,000,000 chance). >This is the idea. It causes those with the predilections to >the disease to pay the high coverage costs. Right. I don't think I expressed my point too clearly, because you seem to have responded to something different than what I was saying. Suppose there is some genetic disease that kills its victims on their 31st birthday, unless they get a $1,000,000 treatment first. Before I have taken the test for this disease, I have to accept a certain risk--if I find out I have the disease, I have to raise a million dollars in the next few months. After I have taken the test and gotten back the results, there's no more risk involved (assuming the test is perfect)--I either have the disease or I don't. After the test, insurance isn't useful (unless I defraud my insurer). Before the test, though, insurance might be useful--I could essentially place a bet with someone that I had the disease--I pay $1, and get a million dollars back if my test comes back positive--just enough to pay for my treatment. >The alternative is not pretty: banning private testing >(how?) and forcing insurance companies to cover all >applicants for all conditions at a fixed rate. I know. Let me make it clear that I am not at all interested in banning private testing, coercing insurance companies or anyone else into agreements they don't want to make, etc. I am saying it would be nice if I could buy insurance against the results of the tests before I took them. The problem is, I can't see a really workable way to do this, because there's no way to keep people from taking the test beforehand. >--Tim May --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBNGDdikHx57Ag8goBAQE6/AP/Yub9LA0b1rvivDeiHW9tHtV7b/n4jmUA aP50hPFTCn7EEMsoKdC2pUv0eq5F+s8AmKyaE+SmxTgBbalrvm+T+lPib4bbEXjH iI9nHbnfzTSxiVbkVHp0p0/0urIgokTcrFBWbfIEnmOnGvI7OHI+KcPjqr3JBQeo A53+dL0NBRQ= =kx2R -----END PGP SIGNATURE----- --John Kelsey, Counterpane Systems, kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36

5 6

Digital signatures
by Anonymous 17 Dec '03

17 Dec '03

Tim Maytag carries a turd in his wallet for identification purposes. _______c___c / /_ _\ | ((6)(6)) Tim Maytag ( )_ __\\ //__ o___n) (nn)\o/(nn)

1 0

PGP 5.5 CMR/GAK: a possible solution
by mark＠unicorn.com 17 Dec '03

17 Dec '03

[Posted to cypherpunks, cc:-ed to Jon Callas] You know, in the last few days I've read a lot of messages on both sides of this debate, and I've umm-ed and ahh-ed and slowly gone from thinking that what PGP are doing is evil to thinking that it's just bad. While I believe that Adam Back's suggestions for alternate systems are good and neccesary ideas for the long-term, I'm coming to the conclusion that PGP are heading in the right direction for the short-term, but have things backwards. The current system sends out a user's personal key, with a tag to say that if I don't encrypt to the company as well, my mail will bounce. But think about this: how often do I want to send email to a particular person in a company, and ensure that only they see it? And how often do I want to send mail to a particular group inside a company? All I want is to ensure that I get a response from the company, I usually don't care who I talk to in the process. So PGP's "everything private unless you choose to make it public" system seems backwards. Surely what we really need to meet these customer demands is an "everything public (within the company) unless you choose to make it private" system? That is, all mail to my department inside the company should be encrypted to a department key, shared by all members, *unless* it is confidential, in which case it should *only* be encrypted to me. Here's how I see this working: when Joe Blow joins Foo-Bah Cryptosystems, he creates his own personal PGP key. He also gets a copy of the department key, which he can use to decrypt any mail which is encrypted to his department; or this decryption could be handled automatically by a department email server to ensure that individuals never have access to the department's private key. PGP then creates a public key for 'Joe Blow <joe.blow(a)foo-bah.com>', which would be the department key with a signed tag linking it to his personal public key. This is the tagged corporate public key which he would give out to any customers. When a customer wishes to send email to Joe, he would use this public key. When encrypting, PGP would detect the tag and put up a dialog box pointing out that this is a corporate key and if they click on the 'confidential' button it will be encrypted to the user's personal key prior to encrypting to the corporate key (by which I mean superencryption, to avoid traffic analysis). The default would be not to superencrypt; and as a side effect this system would be compatible with any version of PGP for non-confidential mail (assuming that version understands the encryption algorithms in use). The effect of this is that if someone wants to send email about an urgent bug and I'm out at lunch, any of my co-workers can read that mail. But if they want to send *me* mail about confidential inter-company negotiations, the co-workers could decrypt the outer layer of the message, but would be blocked by the inner layer encryption to my personal key. As I see it, this system is simple, solves the problems which PGP claim they need to solve without creating the snooping problems Tim and others have discussed, cannot easily be adapted to GAK ('This message is to be encrypted to the FBI public key. If it is confidential, click here to superencrypt to the recipient's personal key'), and won't require a massive change to the PGP source code. There are some obvious security issues with having the department key shared amongst the members of the department, but I don't see that they are any worse than PGP's current CMR implementation, which has already discussed the use of department keys; it's certainly better than using plaintext. There are also problems with encrypting confidential mail to multiple recipients, but they're surmountable; an easy solution, if you don't care about traffic analysis, is to only encrypt confidential mail to the personal key rather than superencrypt with the corporate key. In most cases such mail wouldn't be sent to multiple recipients anyway. So here's how I'd see the simple system working: A PGP CMR key would consist of 1. A corporate key; this might be company-wide, department-wide, or an individual escrowed key; this choice is a seperate key-management issue for the corporation. 2. Optionally a personal key, which could only be decrypted by the individual. 3. A signature from the corporate key linking the personal key to it and the specified User Id. 4. Optional flag to indicate which key to encrypt to by default. 5. User Id, signatures, etc When PGP was asked to encrypt to such a key, it would check for the optional personal key. If it wasn't there, it would put up a warning box to tell the user that the message can be read by people other than the recipient. If it is, then it would put up a dialog box allowing the user to choose whether to encrypt to the corporate key or the individual key, normally defaulting to the corporate key. This system could not easily become GAK because it will only encrypt to one of the keys and not both; the FBI could create FBI CMR keys from all our public keys, but then PGP would either encrypt to the FBI and I wouldn't be able to read it, or encrypt to me and the FBI wouldn't be able to read it. Anyone care to pick any holes? Mark |-----------------------------------------------------------------------| |Mark Grant M.A., U.L.C. EMAIL: mark(a)unicorn.com | |WWW: http://www.unicorn.com/ MAILBOT: bot(a)unicorn.com | |-----------------------------------------------------------------------|

7 10

No Subject
by MIS Security 17 Dec '03

17 Dec '03

Dan, You have a .forward file here at mis that points to toad.com. Do you have a .forward there? I received several compalints from people who are getting your mail at cosmos(a)microserve.net. -Jeremy ~---------------------------------------------------------------------------- Abuse & Security Department MicroServe Information Systems, Inc. security(a)admin.microserve.net 100 North Wilkes-Barre Boulevard abuse(a)admin.microserve.net Wilkes-Barre, Pennsylvania 18702 http://www.naISPa.org (717)821-5964 FAX (717)821-5968 -----------------------------------------------------------------------------

2 3

Great new GAY Phone Services...can be Absolutely FREE
by 82GuyWire＠live.net 17 Dec '03

17 Dec '03

THE MALEBOX THE MALEBOX is an awesome new GAY live voice phone system..{currently absolutely FREE with Sprint's Free Monday} ! Otherwise, only REGULAR U.S. phone charges apply (NY free)...the computer is in New York with a normal phone number. There are no setup costs and NO FEES...call from anywhere anytime (use your own best rate...Dime Deal...MCI 5ct Sunday,etc). Why be shy? Call THE MALEBOX at # 315-233-1693 and press 7 for the LOBBY, then press... #1...LIVE ROOMS > chat for up to 8 people per room; a great way to meet and (press 7 to skip to next room) Gay Guys seem to prefer the virtual chat aspect found on One-on-One #2...BULLETIN BOARD > post messages or ads, or listen #3...ONE-ON-ONE > private talk; good place to meet and chat without giving your home phone number...check out NEW INSTANT VIRTUAL CHAT !! #4...PERSONALS > super place to meet your dream mate #5...VOICEMAIL > get your own private mailbox or leave a message. #9....DIRECTORY > other special numbers and services #0...to return to the LOBBY The system is very simple, just follow the easy directions or use the menu above...try it you'll like it! Please SAVE THIS MESSAGE for the future. Call THE MALEBOX at # 315-233-1693...if busy just try again press 7 to slip in to the LOBBY ...... ( for straight folk try a similar system at THE HOTEL CALIFORNIA at 315-233-1690 ) ( from the U.K. try 268-404-7489 ) for FREE TAROT READINGS try # 1-268-404-4772

1 0