- cypherpunks-legacy@lists.ogf.org

cryptographic activism
by Eric Hughes 02 Mar '93

02 Mar '93

Dave Deltorto, in a message to the list last week, was all fired up to start some real political activism in this country. More power to him. May I suggest publicly, though, Dave, that you broaden your focus? The US really does work pretty well. For example, Fourth Amendment protections agains search and seizure, while eroding in some ways, are still basically intact. I do not claim that the US does not have problems, just that the nature of governmental violence against its own citizenry is much lower here than in other countries. Therefore I suggest that we extend an international hand of cryptographic aid. I suggest that we start with Singapore. Singapore is highly industrialized has a good telecommunications base. So good, in fact, that it supports their national payment and identity card system. Purchases really are tracked and data is filtered to look for unusual behavior. The subway and the toll booths all take the payment card. Singapore is, in many ways, the crypto-anarchist's worst nightmare. I do not know if the government there has cryptography restrictions, but I'm sure they will soon, if only as reaction. So now is the time for all of you folks to start writing your steganographic (information-disguising) applications! They are actually useful here. I would suggest that interested parties listen in on soc.culture.singapore for a while, and then carefully broach the subject about deploying secure communications. This is about as real-world as it gets, folks. The need for cryptography as a tool against oppression is real. In the US and Europe we deploy it to prevent oppression in the future, and we must be grateful that is the future we speak about. Nevertheless, others are not so fortunate. It behooves us to consider them. Singapore is not the only place in the world this is useful; it is only my first suggestion. Eric

1 0

Re: Future of anonymity (short-term vs. long-term)
by tcmay＠netcom.com 02 Mar '93

02 Mar '93

Ted Ts'o comments ruefully: >There doesn't seem to be a lot of realism in these discussions, which is >really bothering me. Oh, well.... > > - Ted There are certainly differing agendas and differing time horizons, as others have also noted (especially Marc Ringuette's analysis of time scales). Some are writing code to be put into their programs _tonight_, while others take a longer view. Some on this list operate real remailers, even world-famous remailers. The day to day discussion of mail protocols, PERL scripts, headers, REGEX stuff, and actual code submitted to the list is certainly pretty strong evidence that folks are deeply immersed in realism. Your own concerns about anonmity have also been well-received, I think, even if many of us disagree with you in some areas. Speaking for myself, I agree that some limits on anonymous posting may develop--this doesn't mean _we_ should put the limits in! (Granted, some of those operating remailers need to think about these issues. Johan Helsingius, for example, has done a very impressive job of balancing needs and threats and is considering how to deal with various kinds of abuses. Many on this list are contributing ideas. You can't get much more real than this.) Bugs, flaws, problems, cruftiness, and other defects exist. So what? That's the main point of trying to actually deploy these systems--to expose weaknesses, to try new approaches, to come out with "Mark II" versions of systems, and to have concrete examples to point to. As far a realism goes, the folks in this group have built real anonymous mailing systems, have been deeply involved in the PGP development (not me, certainly, but look at the PGP docs and you'll see some names from this list), and are working on many aspects of the evolution of digital privacy. As one who has been interested in this area since 1987, I think the progress in the last year or so has been nothing short of amazing. -Tim May -- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: MailSafe and PGP available.

1 0

Re: anonymity + untraceable digital money = potential problems
by wcs＠anchor.ho.att.com 02 Mar '93

02 Mar '93

> > From: ALAN DORN HETZEL JR <dorn(a)indigo.mese.com> > > Dear Group, > > I believe that I see a potential serious problem with they onset of > > truly unbreakable anonymous communication combined with untraceable > > digital cash. > > The problem is that crimes such as blackmail and extortion would become > > absolutely impossible to defend against. Kidnapping for ransome would > > get a LOT easier. Yes, some criminals would find blackmail, extortion, and kidnapping easier. But others would find it harder. Just think about who's most likely to demand half your salary and threaten you with violence if you don't pay, or take your house and not give it back unless you tell them the name they want, or throw you in a locked room and not let you out until you pay ransom? That's right! It's the *government*! I may not be as much of an anarchist as Perry, or maybe just more trusting :-), but I'd still feel a lot more secure if the government didn't know how much money I make and where to get it if they feel like taking it, and couldn't read my mail and accuse me of corresponding with known ANARCHISTS AND DRUG USERS AND FOREIGN NATIONALS AND MUNITIONS DEALERS (obviously I must be conspiring with them since I didn't turn them in) and quite frankly I'd like to be able to discuss different medicinal and recreational products with people without having to worry that they'll knock on my door one night and tear my house apart looking for things that aren't there, or things that were legal when I bought them but aren't now, and I'd like to be able to discuss interesting software without them coming and stealing my wife's home business laptop and laser printer because they couldn't find the disk drive on my VT-100 clone. I'm not paranoid, but I have friends who are :-), and I'd like to be able to talk to them on the phone without us worrying about wiretappers. And I have friends of friends who come from other countries, and maybe their papers aren't in order, and they don't want to go back to places where the governments are less concerned about human rights than our benevolent Immigration and Naturalization Service, or maybe they just like it here. And the lack of anonymous communication hasn't stopped the Mafia from burning down restaurants here in New Jersey or up in Rochester; it just means they've got to invest some of their profits in bribing cops. My friend's brother didn't get an anonymous postal-mail message, he got a visit from two big ugly guys he didn't know who told him how much protection would cost. On the other hand, my reading of Chaum's digicash paper makes it look like marked digicash may be possible, if the original account-holder wants to reveal the numbers and can trace the connection from the recipient's bank back to their bank, so kidnappers will still need money-launderers, though money-laundering will be easier. (Blackmailers still can get revenge by revealing their secrets, but at least you'll be able to be anonymous when you do some of the stupid things you could get blackmailed for :-) Bill Stewart, wcs(a)anchor.att.com

1 0

Re: more ideas on anonymity
by fen＠genmagic.genmagic.com 02 Mar '93

02 Mar '93

> From: Theodore Ts'o <tytso(a)Athena.MIT.EDU> > > Or suppose someone sends 20 messages (all different) about how > ---- ------ stiffed him/her out of some amount of digital cash? I'd > suspect you could do some real damage that way. In response to this, let me first quote Eric Hughes: > "How much reputation has an anonymous source?" I believe that this is the true question being asked. I believe that in the not-so-far-off future there will be an immense quantity of anonymous traffic on the nets, and I will set my filters to ignore the large percentage of it (though perhaps I may want to see notes with my name in them, or perhaps not). This doesn't mean I won't see *any* anonymous messages, as my positive reputation system will work to counter-balance the effect of the filter, and allow messages from anonymous sources that are connected to me via a "line of trust", that is, through a set of anonymous keys and signatures that prove to me that the source of the information is from someone that I trust, or that they trust, or... Further, pseudonymous posters may gain quite a bit of respect. As was earlier pointed out on this list, most posters to net news are today pseudonymous, for I know not if their real name is what their From: line states, but I learn to recognize and differentiate names (pseudonyms) bearing good info from those that know not what they say or those that just flame. It is from this last set of anonymous publishers that we may have the problem being discussed. For example, "NBC" may as well be an anonymous pseudonym, but we (well, a lot of the general public, anyway) have decided to place a fair amount of trust into them. This problem stems from people being too ready to abdicate their responsibility from having to think critically about the world around them, and the information they receive. In other words, the big problem, as we all know, is one of education. Just say "know"! Fen

2 1

she's at it again :-)
by Karl Barrus 02 Mar '93

02 Mar '93

Cypherpunks, (My apologies if this is already widely known; I haven't seen any mention of it on this list) In the March 1993 IEEE Spectrum magazine on pp. 16-17, Dorothy Denning again floats her support for digital telephony bill in an article entitled "Wiretapping and cryptography". I quote her: "Although government regulation of cryptography may be somewhat cumbersome and subject to evasion, we should give it full consideration. Regulated encryption would undoubtedly provide far greater security and privacy than no encryption at all, the current state of affairs for most personal and corporate communications." Regulated encryption!? This topic was discussed quite thoroughly in sci.crypt in response to Tim May's post. And the topic is still kicking... The article is very interesting, containing many oxymorons: "On the contrary, implementation of an intercept capability together with appropriate security measures is more likely to lead to telecommunication systems that are "smarter," more secure, and of commercial interest to other countries." "while often labeled as "anti-privacy," wiretapping actually serves to protect the privacy of law-abiding citizens and the business interests of corporations" /-----------------------------------\ | Karl L. Barrus | | elee9sf(a)menudo.uh.edu | <- preferred address | barrus(a)tree.egr.uh.edu (NeXTMail) | \-----------------------------------/

1 0

Re: more ideas on anonymity
by pmetzger＠shearson.com 01 Mar '93

01 Mar '93

> From: Theodore Ts'o <tytso(a)athena.mit.edu> > > Date: Mon, 1 Mar 93 13:27:24 EST > From: pmetzger(a)shearson.com (Perry E. Metzger) > > Now, on the issue of slander, the notion of anonymity > is largely unimportant. If I had walked into the middle of the street and > ranted for an hour saying that GM trucks are unsafe, that would be largely > ignored, as most anonymous denunciations likely are. The issue is if a > non-anonymous individual or entity with credibility, like NBC, says > something that is false. > > I don't know about that. It is certainly true that non-anonymous > individual or entity with credibility, like NBC, can do the most amount > of damage when they slander someone. > > But what about someone who sends 20 different mail messages, each > through a different remailer path so they have different reply > addresses, all of them detailing some similar (but false) story about > how some GM truck went up in flames aftering being hit lightly by a Geo > Metro? Or suppose someone sends 20 messages (all different) about how > Perry Metzger stiffed him/her out of some amount of digital cash? I'd > suspect you could do some real damage that way. Not as much, perhaps, > as something like a faked demonstration tape broadcast on prime-time > evening news, but damange nevertheless. I doubt it. As people get more and more used to the capacity to do such things, its likely that such anonymous accounts will be more and more untrusted. Perry

1 0

UNSUBSCRIBE
by nihilis＠mindvox.phantom.com 01 Mar '93

01 Mar '93

UNSUBSCRIBE Love the list, just don't logon and 120 new posts is just too many, especially when I have to tell it apart from stuff straight to me... (maybe if I can get a 14400 dialup to telnet through) |:- nihilis(a)phantom.com -:| |:- Joel Boutros -:|

1 0

Re: anonymity + untraceable digital money = potential problems
by pmetzger＠shearson.com 01 Mar '93

01 Mar '93

> From: ALAN DORN HETZEL JR <dorn(a)indigo.mese.com> > > Dear Group, > > I believe that I see a potential serious problem with they onset of > truly unbreakable anonymous communication combined with untraceable > digital cash. > > The problem is that crimes such as blackmail and extortion would become > absolutely impossible to defend against. Kidnapping for ransome would > get a LOT easier. I see serious problems with allowing people to take drugs. They can get addicted to them. Lets ban medicines. I see serious problems with allowing people to own guns -- they might commit crimes with them. I see serious problems with allowing people to speak freely -- they might blaspheme, or tell lies. Mr Hetzel, I'm an anarchist. I have very little "faith" in human beings, which means I don't trust big complicated structures run on the assumption that human beings are inherently trustworthy -- like governments, for example. I prefer systems that decentralize power and make it possible for people to operate without the necessity to trust each other. Yes, digital cash makes kidnapping easier. So, for that matter, do telephones and cash itself -- had money never been invented, anonymous kidnapping would have never been possible. However, the alternative to permitting market structures to take care of problems in a competitive way is to allow central structures in which we are asked to trust in the benificence of government officials. I'm not the trusting type. If history has had any lesson, it is that governments degenerate and are taken over by evil men, over and over and over. The structures needed to stop digital cash, anonymous postings, and the like would be so draconian as to assure that should a dictator ever wish to sieze power the structures needed to do so would be waiting for him. I'd prefer a system in which he would have to build them from scratch, even if it means one or two people can be blackmailed once in a while. Utopia isn't possible. I'd prefer, therefore, to settle for the best we can do. > > I could send you an anonymous note threating to poison your dog, kill > your wife, burn down your house, whatever..., ... unless you pay me > $$$ in untraceable digital cash. What can you do? Today, I could send you an anonymous note threatening to poison your dog if you don't leave $5000 in the poorbox at the corner church. What can you do right now? Easy. Watch your dog. The police have a myriad of techniques at their disposal. Their jobs have never been easy, but they have to cope with anonymous messages and untraceable cash thefts right now. To eliminate the capacity to use digital cash means to require monitoring of all speech and ban most international traffic, to prohibit strong cryptography and require key registration. Even then I'm not convinced that it would work because people would still try to avoid these restrictions. All technologies are fraught with dangers. All of them. The knife you use to slice your bread can be used to kill your wife. Shall we dispense with knives? Shall we pretend that we can unlearn what we know? A bright 10 year old with a computer can produce a cypher machine. Shall we lobotomize all ten year olds and destroy all the computers? You CANT put some djinni back in the bottle after you've rubbed the first time. We can't stop people from knowing things. At least the well meaning fools who advocate gun control have the fact that good machine shops aren't in practically every home on their side -- telephones, modems and computers are becoming ubiquitous, however, and they are all capable of aiding and abbetting in the criminal techniques you mention. Welcome to the world. Perry Metzger

1 0

Re: CFP Costs Too Much!
by fen＠genmagic.genmagic.com 01 Mar '93

01 Mar '93

> In my opinion, $405 is way too much to pay for this conference. One note on the other side of the coin: Email announcements of the conference began in December of '92, including the complete pricing schedule: > Registration Fees are: > If mailed by: 7 February 8 March on site > Conference Fees: $300 $355 $405 > Tutorial Fees: $135 $165 $195 > Conference & Tutorial $435 $520 $600 Note that there was over a month's time to get registered at $300, and the price of registration is currently $355, *not* $405. Now I have to pay the $355 out of my own pocket (as Magic decided not to pay my way) and I understand the pain you feel with having to shell out such big bucks. But, for one reason or another, I believe that CFP has not done incredibly well financially, and they've got to cover their ass. One way to do that is by encouraging early registration, which smooths the planning process. So get your registration in now! > Registration is limited to 550 participants, so register early and save! > > By Mail: By Fax: > (with Check or Credit Card) (with Credit Card only) > CFP'93 Registration Send Registration Form > 2210 Sixth Street (510) 845-3946 > Berkeley, CA 94710 Available 24 hours > > By Phone: By E-Mail: > (with Credit Card only) (with Credit Card only) > (510) 845-1350 cfp93(a)well.sf.a.us > 10 am to 5 pm Pacific Time On the other hand, Glenn Tenney has done a remarkable job in keeping the price of Hackers down... Fen

1 0

Piercing anonymity and censorship
by ssandfort＠attmail.com 01 Mar '93

01 Mar '93

_________________________________________________________________ FROM THE VIRTUAL DESK OF SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Theodore Ts'o wrote: ". . . I don't like censorship in any form. But disclosing who sent a particular piece of anonymous mail is not the same as censorship." How about FORCING a third-party to make such a disclosure? It seems Ted would ask or force remailers to be the nets' policemen. If remailers are required to compromise the anonymity of their service, the "chilling" effect on speech IS censorship. ". . . there are people who believe . . . that libel and slander laws shouldn't exist. But it's not fair to call that a mainstream position. And it is unreasonable to assume that as an axiom." I never claimed that such a position was "mainstream" nor assumed it was an "axiom." I don't think I've seen ANY "ad populum" arguments (other than Ted's) on Cypherpunks, we tend to think for ourselves. ". . . *MOST PEOPLE* also don't believe that the right to privacy is absolute. It certainly isn't explicitly listed in the *U.S. CONSTITUTION"*. (Emphasis added.SS) Our desire for privacy is not the result of a *popularity contest* nor is it an argument from *authority*. Rather, it is derived from the logical requirements of freedom. "But in order to punish the perpetrators, it is first necessary to *identify* the perpetrators......" RE-READ my post, Ted. S a n d y ssandfort(a)attmail.com ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0