Subject: Re: [Raven] Re: (no subject)

From: Sampo A Syreeni <[email-masked]>
Date: Wed, 1 Dec 1999 14:45:52 +0200 (EET)

On Tue, 30 Nov 1999, chefren wrote:

>I can simply reason that criminals can misuse networks for 
>their organizations and that it will cost us all money to 
>keep crime rates as low as they are now.

The classical counter to such a claim is that if somebody is doing something
criminal enough, they will use something like strong crypto anyway. So the
only ones to be monitored through such standard taps are the ordinary,
law-abiding citizens. So why are the taps needed?

Sampo Syreeni <[email-masked]>, aka decoy, student/math/Helsinki university

_______________________________________________
raven mailing list
[email-masked]
http://www.ietf.org/mailman/listinfo/raven

---

From: "Lyal Collins" <[email-masked]>
Date: Thu, 2 Dec 1999 00:53:11 +1100

Taps help with stupid criminals.

Cost-effectiveness of law enforcement occurs under such circumstances.

Regards,
Lyal
> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]]On Behalf Of
> Sampo A Syreeni
> Sent: Wednesday, 1 December 1999 23:46
> To: chefren
> Cc: [email-masked]
> Subject: Re: [Raven] Re: (no subject)
>
>

---

From: "chefren" <[email-masked]>
Date: Wed, 1 Dec 1999 23:47:39 +0100

> law-abiding citizens. So why are the taps needed?

They are needed because your "classical counter" is flawed.

There is a lot of very specific information even in strong 
encrypted datastreams.

+++chefren

= =
ii.nl ontwerpt, bouwt én onderhoudt websites
100 Euro aanbrengpremie: http://www.ii.nl/premie

---

From: Sampo A Syreeni <[email-masked]>
Date: Thu, 2 Dec 1999 13:31:38 +0200 (EET)

>There is a lot of very specific information even in strong 

What is this specific information? Supposing the protocol is well built and
routed through a couple of anonymizers in countries your local government
cannot touch, the stream need not give away the IP address of the other
side, nor connection information, nor any of the data inside the encrypted
stream. Any proper protocol prevents man-in-the-middle attacks. Properly
built protocols can be made so that even local analysis of inter-packet
arrivals cannot give anything away (fixed width tube with random data
inserted when actual data isn't there to be sent). If the encryption
algorithm fulfils any standard whatsoever, the encrypted stream will not
betray any useful statistics either. So what is this specific information,
again?

---

From: "Lyal Collins" <[email-masked]>
Date: Fri, 3 Dec 1999 07:17:16 +1100

Name me 2 propoer protocols that prevent man-in-the-middle attacks.
SSL doesn't.
Nor does S/MIME.  The both depend on external agents, like Certificate
Authorities and or DNS, and in the case of SSL, on the web page you click
from to be accurate (if
https://my.site.com is changed in aproxy cache to read
https://my-site.com, the browser and most users won't care).

What we seem to be seeing some consensus on is :
- that encryption needs to be used more often, and
- that prevent tapping/monitoring abuse is desirable,
- given tapping and monitoring abuse is likely to happen regardless of laws
or policies to the contrary.

Regards,
Lyal

> Sent: Thursday, 2 December 1999 22:32
> To: chefren
> Cc: [email-masked]

---

From: "chefren" <[email-masked]>
Date: Fri, 3 Dec 1999 21:20:38 +0100

On 2 Dec 99, at 13:31, Sampo A Syreeni wrote:

> Supposing the protocol is well built and routed through a
> couple of anonymizers in countries your local government
> cannot touch, 

One of the distinct features that appeared to have ended 
the middle ages in Europe were the cities.

Cities didn't allow anonymous people and unregulated 
weapons within their walls.

+++chefren

p.s. As far as I know there aren't that much anonymizers on 
the web. I know of activity by Zero Knowledge Systems, is 
there someone who can point me off-list at a webpage that 
gives a nice and current overview?