Two items from recent magazines...

Two items form recent magazines:

* "Time" (on the newstands now) has an article on the Internet and its
rapid growth and uses John Gilmore's wonderful quote: "The Internet
interprets censorship as damage and routes around it." (may not be his
exact phrasing)

* Pseudospoofing detectors? "The Economist," November 20, has an
article "Hidden Agenda" which describes how an outfit named CHI
Research in New Jersey uses its 12-year data base of U.S. patents to
determine who is really doing what. Apparently some companies try to
obscure what they're doing by using different "inventors"...sounds
fishy to me (I'd be pissed if my invention got credited to someone
else).

Anyway, CHI uses various techniques to deduce actual inventors, what
companies are doing what, etc. Then he sells the conclusions.

This fits with some of the themes we discuss here, both for our own
use and in terms of what our opponents may be doing.

--Tim May



-- 
..........................................................................
Timothy C. May         | Crypto Anarchy: encryption, digital money,  
tcmay@netcom.com       | anonymous networks, digital pseudonyms, zero
408-688-5409           | knowledge, reputations, information markets, 
W.A.S.T.E.: Aptos, CA  | black markets, collapse of governments.
Higher Power: 2^756839 | Public Key: PGP and MailSafe available.
Note: I put time and money into writing this posting. I hope you enjoy it.

W.R.T. using "fake" inventors.  It's illegal to file a patent application
without the true original inventor's name on it.  If it can be proven that a
company did this, it is liable for treble damages and the lawyer who filed
the application can be disbarred.

It's possible that companies might shuffle the order of names on an
application so that someone's name doesn't keep showing up as primary
applicant, but the inventor's name has to appear on the application
somewhere.

--Alan Wexelblat, Reality Hacker, Author, and Cyberspace Bard
Media Lab - Advanced Human Interface Group	wex@media.mit.edu
Voice: 617-258-9168 Page: 617-945-1842		an53607@anon.penet.fi
"To pleasure!" "To passion!" "To paradise!" "To pain!" "Tonight!"

> W.R.T. using "fake" inventors.  It's illegal to file a patent application
> without the true original inventor's name on it.  If it can be proven that a
> company did this, it is liable for treble damages and the lawyer who filed
> the application can be disbarred.

It's not the inventors who are faked, according to the article -- it's the
companies for whom they work.  I forget the examples now (mag is at home),
but these people have turned up corporations which file their patents under
no end of front companies (tentacles? :-) so as to make it hard for their
competitors to see what they are up to.  It's by using the inventors' names
that all this information is being pulled back together.

Jonathan Corbet
National Center for Atmospheric Research, Atmospheric Technology Division
corbet@stout.atd.ucar.edu

 they are - and I haven't tried checking their
articles to know what to look for to check whether an email
request claiming to be from one of them looks unforged.
If I remember right, none of these people puts a PGP Key ID or fingerprint
in their posting signatures, so I don't have that clue available -
that would increase my confidence a lot.  But I still couldn't be sure.
 
[This is the hitch in digital signatures isn't it?  At least as far as
those not issued from an authority are concerned.  You are really
signing for a location rather than anything else.  You have no idea
who has access to the secret key on the other side of the public or if
the "who" is a "him" a "her" or "they."  A signature is webbed in with
the trust you give it.  Tim May's signature means nothing if everyone
knows that Tim and his close friends all use it even if the key only
has the words "Tim May" on it.
++ Tim, I used your name because I want someone else to be the example
today  :) ++
Technically (for you grassy knoll types) the holder of a secret key could
be quite dead and anyone might have taken up use.
The dead key holder, or even the duress key holder, creates all
sorts of problems if you are dealing with nym's or anonymous keys.
Same problem with so-called "password" or "bearer" accounts.
The money is only as secure as the protocol is secret.  Subjectively
different for each and every user.
 
People like LD have to break past the barrier in concept and accept
that a public key system with an open trust web just cannot be used
to establish IDENTITY.  With a properly structured web it approaches
zero probability of "identity fraud," but never quite gets there.
 
I'm not lying if I sign some key that I know to belong to a person
who actively uses the name "564FR"
All my signature says is that "at one time 564FR held this key and
I trust him to send a revocation if there is a problem."
NOT
"This key is held by 564FR and 564FR alone, so help me (insert deity of
choice)"
 
Frankly I think this system is a lot MORE honest than a centralized
system (which stinks to me of big government anyhow) because
multiple signatures from several individuals represent different
perspectives on identity.  Chances are that if you have 6 nice signatures
you managed to convince 6 very different people that the key is "yours"
I trust this much more than some "trusted authority" which is likely
to be neither trusted, nor an authority.]
 
+++
On the other hand, if I really cared about preserving the anonymity
of the nym-user, and it was somebody I knew in person, or myself,
I probably wouldn't sign it with my real key - it may be relatively obvious
that "Bill The Dragon-Basher" whose key was signed by "Bill Stewart" was me,
but I'd rather not have to deal with a court subpoena or Mafia equivalent
trying to find the users of the keys for "Crypto International, Ltd." or
"Coalition Against the U.S. Invasion of Cuba" or "Some Unapproved Religion" or
"Bear's Custom Chemicals" or an anonymous Panamanian bank account that's mine.
 
But if the keys are only signed by other nyms, how trustable are they?
 
[So how do you know what's a nym and what's not?]
 
If I ran a digibank, I'd be real hesitant about accepting changes of
address or public-key unless I had some physical verification or other
securely shared secret to avoid eavesdropper and interloper attacks,
but one of the goals of digital banking is that you're not supposed
to need physical transactions.  I suppose an initial account set up
by sending the bank a message with a Secret and a public key and a
bunch of digibucks might do the job, with some cut&choose protocols
to decrypt the digibucks if the account is approved?
 
[If I ran a digibank with open accounts, I'd shift the security burden
to the account holder.  Especially when dealing with accounts from
sketchy identities.  Provide the means for security in protocol,
the rest is up to the user.]
 
                Bill The Dragon-Basher
                        (oops!  ^X^C:wq!/exit~.\b\b\b\b\b\b)
# Bill Stewart  Old address: wcs@anchor.ho.att.com AT&T Bell Labs, Holmdel, NJ
# After 10/15, NCR, 6870 Koll Center Parkway, Pleasanton CA, 94566
# Voice/Beeper 510-224-7043, Phone 510-484-6204, email bill.stewart@pleasantonca.ncr.
com
 
- -uni- (Dark) 
[who will begin to attach key fingerprints to mail and not just usenet
and finger]  :)
073BB885A786F666  6E6D4506F6EDBC17
 
-----BEGIN PGP SIGNATURE-----
Version: 2.3
 
iQCVAgUBLP0XEBibHbaiMfO5AQHeKQQAhN6RXRQ8fZ1hz+jvFbuw6N6fvByG2Euq
BYISCdcLgcWa1V/Jpq7GjjIwLTEYjxFQBqg2txyu4QKpmg1HR3ox/MAyUPcqQqQy
K9WxvwVMW/3ydGKRwLyatthHZsa47JGVumwzQJ2/cDzhNZhfiM/SqXgH3jdHBSAO
9r744wKJsoc=
=Qi4O
-----END PGP SIGNATURE-----