Re: Netscape gives in to key escrow

At 6:44 AM 11/30/95, sameer wrote:
>http://www.cnet.com/Central/News/govt.html
>
>        Bad. Very Bad. And I was almost starting to like Netscape.

Thank you Sameer for pointing this out.

Jim Clark is actively working for the enemies of liberty and freedom.
Consider this quote:

"To secure Net communications, the government will need to have access to
private data exchanges using what is known as a key escrow security system,
said Clark. He added that an invincible security system for the Net is
possible, but such a system won't be built unless the government has a
stake in it. "That's where key escrow comes in," said Clark."

Note that this is beyond the "watered down" forms of "commercial key
escrow" that many advocates of forms of key escrow often like to talk about
(such as the nominally voluntary schemes espoused by TIS). This speech by
Clark is actually closer to the real truth of key escrow that we normally
here from public speakers: the government will need to have access,
therefore the key escrow will be mandatory, not voluntary.

Can Netscape continue to prosper? This latest issue won't kill it,
naturally, but I doubt a $5 billion market capitalization can persist when
a company has no technology that cannot be duplicated or bettered by
others. As an example, I use Netscape to do certain things, Eudora to do
other things, and Newswatcher to do still other things...I will switch to
an improved Web browser _much_ faster than I will switch to a new word
processor. I don't see much "staying power" inherent in Netscape's browser,
so I can't see how the company can maintain a market capitalization greater
than that of General Dynamics, CBS, and Apple.

I wonder what discussions Jim Clark has been having with the Feds?

--Tim May

Views here are not the views of my Internet Service Provider or Government.
---------:---------:---------:---------:---------:---------:---------:----
Timothy C. May              | Crypto Anarchy: encryption, digital money,
tcmay@got.net  408-728-0152 | anonymous networks, digital pseudonyms, zero
Corralitos, CA              | knowledge, reputations, information markets,
Higher Power: 2^756839      | black markets, collapse of governments.
"National borders are just speed bumps on the information superhighway."

What's the point? Surely Clark must realize that even if Netscape
adds key escrow to SSL/Secure Courier, it is still possible to tunnel
real encryption through that link thus thwarting the escrow system.
In fact, this is the perfect job for Java:

1) Client connects to server thru insecure key-escrow channel and downloads
Java applet
2) Java applet opens new connection to server using "invincible" security
as Clark puts it, and performs add transactions on this channel. In fact,
in the future, a large number of "forms" will be Java applets which
submit information back to the server themselves.

  And what about IPSEC ESP? Even if the application layer is weak,
the link layer can more than make up for it.

  Now, Netscape has momentum, and if they set a key-escrow standard, there
is a chance of it being adopted widely. However, Java applets and IPSEC
can still make transactions through an insecure netscape payment/encryption
channel.

  The genie is out of the bottle.

-Ray

On Thu, 30 Nov 1995, Timothy C. May wrote:

> 
> Can Netscape continue to prosper? This latest issue won't kill it,

I suspect this will unfortunately help. Stockholders are interested in 
profits, not principles. Co-oping with the feds will help Netscape get to 
the commercial market sooner, and most customers, sadly don't give a damn 
about privacy (or don't understand).

Jay Holovacs <holovacs@ios.com>
PGP Key fingerprint =  AC 29 C8 7A E4 2D 07 27  AE CA 99 4A F6 59 87 90 
>

On Thu, 30 Nov 1995, Jay Holovacs wrote:

> On Thu, 30 Nov 1995, Timothy C. May wrote:
> > Can Netscape continue to prosper? This latest issue won't kill it,
> 
> I suspect this will unfortunately help. Stockholders are interested in 
> profits, not principles. Co-oping with the feds will help Netscape get to 
> the commercial market sooner, and most customers, sadly don't give a damn 
> about privacy (or don't understand).

<Rant mode on>
Clipper and family are vampires; shine some light on them and they're dead.
Witness the public ridicule of the FBI 1% scheme. Compare that to the near
mainstream silence about DT. The last round of Clipper was wonderful, for 
a while in '94 we had Time sounding like Brock Meeks.

If Jim Clark really does mean this nonsense then I hope he does a Dorothy 
Denning and takes his show on the road (sorry Jeff). This is simply 
easy fodder for journalists without a story, totally black and white 
cheap shot at the gov. While people don't give a damn about their privacy, 
they sure do get mad when they're shown how easy it is to take away. 
They *hate* hearing the $ cost.

Maybe some of the people on this list with higher profiles than myself should
start defending Clipper and GAK as loudly and stupidly as possible. I've 
grown dead tired of trying to get anyone around me interested in pgp,
remailers and whatnot. Reverse psycho sounds a lot easier:

"Noted counterterrorism expert Timothy May was quoted on Connie Chung Live 
last night as saying "Clipper, GAK and CTHULHU666 are a hundred billion 
dollar investment in your national security. Only through complete wiretapping 
will we save our nation's children from violent cigarette smokers, tax 
cheaters, unlicensed pit-bull owners, Tax 'n Spend Liberals, murderous Nation 
of Islam Dope Pushers, audiophiles, christians, fat people, OJ and 
jaywalkers on the infohighway." -USA Today" 

(Apologies. You may now killfile me with a clear conscience.)

If you can't beat 'em, subvert 'em.

Jay Holovacs writes:
> On Thu, 30 Nov 1995, Timothy C. May wrote:
> 
> > 
> > Can Netscape continue to prosper? This latest issue won't kill it,
> 
> I suspect this will unfortunately help. Stockholders are interested in 
> profits, not principles.

Netscape is currently trading somewhere like 7000 times earnings. What
profits are you talking about, precisely?

Perry

Jay Holovacs wrote:
| On Thu, 30 Nov 1995, Timothy C. May wrote:

| > Can Netscape continue to prosper? This latest issue won't kill it,
| 
| I suspect this will unfortunately help. Stockholders are interested in 
| profits, not principles. Co-oping with the feds will help Netscape get to 
| the commercial market sooner, and most customers, sadly don't give a damn 
| about privacy (or don't understand).

	Thats very true.  We should look at what stockholders tend to
care about (although, in the case of many internet stocks, it does
seem to be 'a bigger fool').

	One thing that stockholders do care about is liability.  Its
my (non lawyerly) opinion that anyone implementing GAK without a
government mandate to do so is opening themselves up to huge liability
the Clipper database of keys gets out.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

On Thu, 30 Nov 1995, Adam Shostack wrote:

> 
> 	One thing that stockholders do care about is liability.  Its
> my (non lawyerly) opinion that anyone implementing GAK without a
> government mandate to do so is opening themselves up to huge liability
> the Clipper database of keys gets out.

Well that would depend on the terms of the agreement to hold the escrowed 
keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
write the agreement so that it says, in essence, "we will try really 
really hard not to let the keys out, but if they get out, our only 
liability if to say 'Ooops' followed by a heartfelt apology!"

EBD


> 
> Adam
> 
> -- 
> "It is seldom that liberty of any kind is lost all at once."
> 					               -Hume
> 
> 

Not a lawyer on the Net, although I play one in real life.
**********************************************************
Flame away! I get treated worse in person every day!!

Brian Davis wrote:

| On Thu, 30 Nov 1995, Adam Shostack wrote:

| > 	One thing that stockholders do care about is liability.  Its
| > my (non lawyerly) opinion that anyone implementing GAK without a
| > government mandate to do so is opening themselves up to huge liability
| > the Clipper database of keys gets out.

| Well that would depend on the terms of the agreement to hold the escrowed 
| keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
| write the agreement so that it says, in essence, "we will try really 
| really hard not to let the keys out, but if they get out, our only 
| liability if to say 'Ooops' followed by a heartfelt apology!"

	I'm not sure thats true.  Allow me to argue by analogy.

	A car company, hearing the FBI's laments about cars being used
as getaway vehicles after bank robberies, starts a program of putting
explosives in all their cars, with radio detonators.  In an
unfortunate accident, some of the explosives go off for no reason,
injuring the owner of the car, etc, etc.  It seems to me that the car
maker would be quite liable for doing something stupid (putting
explosives in the engine block), even though they didn't cause the
explosion.

Adam

-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume

On Fri, 1 Dec 1995, Adam Shostack wrote:

> Brian Davis wrote:
> 
> | On Thu, 30 Nov 1995, Adam Shostack wrote:
> 
> | > 	One thing that stockholders do care about is liability.  Its
> | > my (non lawyerly) opinion that anyone implementing GAK without a
> | > government mandate to do so is opening themselves up to huge liability
> | > the Clipper database of keys gets out.
> 
> | Well that would depend on the terms of the agreement to hold the escrowed 
> | keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
> | write the agreement so that it says, in essence, "we will try really 
> | really hard not to let the keys out, but if they get out, our only 
> | liability if to say 'Ooops' followed by a heartfelt apology!"
> 
> 	I'm not sure thats true.  Allow me to argue by analogy.
> 
> 	A car company, hearing the FBI's laments about cars being used
> as getaway vehicles after bank robberies, starts a program of putting
> explosives in all their cars, with radio detonators.  In an
> unfortunate accident, some of the explosives go off for no reason,
> injuring the owner of the car, etc, etc.  It seems to me that the car
> maker would be quite liable for doing something stupid (putting
> explosives in the engine block), even though they didn't cause the
> explosion.

I'm presuming that the consumer is aware of the key escrow.  It would 
indeed be foolhardy for Netscape to try to hide that, given the liability 
problem and the cypherpunks available to discover the "hidden" escrow.

I they tell you about it and you buy it anyway -- tough luck.


Same with the cars.  Would *you* buy Pinto with explosives in it???? 
(leaving aside the "inherently dangerous" argument for the moment on the 
products liability claim).

EBD




> 
> Adam
> 
> -- 
> "It is seldom that liberty of any kind is lost all at once."
> 					               -Hume
> 
> 

Not a lawyer on the Net, although I play one in real life.
**********************************************************
Flame away! I get treated worse in person every day!!

On Fri, 1 Dec 1995, Brian Davis wrote:

> Well that would depend on the terms of the agreement to hold the escrowed 
> keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
> write the agreement so that it says, in essence, "we will try really 
> really hard not to let the keys out, but if they get out, our only 
> liability if to say 'Ooops' followed by a heartfelt apology!"

<IANAL>
This sounds like the fine print you "agree" to by opening commercial software
packages. Hasn't this been found void in a couple of places? The "OK"  or 
"I Agree" buttons I'm forced to press (but you don't *have* to download 
software, nya,nya,nya...) when downloading wares also comes to mind.
Has this been tested in a court? (Sega's reverse engineering suit from 
a while back comes to mind)

Pressing buttons is hardly the same as your notarized handwritten signature
on paper (we prefer blood, it's more permanent), or its digital equivalent.
Mere tokenism, not insurance. 
</IANAL>

About JR's concern about Netscape's shareholders, they're playing a bubble
market and they know it. I wish them all the money and luck; luck is 
something they're gonna need if this is to go on.

Ps. Netmanage websurfer ain't so bad, hint, hint, hint (detraction time 
netscape).

On Fri, 1 Dec 1995 s1113645@tesla.cc.uottawa.ca wrote:

> On Fri, 1 Dec 1995, Brian Davis wrote:
> 
> > Well that would depend on the terms of the agreement to hold the escrowed 
> > keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
> > write the agreement so that it says, in essence, "we will try really 
> > really hard not to let the keys out, but if they get out, our only 
> > liability if to say 'Ooops' followed by a heartfelt apology!"
> 
> <IANAL>
> This sounds like the fine print you "agree" to by opening commercial software
> packages. Hasn't this been found void in a couple of places? The "OK"  or 


"I agree" that shrinkwrapped licenses are problematic, at best.  I don't 
think the analogy applies, though.  Maybe I'm mixing threads up, but I 
thought the topic was "Why would anyone agree to escrow keys commercially 
-- given the high risk if the keys get out?"

If that is the topic, then the keys would be escrowed by one of two 
parties:  the software developer or the customer.  If the customer does 
it, through an active act on his part, then no problem -- he's expressly 
consented (not a "shrinkwrap license" problem in my view if he send them 
his key ...).

If the software developer gives the key to the C/GAK escrow agent, then 
all that should be necessary is to warn the consumer that there is a 
backdoor through the escrowed key.  Then the consumer can buy the product 
or not, but knows what he is getting so can make a choice.

As long as the escrow aspect is not hidden, I don't see any fraud.  The 
remedy is the marketplace.  It is a long fall from $5,000,000,000 ...

EBD




> "I Agree" buttons I'm forced to press (but you don't *have* to download 
> software, nya,nya,nya...) when downloading wares also comes to mind.
> Has this been tested in a court? (Sega's reverse engineering suit from 
> a while back comes to mind)
> 
> Pressing buttons is hardly the same as your notarized handwritten signature
> on paper (we prefer blood, it's more permanent), or its digital equivalent.
> Mere tokenism, not insurance. 
> </IANAL>
> 
> About JR's concern about Netscape's shareholders, they're playing a bubble
> market and they know it. I wish them all the money and luck; luck is 
> something they're gonna need if this is to go on.
> 
> Ps. Netmanage websurfer ain't so bad, hint, hint, hint (detraction time 
> netscape). 
> 

Not a lawyer on the Net, although I play one in real life.
**********************************************************
Flame away! I get treated worse in person every day!!

FWIW:

A guy from the Wall Street Journal was on the CNN biz show this morning 
explaining all the reasons why Netscape's stock value was supported only 
by religious belief.

This may have a depressing effect on the stock value, as well as the 
morale of Netscapes major stockholders.

bd


On Fri, 1 Dec 1995 s1113645@tesla.cc.uottawa.ca wrote:

> On Fri, 1 Dec 1995, Brian Davis wrote:
> 
> > Well that would depend on the terms of the agreement to hold the escrowed 
> > keys, wouldn't it?   And presumably the GAK keyholder will have lawyers 
> > write the agreement so that it says, in essence, "we will try really 
> > really hard not to let the keys out, but if they get out, our only 
> > liability if to say 'Ooops' followed by a heartfelt apology!"
> 
> <IANAL>
> This sounds like the fine print you "agree" to by opening commercial software
> packages. Hasn't this been found void in a couple of places? The "OK"  or 
> "I Agree" buttons I'm forced to press (but you don't *have* to download 
> software, nya,nya,nya...) when downloading wares also comes to mind.
> Has this been tested in a court? (Sega's reverse engineering suit from 
> a while back comes to mind)
> 
> Pressing buttons is hardly the same as your notarized handwritten signature
> on paper (we prefer blood, it's more permanent), or its digital equivalent.
> Mere tokenism, not insurance. 
> </IANAL>
> 
> About JR's concern about Netscape's shareholders, they're playing a bubble
> market and they know it. I wish them all the money and luck; luck is 
> something they're gonna need if this is to go on.
> 
> Ps. Netmanage websurfer ain't so bad, hint, hint, hint (detraction time 
> netscape). 
>