Re: The GAK Momentum is Building...

>On Tue, 17 Sep 1996 21:02:03 -0700, Lucky Green wrote:
>>On Tue, 17 Sep 1996, Timothy C. May wrote:
>> However, making the government a _required_ part of such plans implies a
>> motive that is not at all the same as what companies wish (mostly, disaster
>> recovery).
>
>The required part will come later. Meanwhile, many big players in the
>industry are volunteering to include GAK for you.

It seems that in order for this to work Net consumers must be
convinced/coerced into accepting the GAK security features.  What if, due
to a grassroots uprising, Neters refuse to use products which require GAK
or Net services which will only operate via GAK?  Isn't there an great
opportunity being created for S/Wan, Apache and its ilk and third-party
(especially off-shore, non-COCOM, produced) security plug-ins?

>
>When I asked the fellow from HP that proposed the CommerceNet position
>paper how the "voluntary key recovery" he was proposing on his slides
>could possibly aid law enforcement against criminals who obviously
>wouldn't "escrow" their keys, he said, and I am not kidding:
>
>"There are many possible interpretations of the words voluntary and
>mandatory." I was the *only* person in a room full of people working in the
>industry that seemed bothered by this.
>
>> Furthermore, the main worry (for me, at least) is that the government hopes
>> to get its Clipper IV scheme accepted (by means of export laws) at some
>> large fraction of important corporate accounts, not the least of which will
>> be Netscape, Microsoft, IBM, Oracle, Qualcomm, and suchlike major players
>> in the "infrastructure" business. Once most of these have "bought off" on
>> GAK, pressure will be intense to universalize the process, to make it a
>> felony _not_ to use a "Key Authority."
>
>That's exactly how it will be.

Enacting laws which make criminals out otherwise upstanding citizens is the
surest path to civil disobedience/unrest, disrespect for duly constituted
government and more serious criminal behavior.  I guess I and many friends
will be on posters in the Post Office.

-- Steve


PGP Fingerprint: FE 90 1A 95 9D EA 8D 61  81 2E CC A9 A4 4A FB A9
---------------------------------------------------------------------
Snoop Daty Data           | Internet: azur@netcom.com
Grinder                   | Voice: 1-702-655-2877
Sacred Cow Meat Co.       | Fax: 1-702-658-2673
7075 W. Gowan Road, #2148 |
Las Vegas, NV 89129       |
---------------------------------------------------------------------

Just say NO to perscription DRUGS.

On Wed, 18 Sep 1996, Steve Schear wrote:
> It seems that in order for this to work Net consumers must be
> convinced/coerced into accepting the GAK security features.  What if, due
> to a grassroots uprising, Neters refuse to use products which require GAK
> or Net services which will only operate via GAK?  Isn't there an great
> opportunity being created for S/Wan, Apache and its ilk and third-party
> (especially off-shore, non-COCOM, produced) security plug-ins?

Simple. Incentivize sites/server/payment system manufacturers to require 
certs from their users. This is already underway. See SET. Then make sure 
that the certs/keys are GAK'ed. Yes, I know there is a difference between 
certs and keys. Joe User doesn't. Neither does the media. It is a two step 
process.

> Enacting laws which make criminals out otherwise upstanding citizens is the
> surest path to civil disobedience/unrest, disrespect for duly constituted
> government and more serious criminal behavior.  I guess I and many friends
> will be on posters in the Post Office.

Those of us that won't have "reformed", have been shot, or imprisoned, 
will indeed be on the posters in the Post Office. And the banners on all 
major websites.

--Lucky

Lucky Green wrote:

| On Wed, 18 Sep 1996, Steve Schear wrote:
| > It seems that in order for this to work Net consumers must be
| > convinced/coerced into accepting the GAK security features.  What if, due
| > to a grassroots uprising, Neters refuse to use products which require GAK
| > or Net services which will only operate via GAK?  Isn't there an great
| > opportunity being created for S/Wan, Apache and its ilk and third-party
| > (especially off-shore, non-COCOM, produced) security plug-ins?
| 
| Simple. Incentivize sites/server/payment system manufacturers to require 
| certs from their users. This is already underway. See SET. Then make sure 
| that the certs/keys are GAK'ed. Yes, I know there is a difference between 
| certs and keys. Joe User doesn't. Neither does the media. It is a two step 
| process.

	The problem with GAK in financial systems is that it makes
your non-repudiation repudiable.  It also opens you to the CIA using
your bank to finance a revolution in Central America.  Think of it as
a revolutionary tax. ;)

Adam


-- 
"It is seldom that liberty of any kind is lost all at once."
					               -Hume