August 1993 - cypherpunks-legacy

Re: Digicash
by plmoses＠unix.cc.emory.edu 23 Aug '93

23 Aug '93

I dont see that a "reverse" ATM card (ie, one that was "charged" with money to spend) poses any greater risk to the bearer, IF some kind of authorization code/check is built into the card. What I am hazy on is how such an authorization could exist while avoiding the problem of creating a dossier. If the individual user could encode his own PIN on the card without telling the bank, that would do it. Or, the bank could know the PIN but if the Retailer's transaction software never *records* the PIN, then there will be no privacy problem...since there will be nothing to cross check against the bank's records. The retailer is happy cos he has HIS data (item sold, amount, date, etc); the consumer is protected, and the bank is not involved at all. Eh?

1 0

Better late than never, eh Stanton?
by plmoses＠unix.cc.emory.edu 23 Aug '93

23 Aug '93

>From hughes(a)toad.com Sun Aug 22 20:07:28 1993 >To: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Subject: [plmoses(a)unix.cc.emory.edu (Paul L. Moses): forwarding] >Date: Sun, 22 Aug 93 17:07:20 -0700 >From: hughes(a)toad.com > > >------- Forwarded Message > >Return-Path: plmoses(a)unix.cc.emory.edu >Received: from emoryu1.cc.emory.edu ([128.140.1.1]) by toad.com id AA25788; Tue, 17 Aug 93 09:19:15 PDT >Received: by > emoryu1.cc.emory.edu (5.65/Emory_cc.3.4.6) via MAILPROG > id AA17454 ; Tue, 17 Aug 93 12:19:07 -0400 >Return-Path: plmoses(a)unix.cc.emory.edu >Date: Tue, 17 Aug 93 12:19:07 -0400 >From: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Message-Id: <9308171619.AA17454(a)emoryu1.cc.emory.edu> >To: owner-cypherpunks(a)toad.com >Subject: forwarding > >>From anton(a)hydra.unm.edu Sun Aug 15 03:21:35 1993 >From: Stanton McCandlish <anton(a)hydra.unm.edu> >Subject: Re: On The Inherent Evil of Electronic Democracy >To: plmoses(a)unix.cc.emory.edu (Paul L. Moses) >Date: Sun, 15 Aug 1993 01:21:25 -0600 (MDT) >In-Reply-To: <9308121908.AA06721(a)emoryu1.cc.emory.edu> from "Paul L. Moses" at Aug 12, 93 03:08:00 pm >X-Mailer: ELM [version 2.4 PL21] >Mime-Version: 1.0 >Content-Type: text/plain; charset=US-ASCII >Content-Transfer-Encoding: 7bit >Content-Length: 3327 > >Quoth Paul L. Moses, verily I say unto thee: >- -=> >- -=>Regarding the Electronic Democracy idea, I vote with Tim May. Look at the > >Just the opposite here. > >One factor has been missing from this discussion. > >Representative "democracy" is a statist imposition. > >One other factor: > >The number of issues to be voted on is quite large. Even with easy access >via cable-tv data networks, public voting kiosks, etc, no one will be able >to keep up. This will immediately result in demand for LESS legislation, >which is a good thing no matter how you look at it. > >Simple requirements for quorums before a proposition comes up for voting >would head off most goofy bills right from the start. If you have to have >at least, say, 10% of the population to vote to ALLOW AN ISSUE TO EVEN BE >VOTED ON, most idiot bills will be nipped in the bud. One other thing >you'll see disappear is "private laws". Our congress wastes an incredible >amount of time and money working on laws that affect only one corporation, >or one small area. For one thing, most of this stuff is irrelevant as far >as the Law of the Land goes. It's not something our legislature should be >involved in. Let companies work out their own damn problems. For >another, local-area laws should be handled by local areas. Period. >In my opinion. > >The main objection I keep seeing is that all them loonies will vote for >stupid laws. I'd like to ask you how many of these people vote NOW? Not >very many. The idiotic, the lazy, and the careless do not vote, by and >large. The people that vote are the people that think about issues, and >decide that they want to do something about them. > >Anyway, when some of this comes about, and it is quite inevitable, I would >hope that a very least e-voting gives the people veto power, to directly >overturn anything passed by congress and the prez, and even the power to >kill bills before they even get past the discussion stage. Add to that >the right to directly propose legislation, provided there is a quorum, and >I think that would be a good starting point. > >If all Tim and others with the same views are upset about is that a sudden >change could result in utter chaos, I have no argument with that. The >changes must be gradual, so as to not cause a governmental backlash. I >can see just installing the system and cutting congress out of the picture >entirely. The resulting mess would be allowed to go on for about a month, >before the pres declared martial law due to national emergency, and then >it'd be all over. One thing that irritates the hell out of me about many >anarch[o-capital]ists and libertarians, is an all or nothing stance. Some >of you folks don't seem to clue to the ideas of compromise, gradual >change, long-term planning, and strategic retreat to throw an enemy off >balance. You aren't going to take the world by storm, and Tim's dire >predictions of a hell hole that would result if such occured are right on >the mark. Play our cards right, and we'll take the world by whispering breeze. > >- -- >Stanton McCandlish * Space Migration * Networking * ChaOrder * NO GOV'T. * >anton(a)hydra.unm.edu * Intelligence Increase * Nano * Crypto * NO RELIGION * >FidoNet: 1:301/2 * Life Extension * Ethics * VR * Now! * NO MORE LIES! * >Noise in the Void BBS * +1-505-246-8515 (24hr, 1200-14400, v32bis, N-8-1) * > > > >------- End of Forwarded Message > >

1 0

Re: Cracking & auditing crypto protocols
by Peter Wayner 23 Aug '93

23 Aug '93

I'm not sure whether it is fair to call Walter Tuchman a Real Cryptanalyst, but there are many reasons to suspect that he is a talented one. When he headed the IBM team developing DES, it is said (by Coppersmith) that they developed many attacks like what we now know as Differential Cryptanalysis. These contributed to their design of DES and I think it would be fair to say that the same principles could be used to assess the strength of the Clipper chip. A Mykotronix employee told me that it "Contains s-boxes and all that stuff." I don't know whether he was the one responsible for these insights back then, but he certainly was in the right place to learn alot by osmosis. -Peter

1 0

Munged account feeding old mail?
by fergp＠sytex.com 22 Aug '93

22 Aug '93

Am I the only one getting carbon copies of many of my own messages from someone else's munged account? 8<------------------------

2 1

No Subject
by XXCLARK＠indst.indstate.edu 22 Aug '93

22 Aug '93

fergp(a)sytex.com asks: >Am I the only one getting carbon copies of many of my own messages >from someone else's munged account? Nope. But I received one only, and that a bounce back from cypherpunks... Seemed to take several days to come back. >X-Delivery-Notice: SMTP MAIL FROM does not correspond to sender. >Received: from INDST (SMTP) by indst.INDSTATE.EDU (Mailer R2.08) with BSMTP id > 4801; Sun, 22 Aug 93 04:04:07 EST >Received: from nic.cerf.net by indst.indstate.edu (IBM VM SMTP R1.2.2MX) with > TCP; Sun, 22 Aug 93 04:04:06 EST >Received: by nic.cerf.net (4.1/CERFnet-1.0) id AA11147; Sun, 22 Aug 93 02:06:2 > PDT >X-Path: cerf!sdcoe!philly!lanleb!lebanon!daemon Sat, 21 Aug 93 23:45 >Received: by sdcoe DHL85510: Sat, 21 Aug 93 23:45 Version 2.2.1 18Aug93 >Date: Fri, 20 Aug 93 11:02 edt >From: daemon(a)lebanon.cerf.fred.org (FMF Mailer Version 2.03 19apr93) >To: xxclark(a)indst.indstate.edu >Subject: returned mail >Message-Id: <DHL85510(a)sdcoe.cerf.fred.org >Error: User "dhaise" isn't on lebanon >----------returned message---------- >From lanleb!philly!sdcoe!toad.com!owner-cypherpunks Wed, 18 Aug 93 02:36 >Received: by lanleb.cerf.fred.org Version 2.02 6apr93 > id DHI00002; Wed, 18 Aug 93 02:36 edt >Date: Tue, 17 Aug 93 01:24:07 EST >Ppath: lebanon!dhaise >From: XXCLARK(a)indst.indstate.edu >To: cypherpunks(a)toad.com > ... >----------end of returned message---------- > daemon lebanon 8/22/93

1 0

Re: "Secure Voice"
by geoffw＠nexsys.net 22 Aug '93

22 Aug '93

Anybody know about the voice capabilities of the ZyXel class modems? I own a ZyXel 1496E which can digitize voice and also transmit voice data that has been digitized. It would be easy to first encript this stream before sending it out. The 1496E+ also support CELP (or is it (CLEP?) but that one cost about $400. (The 1496E is around $300) It also is a 14.4 K baud modem and does FAX.

2 1

"Secure Voice"
by bart＠netcom.com 22 Aug '93

22 Aug '93

Just received a low budget brochure from SVC offering their "Secure Voice" TM software for $250. Used with a '386 minimum, a Sound Blaster board, and a 14.4K V.42 modem they claim to do compression and DES encryption (triple DES with a '486). "You talk into your computer, the computer digitizes your voice, encrypts it, transmits it through the high speed modem over the open phone lines to the other end, where it is decrypted, and can be heard." They indicate you need one "Secure Voice" for each end so I'd guess they have it copy protected. "No BS Updates: ... As a purchaser, you are entitled to free software updates for the life of this product. We keep no records of who purchases our products, so to receive your update, send us your original disk and a SASE." Their address: PO Box 9512 College Station, TX 77842 Texas residents add 8.25%, VISA/MC add 5%

1 0

(fwd) [prodigy] Am-prodigy correction
by emv＠mail.msen.com 22 Aug '93

22 Aug '93

This came over our Reuters wire - it looks like the Prodigy message in question was not a private message, but rather a message on a public forum (where Prodigy is known to monitor such things.) I wonder whether this correction is going to get press in the print media, most of which are not likely to be hip enough to be able to convey the difference to their readers (who are not necessarily likely to know or care). --Ed From: reuters(a)msen.com (Msen Reuters News) Newsgroups: msen.reuters.domestic Subject: [prodigy] Am-prodigy correction Date: 21 Aug 1993 20:54:46 -0400 Organization: Msen, Inc. -- Ann Arbor, MI (acct info +1 313 998-4562) Keywords: AM-PRODIGY AM-PRODIGY CORRECTION In MEDINA, Washington item headlined U.S. TEENAGER FINDS DEATH 'THREAT' HAS ITS PRICE please read in 3rd graf ...The girl told police she made the threat in a message on an electronic bulletin board... instead of ...in an electronic message. (Correcting form of transmission of message). A corrected story follows immediately. REUTER

1 0

anecdote about Prodigy
by L. Detweiler 21 Aug '93

21 Aug '93

ah, the perils of surveillance & censorship... ===cut=here=== Subject: Prodigy intrusiveness causes bogus security scare Date: Fri, 20 Aug 93 19:52:17 -0700 Subject: 14-year-old's computer 'joke' sets off alarms nationwide Date: 19 Aug 93 23:51:17 GMT SEATTLE (UPI) -- A seemingly innocuous joke sent by a 14-year-old girl over a computer network didn't get any laughs at the New York City Police Department, or with the Baltimore Orioles or Kingdome officials in Seattle. In an attempt to get a rise out of her boyfriend in New Jersey, the teenager typed out a phony death threat Monday against Baltimore Orioles superstar Cal Ripkin, Jr. The young girl knew her boyfriend was an avid Orioles fan and that Baltimore was playing the Seattle Mariners in the Kingdome. But Prodigy security personnel picked up on the message in their New York headquarters and called police. They notified the Orioles and the Kingdome, where security was immediately tightened. Police staked out the address from where the message had come for 16 hours before the girl, whose parents were on vacation, returned home with her 28-year-old sister. The girl received a stern lecture, but no charges were filed. Police said she was ``very embarrassed and apologetic'' and added, ``By the time her sister got done chewing her out, that was enough.'' ------- End of Forwarded Message

1 0

mail header parser?
by bill＠twwells.com 21 Aug '93

21 Aug '93

I'm in the process of updating my anonymous server. Up till now, I've relied on a really brain-dead parsing of the mail headers. This is good enough essentially all of the time; it may even be good enough all of the time (on the theory that those addresses it rejects violate de facto standards even if they don't violate de jure ones). Nonetheless, if there is a simple *and* correct mail header parser (Internet and uucp-style), I'd appreciate a pointer to it. Ya know, I *hate* testing sometimes. Eventually I want to release this thing but I want a test suite to go with it -- and I think the damned suite will be bigger than the server!

3 2