August 1993 - cypherpunks-legacy

Re: cypher breaking and genetic algorithms
by baumbach＠atmel.com 20 Aug '93

20 Aug '93

Scott Collins writes: >[...] > between. Being one bit off in the key should give a totally fruitless > result. GA's don't help much with such ciphers. >[...] What if the GA "knew" the plain-text, the cyphertext, and the encryption algorithm, and was searching for a decryption algorithm without the encryption key? Would that be for fruitful? Peter Baumbach baumbach(a)atmel.com

1 0

No Subject
by remailer＠merde.dis.org 20 Aug '93

20 Aug '93

1 0

Re: Traveller's Checks...
by baumbach＠atmel.com 20 Aug '93

20 Aug '93

Peter Wayner says: > I think that American Express wouldn't be interested in > anonymous cash because the most important "feature" of > a traveller's check is the lack of transferability. Once > they're bought, only one person can spend them. >[...] I think American Express would be interested in collecting a percentage of the cash-flow. The underground economy is pretty big. Wouldn't it be nice to get a percentage of it? Peter Baumbach baumbach(a)atmel.com

2 1

Re: Traveller's Checks...
by jim＠tadpole.com 20 Aug '93

20 Aug '93

> > I think that American Express wouldn't be interested in > anonymous cash because the most important "feature" of > a traveller's check is the lack of transferability. Once > they're bought, only one person can spend them. I doubt that Amex is interested in traveller's checks for this reason. AMEX likes traveller's checks because they make a lot of money on the 'float', the time value of the money you give them before they have to redeem the checks when some bank presents them for payment. A digital bank could make a lot of money on 'float' too. Given that anonymous cash could be much harder to steal than paper checks, AMEX could very well be interested in this 'new' type of monetary instrument. Jim

2 1

Genetic Algorithms and password cracking
by an31122＠anon.penet.fi 20 Aug '93

20 Aug '93

Hi, If my understanding of GAs is correct (not a given), they operate by progressively narrowing the search space until they arrive at the solution. More clearly, each generation uses information gleaned from previous generations to guide the current search. The operation depends on being able to take two sets of input parameters and decide which operates better than the other. I'm not a cryptographer, so I don't know whether there is a way to find out if an answer is "close" to the actual. If not, GAs will probably be of little use. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

T. Wells & Anonymity
by L. Detweiler 20 Aug '93

20 Aug '93

My last response to Mr. Wells was in private and I hoped he would take that course himself in future communication, but as it stands he now has screamed insults at me twice in a row in this forum, and I must address his latest unanswered letter; most of these following points are from my private letter. The fundamental issue at stake is: is Mr. Wells routinely and regularly monitoring the content of the email he forwards via his so-called `anonymous server'? The answer is: definitely. To do so is very ethically borderline, IMHO, no matter who his `family'. This was enough to alarm me seriously to the point of writing a very vehement letter condemning this type of `surveillance'. Yes, he has provided this service for a long time, he is doing so voluntarily, he has a select group of participants with a particular sensitivity and need, `most' of whom are satisfied with it, this I all acknowledge. However, it's evident to me that all users of anonymous services have a set of unconscious expectations, foremost among them that the operator will not routinely be reading their mail. I pointed out to Mr. Wells that breaking the violation of trust in privacy may lead the operator to breach the trust in anonymity. Merely the knowledge of content can lead the operator to serious quandaries that can be wholly avoided in completely adhering to privacy. Furthermore, an operator who does not strive to adhere conscientiously to the set of unconscious user expectations, even if working on a voluntary basis, is actually doing his users a disservice. Mr. Wells' rambling letter, replete with references to his personal philosophy of Objectivism, is a complicated set of rationalizations that amount to `yes, I regularly monitor my server's email traffic, in fact I consider it my duty.' Given his unswerving obstinacy to this practice, I asked that he make this policy clear in his introductory statements to the server, but he has consistently failed to reassure me that he actually has done so, making me wonder to what extent of the readers in the newsgroup and of his server (a substantial overlap according to him) are aware of this very serious matter of `systematic observation'. Are any people using this server as a plain vanilla server, or do they all realize that they are establishing a very strong personal arrangement of trust with this operator, who considers their relationship analogous to the protective Platonic intimacy between a therapist and his patients? Who will personally censor messages he thinks will unduly upset them? Mr. Wells tells us that `this is neither the time nor the place to discuss the wherefors and whys of abuse recovery; you'll just have to take it as a given that the rules used for understanding people in general won't work so well when applied to this newsgroup, or to my anonymous service.' Mr. Wells, I don't claim to be a specialist in the area as you insinuate yourself, but I believe there are fundamental laws of respect and candor that are appropriate -- *necessary* -- for *all* people, and my concern is precisely that you may be not be adhering to it in this case in presenting your policies. Your polarized dance of defensiveness and offensiveness indicates to me clearly a nerve has been struck. Mr. Wells' letter is full of seemingly contradictory statements. He seems to think that `confidentiality' and `privacy' are `two distinct functions', and suggests that in his regular email monitoring he actually achieves a `tighter, higher standard of confidentiality' than Helsingius or Kleinpaste's servers. Also, his attitudes on the limitations of his actual commitments to the people who use his service are extremely disturbing. He says `Their rights do not extend to arbitary protection of their confidentiality or privacy' and the actual protections granted are `mine to choose' and `not implicit in an anonymous server'. I find these comments simultaneously highly revealing and alarming. From my point of view the sheer all-encompassing trust awarded a server operator by users requires every conceivable commitment on the latter's part to *transcend* the common denominator in user expectations of privacy. Mr. Wells says he personally handles `half the traffic' of the sexual abuse recovery newsgroup, and that `most' of its users and his `potentially legitimate' correspondents are satisfied, and that most people who have `expressed dislike for my policies' are coincidentally `outsiders'. His service is `integral to a specific community'. Perhaps so, but how would he react to another server operator specifically serving that group? His statements seem to reflect a perverse pride in his monopoly on the group's anonymity and secret knowledge of its participants. IMHO, this is precisely the kind of extremely compromising position encryption would effortlessly avert. Finally, I'm extremely disappointed in Mr. Wells transparently vitriolic rhetoric to deflect the primary issues of systematic monitoring and truth in advertising to ugly subsidiary sideshows, such as with his expert diagnosis of me as `mentally unbalanced'. This classicly ridiculous ad hominem insult is particularly ironically insensitive coming from someone who professes to tiptoe around areas requiring the utmost delicacy in human interaction in supporting people with mental anguish! Yes, my mind is indeed teetering on the brink of a breakdown -- from Mr. Wells blows, who says of me, `he should consider himself honored that I bothered to tell him where he went wrong.' -- such words bespeak an attitude of shocking, sickening arrogance and intolerance. Caveat emptor! P.S. I will respond no further to Mr. Wells in this forum.

5 4

Parallel DES Decrypt Experiment
by nobody＠shell.portal.com 20 Aug '93

20 Aug '93

> Recent postings have gotten me to thinking: If we wrote a > easily portable UNIX program to decrypt DES in parallel across > our many machines, how fast could we go? > What do y'all think? I say do it as an experiment. That's how I always justified doing crazy stuff as a child. Besides, as a non-programmer, I am exempt from actually doing any work on the project.

1 0

"Clipper" in Norway (FYI)
by HELGE RENE URHOLM 20 Aug '93

20 Aug '93

The Department of Defence in Norway have given permission to develop a new crypto-chip to use in all public and confidential data, which has been collected about persons and groups. The algorithm is secret. The chip has been compared with the American Clipper-project. The Department of Defense will be administering the keys, and the user will have no choice whether they want to use the chip or not. They are even trying to enforced the health system to use this chip. Last week Hans Olav Oestgaard (head of the Norwegian secret service) said he wanted a law which enforce companies and single persons to encrypt all information such that the secret service can access the information in a simple way.

1 0

Violent Revolution?
by nobody＠alumni.cco.caltech.edu 20 Aug '93

20 Aug '93

++> From: koontzd(a)lrcs.loral.com (David Koontz ) + >Cypherpunks are providing the basis for long-range, (relatively) secure + >communication between those activists and thinkers who may have the + >power to bring down the State and restore the individual autonomy this + >nation was originally devised to foster. ++> As I understand it the Libertarian Party qualifies membership to ++> exclude any endorsement of violent overthrow of government. 1] I didn't see that the writer said anything about Libertarians. 2] I didn't get the impression that the writer was specifically calling for the violent overthrow of the government, only that he/she believed that actual violence _might_ eventually come. ++> While some ++> portion of those affected by this policy may well have gone ++> underground... Of course, I cannot personally say with any accuracy, but I feel strongly that a private ("underground," if you prefer) network of those discussing radical options must exist as a direct result of more secure communication. I have no evidence of this, but it seems like such an obvious and irresistable consequence that I can't picture it NOT happening, especially considering the numbers of pissed-off people using computer networks these days. ++> I don't believe that cypherpunks as a committee of the ++> whole are willing or ready to do so. 1] I didn't get the impression that the writer was saying that Cypherpunks were part of any such conspiracy, if it even exists, but only that Cypherpunks tech aided their communications. 2] I have also never been clear on how formal an organization Cypherpunks actually are - if they actually have a platform or a membership roster or secret handshakes or have turned the word "Cypherpunks" into a registered trademark with marketing licensed for logoed adjustable size baseball caps and childrens' lunchbox sets. Is there sufficient officialness for the result of a nut with "CYPHERPUNKS!" on his chest in Magic Marker biting off Hillary Roddam's left thumb at a press conference to be the forfeiture of Tim May's personal fortune under RICO? I wonder. ++> Then again as someone pointed out yesterday, cypherpunks aren't just ++> libertarians... Whatever gave you the idea that they were? ++> Some ++> portion, however large of those receiving this mailing list, may not ++> agree with this political leaning and may not consider it germaine to ++> their participation. Certainly true enough, but who claims to "speak" for cypherpunks anyway? ++> Avoiding the appearance of endorsing the violent overthrow of ++> government is prudent policy for any organization. Hell, yes. If I were signing my name to stuff, I'd be as benightedly pro-Statist in my posts as David Sternlight himself.

1 0

Re: Physical to digital cash, and back again
by hfinney＠shell.portal.com 20 Aug '93

20 Aug '93

I agree with Anonymous that there are problems with the actual use of digital cash in the near term. But it depends to some extent on what problem you are trying to solve. One concern I have is that the move to electronic payments will decrease personal privacy by making it easier to log and record transactions. Dossiers could be built up which would track the spending patterns of each of us. Already, when I order something over the phone or electronically using my Visa card, a record is kept of exactly how much I spent and where I spent it. As time goes on, more transactions may be done in this way, and the net result could be a great loss of privacy. Paying in cash is still possible through the mail, but it is insecure and inconvenient. I think that the convenience of credit and debit cards will overcome most people's privacy concerns and that we will find ourselves in a situation where great volumes of information exist about people's private lives. This is a place that I could see digital cash playing a role. Imagine a Visa-like system in which I am not anonymous to the bank. In this model, imagine that the bank is granting me credit similar to a credit card. But instead of giving me just an account number which I read over the phone or send in an email message, it gives me the right to request digital cash on demand. I keep some digital cash around and spend it for transactions as I described in my previous posts. When I get low I send some email to the bank and get some more dcash. Every month I send a check to the bank to cover my account just as I do with my credit cards. My relations with the bank are very similar to my current relationships with the credit card companies: frequent withdrawals and a single payment each month by check. This has several advantages over the system which we are heading towards. No records are kept of where I spend my money. All the bank knows is how much I have withdrawn each month; I may or may not have spent it at that time. For some transactions (e.g. software) I could be anonymous to the vendor; for others the vendor might know my real address, but still no central location is able to track everything I buy. (There is also a security advantage over the ridiculous current system in which knowing a 16 digit number and an expiration date allows anyone to order anything in my name!) Furthermore, I don't see why this system could not be as legal as current credit cards. All that really differs in this system is the inability to track where users spend their money, and as far as I know this ability was never an important legal aspect of credit cards. Certainly nobody will admit today that the government has a vested interest in moving towards an environment in which every financial transaction is tracked. Granted, this does not provide full anonymity. It is still possible to see roughly how much each person spends (although nothing stops a person from withdrawing much more cash than he will spend in a given month, except per- haps for interest expenses; but maybe he can lend the extra digicash itself and gain interest on that to compensate). And it is oriented around the same customer/vendor model that Anonymous criticized. But I maintain that this model represents the majority of electronic transactions, today and in the near future. It's worth noting that it is not trivial to become a merchant who can accept credit cards. I went through this with a business I had a couple of years ago. We were selling software through mail order, and this makes the credit card companies very nervous. There is so much phone fraud in which credit card numbers are accumulated over a few months, then large amounts of charges made against them. By the time the user receives his monthly statement and complains, the vendor has disappeared. In order to get our credit card terminal we went to a company which "helps" startups with this. They seemed like a pretty shady outfit, themselves. We had to fudge our application to say that we'd be selling something like 50% of the units at trade shows, which apparently counted as over-the-counter sales. And we had to pay about $3,000 up front, as a bribe, it seemed. Even then we probably couldn't have done it if we hadn't had an office in the business district. Under the digital cash system, this might be less of a problem. The main problem with digital cash is double-spending, and if you are willing to go with online verification (reasonable for any business which is going to take anything over several hours to deliver the merchandise) this can be completely prevented. So there is no longer any possibility of merchants collecting credit card numbers for later fraud. (You still have problems with non-delivery of merchandise, though, so not all risks are eliminated.) This might eventually make the system more widely available than current credit cards. I don't know whether this system could be used to support illegal actions, tax evasion, gambling, or whatever. That is not the purpose of this proposal. It does offer the prospect of improving personal privacy and security, in a framework that might even be legal, and that's not bad. Hal Finney hfinney(a)shell.portal.com

1 0