August 1993 - cypherpunks-legacy

Physical to digital cash,
by Duncan Frissell 18 Aug '93

18 Aug '93

To: cypherpunks(a)toad.com N>Pretty exhausting for the typical service industry. Most customers N>will pick the service that's easier to sign up for, They used to think this about PCs in general but we now have a hard core of fairly sophisticated PC users that support sophisticated software/hardware. Crypto will be a niche market for a while but there are enough "motivated buyers" out there to support a large market. These buyers would include the retail pharmacutical trade, deadbeat dads, wagering, the 10 million tax non-filers and the other 10 million filers who practice tax evasion, upscale illegal aliens, the politically motivated, a portion of the financial services industry. Obviously, people won't buy until they see a "must have" application. What will be the "Visicalc" of digital anarchy? Offshore debit VISA cards linked to anonymous accounts? If I knew of an institution offering same, I could "sell" thousands of such accounts tomorrow even with an unfriendly user interface. N>Also, the issue of which parts of these schemes are *legal* N>is critical, but being completely overlooked. Any lawyers N>out there with comments on this? As long as the phyical part of the institution is in a tax haven jurisdiction, digital cash should be legal. Most haven jurisdictions allow bank accounts in the names of businesses owned by the holders of bearer shares. Those haven jurisdictions that are in what is now the European Free Trade Area (or whatever they're calling it this month) such as Austria, Gibraltar, The Channel Islands, and Isle of Man may lose their ability to offer anonymous accounts as EEC rules tighten but there are many other jurisdictions. Also, not enough work has been done in the area of non-anonymous anonymous accounts. If an account is in the name of an institution (company, etc) beneficial ownership may be just as difficult to determine as with a genuine anonymous account. A haven-based cutout which holds accounts in ordinary jurisdictions can do many usefull things. The proliferation of non-bank banks like money market funds also provide other opportunities. "No Truce with Kings" Duncan Frissell Teaching individuals the technology of liberty since 1969 - Frissell & Associates Privacy Consulting. --- WinQwk 2.0b#0

1 0

The Zen of Anonymity
by L. Detweiler 18 Aug '93

18 Aug '93

Given: Some graffiti is on the wall. Question: who is `responsible' or `liable' for graffiti? the `vandal' (or `artist')? the owner of the wall? society? What if no means exists whatsoever to identify the originator? or the owner of the wall actually *encourages* people to use it for whatever purpose? And socially beneficial uses ensue? Given: something `illegal' in country A but not in B has been written on a piece of paper. The paper now resides precisely between, exactly on the border, of A and B. Question: Who is the criminal? What is the crime? the writer for treason? the paper transporter for violating export laws? the border guards for not shooting? Again, what if the writer is unidentifiable, the transportation automatic, guarding impossible? What if there is actually a great deal of utility in the transportation of paper-scrawl across borders, for everyone involved? (Note that answers like `it behooves us all to ...prevent the spread of graffiti' or `...prevent the spread of illegal papers to borders' would be worthy of the NSA but pathetically beg the questions.) * * * IMHO, anonymous postings and email have the same legal status of graffiti or the paper on the border. No one is `responsible' or `liable' for the content of graffiti, no laws apply to the paper. Precautions can be taken to limit `offensive' or `illegal' graffiti (whatever that is!) and contrain the transport of writing on paper, but nothing can be done to completely eradicate either, save erecting the most totalitarian system the world has ever seen (a phrase coined by T.C. May, my respect). Perhaps we should have licensing laws for graffiti `vandals' or paper carriers? registers next to all the walls and streets so they can sign in? `Scrawling implement' or `communicable media' bans? Or panning cameras mounted in every 10 foot square area of space in the world? Human identification tags and tracking systems? We have this thing called `cyberspace' that has nothing to do with the laws of any country and comprises nothing but innocuous electrical or light streams coursing through wires and fibers, and trying to impose some system of `accountability' or `responsibility' or `liability' on every last element is an archaic, horrifying, but thankfully obsolete and conceptually impossible artifact from the `dark' ages. Yes, people can choose to become agitated by the *perceived* contents, but people can also choose to starve for a cause. There is no limit to the persecutions invented by the imagination of humanity. Offense is in the lie of the beholder. Libel, slander, sedition, thought crimes: what do these words mean? Whatever meaning they once had is completely dissolved upon the advent of true anonymity. Perhaps if others quiet their minds, they too will hear the sound of one hand clapping.

5 4

Re: The Zen of Anonymity
by smb＠research.att.com 18 Aug '93

18 Aug '93

>Given: Some graffiti is on the wall. >Question: who is `responsible' or `liable' for graffiti? This question already has a known answer. The author of the words is the one that is liable for them. No other parties are liable unless they had prior knowledge; this would make them conspirators. However, under certain circumstances the owner of a facility can be held liable for not removing libelous graffiti. I picked up a paper from the net some time back (/telecom-archives/sysops.libel.liability on ftp.lcs.mit.edu, ``Defamation Liability of Computerized BBS Operators & Problems of Proof'', by John R. Kahn) which discusses that point. The judgement is context-dependent -- one court noted that different standards apply to a New York subway car [sic] than to the interior of a manufacturing plant -- but the general rule is that if you know of some defamatory graffiti on your property, you're obligated to remove it.

1 0

Re: Private legal tender
by wcs＠anchor.ho.att.com 18 Aug '93

18 Aug '93

Writing anonymously, Sugarplum suggests: > Customer sends cash or money order to digital bank, along with a floppy > with an anonymous email address (via a remailer) and a public key. > The bank emails the customer encrypted digital cash corresponding to the > amount he sent in (minus any service charges). The problem with this is that the bank or clerks aren't accountable - they can pocket the snail-cash and not send the digicash "Oh, darn, the floppy's blank" or "Oh, darn, the email bounced" "Guess there's nothing I can do, what a shame" just as they could if you snailmailed cash to a conventional account. If you're sending non-accountable-by-sender cash, you need some way to get a receipt. If you're mailing a check or digicash, you have a way to repudiate the transaction or at least make a claim against them, or if you can go in to the bank in person for the transactions with cash. Bill # Bill Stewart wcs(a)anchor.ho.att.com +1-908-949-0705 Fax-4876 # AT&T Bell Labs, Room 4M-312, Crawfords Corner Rd, Holmdel, NJ 07733-3030

1 0

No Subject
by anonymous＠extropia.wimsey.com 18 Aug '93

18 Aug '93

> From: pmetzger(a)lehman.com ("Perry E. Metzger") > To: "L. Detweiler" <ld231782(a)longs.lance.colostate.edu> > *we* *are* our government. How can it not be more obvious? What does it > say about our character if we are resigned to deprivation? > WE ARE NOT OUR GOVERNMENT. > I have an interesting fact for you, Mr. Detweiler. I did not choose > the government I live under. I chose none of its parts, agreed to none > of its actions, selected none of its members (not one person I've ever > voted for has been elected, and I only vote in self defense, not as an > endorsement of the system), and I agree with virtually none of its > actions. Sadly, this is the best country I know of to live in, so > leaving is not an option. However, don't for one minute claim that > this is *my* government. It is the government that rules me, to be > sure, but it is my master, not my servant. I would not choose to have > it operate as it does were I given the choice. It is not mine. Yes, absolutely. This discussion may be considered tangential, but the issue here is at the core of the cypherpunks raison d'etre. Detweiller seems to be tremendously confused about the source of government and unaware of the emergence of the American State. I personally feel that I have zero representation in what passes for our "democratic" government for the reasons you mention, exactly. I find myself amazed to encounter the numbers of "mainstream Americans" who have gradually come to the same conclusion, independent of outside prompting. My only hope, personally, is to fight vigorously (perhaps literally, in due course) for the maintenance of the Bill of Rights as protection against the tyranny of _both_ the mob and the State. I personally see the prospect of an electronic so-called democracy to be terrifying, a mechanism whose technical subversion would be trivial for the State's assets, say the NSA. Simple manipulation by propaganda would be even easier. Read Orwell. Read Zamyatin. Cypherpunks are providing the basis for long-range, (relatively) secure communication between those activists and thinkers who may have the power to bring down the State and restore the individual autonomy this nation was originally devised to foster. In the past year I have had the privilege to see a de facto cadre of brilliant men and women develop from formerly isolated individuals, all thanks to computer networks and the emergence of secure communication. I have found answers to questions I have been asking for twenty-five years, and provided information that answered similar questions for others. I have seen the product of these private communications develop into public statements that have demonstrably influenced the political outlooks of hundreds, perhaps thousands, of casual computer network users. The ability of computer networks and secure communication has in itself empowered and radicalized an otherwise disenfranchised body of valuable and vital Americans. Really, this is heady stuff. It gives me reason to stick around and watch this country for a few more years.

1 0

No Subject
by anonymous＠extropia.wimsey.com 18 Aug '93

18 Aug '93

Uu> Actually, Julf's solution isn't too bad. It is if your gate won't process the password header line. Uu> Maybe Julf needs to bite the bullet and start using PGP. That would be nice. I particularly enjoy using the PGPed remailer at remail(a)extropia.wimsey.com, which is not only private, but reliable and damn near grunge-proof.

1 0

Physical to digital cash, and back again
by nobody＠rosebud.ee.uh.edu 18 Aug '93

18 Aug '93

> A simpler variation... > Customer sends cash or money order to digital bank, along with a floppy > with an anonymous email address (via a remailer) and a public key. For any real business, the customer comes from the 99.99% of the population that are not hacker/cypherpunks, not the one or two dozen people who are. These protocols aren't at all simple for the customer, unless the vendor (the same or another vendor) provides some free software on the net or by mail to automate the process (eg PGP with a user-freindly shell for generating the key, and a script for creating an anon e-mail address). But then we have several steps: (1) customer reads ad about cool net.service (a) they contact directly (but this ruins privacy) (b) they contact independent distributor of PGP key and anon-remail address generating software. (but how does customer trust _them_?) (2) vendor sends key & address generators (via e-mail or floppy), and physical-mail-security instructions (3) customer sends in money order (from mail drop or without return address!) along with chosen anon e-mail address and public key. (4) vendor sets up account and e-mails the d-cash. (5) we still need a physical mail drop or bearer bank account for withdrawals, refunds, etc. of physical cash. Pretty exhausting for the typical service industry. Most customers will pick the service that's easier to sign up for, even if some ivory-tower critics criticize its security. Security and privacy are very easy to hype, but often difficult to prove to the layman, who doesn't know or care about the math. Digressing a bit, we could use some sort of independent (not government-run please!) certification company, which takes (perhaps in alliance with liability insurance providers) responsibility for examining the service's computer programs and protocols and giving out "privacy ratings". Secure vendors could then use "Whit Diffie certified, top privacy rating" in their ads. Also, the issue of which parts of these schemes are *legal* is critical, but being completely overlooked. Any lawyers out there with comments on this? The best protocols for legal and illegal operations may be very different, legality of digital cash will vary between jurisdictions, etc. And what about certifying agencies that call a protocol "insecure" simply because it supports activities illegal in their jurisdiction, not for any reasons of physical or software privacy? The cases of illegality and physical/software security are both important risk factors for the vendor, customers, and liability insurers to consider, but ratings for each should be quite distinct. But this discussion is too abstract. We need a real, visceral example. The enclosure below illustrates some of the some legal and privacy issues of a Mom & Pop BBS operation in the pre-d-cash era. This service could use some privacy -- it's an on-line football game with a $35 sign-up fee and cash "prizes." I don't know whether or not it's legal for the vendor, but it's certainly illegal for a significant subset of potential net.customers. There will be thousands of these little on-line services springing up in the near future, if there aren't already. The BBS# is area code (802), but I've lost the rest of it, sorry. You can call their voice# toll-free for more info. Sports Spectrum Ltd. (800) 639-3719 (voice) ----------------------------- P R I V A C Y N O T I C E ----------------------------- Pursuant to the Electronic and Communications Privacy Act of 1986, 18 USC 2510 et. seq., Notice is Hereby Given that There are NO FACILITIES PROVIDED BY THIS SYSTEM for SENDING or RECEIVING PRIVATE OR CONFIDENTIAL ELECTRONIC COMMUNICATIONS. ALL Messages Shall be Deemed to be Readily Accessible to the General Public. Do NOT Use this System for ANY Communication for Which the SENDER Intends ONLY the Sender and the Intended Recipient(s) to read. Notice is Herby Given that ALL Messages Entered into this System CAN and MAY Be READ by the Operators of this System, WHETHER OR NOT they are the Intended Recipient(s). By Your Use of this System, You Agree to HOLD HARMLESS the Operators Thereof Against ANY and ALL CLAIMS Arising Out of Said Use NO MATTER THE CAUSE OR FAULT. ] .... Please remember that this password is protecting yourself against the unauthorized use of YOUR credit card. Please take all necessary precautions to guard it. Since all communications between customers and Sports Spectrum Ltd. occur via computer-to-computer, the password is the only way for Sports Spectrum Ltd. to verify that it is actually you on the other end of the phone connection. Gaining access to Sports Spectrum Ltd.'s service by invoking your password at logon time implicitly authorizes the use of your credit card to pay for any subsequent purchases during that particular session. -----------------------

1 0

NEW CP REMAILER
by nobody＠indirect.com 18 Aug '93

18 Aug '93

Well, after two days or so of missed mail and a lot of headache and missed sleep, I think I've got this working ok. The remailer address is <cdodhner(a)indirect.com>, and so far it is a vanilla remailer, nothing special at all. I have not tested it with encrypted messages yet, the public key, however, is below. Consider the remailer in 'test mode' for the next few days, and if all goes well I'll turn off the logging etc. by the 25th. Until then the remailer should be considered unsecured and all messages are subject to being inadvertantly read by myself in the process of debugging. If it works as well as it looks like it works, at that point I will turn off all logging, debugging, and archiveing, and generaly keep my nose out of it. Send any questions to me at cdodhner(a)indirect.com. Happy Hunting, -Chris -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAixwXwsAAAEEAMMN+Y9tRX5V/cYEroALiE/2pW1289kK9NCpPjaG+ExuNn0E lJOX4l0Yy6wqNCW7J4ZJEeZ7OQPUaZ6Ig4KUm2O3D8stg+YEuGPvO3TCrEpQ4faf lCZB6+qaalOyuyfGXIcgjQRl026KeYmMJkOGCcc4dFgKfp2tvJJSqYY5uHDxAAUR tClpbmRpcmVjdCByZW1haWxlciA8Y2RvZGhuZXJAaW5kaXJlY3QuY29tPg== =77gB -----END PGP PUBLIC KEY BLOCK-----

1 0

[ari@ISI.EDU: New paper on electronic currency]
by hfinney＠shell.portal.com 18 Aug '93

18 Aug '93

I just ftp'd, printed, and read the paper which Derek mentioned: NetCash: A design for practical electronic currency on the Internet by Gennady Medvinsky and Clifford Neuman I didn't think it was any good. They have an incredibly simplistic model, and their "protocols" are of the order, A sends the bank some paper money, and B sends A some electronic cash in return. They don't even do blinding of the cash. Each piece of cash has a unique serial number which is known to the currency provider. This would of course allow matching of withdrawn and deposited coins. "In particular, at the point that a client purchases coins from a currency server by check, or cashes in coins, it is possible for the currency server to record which coins have been issued to a particular client. It is expected that currency servers will not do so, and it is likely that the agreement with clients will specifically preclude it." Right. It is expected that they will not do so. I feel so much better now. These guys seem to have read the work in the field (they reference it) but they don't appear to have understood it. Hal Finney hfinney(a)shell.portal.com

1 0

Digital cash references
by hfinney＠shell.portal.com 18 Aug '93

18 Aug '93

I got asked what would be good survey articles on digital cash. Two good ones that are widely available are both by David Chaum: Scientific American, August 1992, p. 96; and Communications of the ACM, October 1985, p. 1030. Unfortunately, neither of these really describes the mathematics, instead discussing things in terms of analogies. To get more details you have to read the conference proceedings. Many of the recent Eurocrypt and Crypto conferences have discussed implementations of digital cash. Hal Finney hfinney(a)shell.portal.com

1 0