January 2003 - cypherpunks-legacy

ATTN: John Walker - RE: [speak-freely] Speak Freely for Windows and Speak Freely mailing lists (fwd)
by Eugen Leitl 27 Jan '03

27 Jan '03

How would you do it? Would you lift public key exchange from OpenSSL or GPG? Or just package a snapshot of GPG with Speak Freely, and adapt the call syntax? ---------- Forwarded message ---------- Date: Mon, 27 Jan 2003 01:25:26 -0500 From: "Benjamin T. Moore, Jr." <btmoore(a)iname.com> To: speak-freely(a)fourmilab.ch Subject: ATTN: John Walker - RE: [speak-freely] Speak Freely for Windows and Speak Freely mailing lists -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I am elated that the development of Speak Freely is continuing. I think it is one of the best Voice over IP applications I have ever tried. I have been using Speak Freely for at least 8 or 9 years now. I have also been using PGP since version 2.3a was released. I have yet to get Speak Freely to interface with PGP the way it is supposed to as per the help file. I have tried many times with friends also equally adept at PGP and Speak Freely. We've never been able to have any success. We always have to generate a key and exchange it through encrypted e-mail. I would dearly love to have someone provide a step by step tutorial on how we should proceed. Or, if as I suspect, it doesn't work, I'd like to know that as well so I can stop losing sleep over it! :-) Any advice or help would put me forever in your debt. Thanks in advance! - -- Benjamin T. Moore, Jr. - <btmoore(a)iname.com> ICQ UIN - 8159114 *The Price of Freedom is Self-Reliance! The Cost is Education!*

1 0

Re: Big Brotherish Laws
by pgut001＠cs.auckland.ac.nz 26 Jan '03

26 Jan '03

Bill Stewart <bill.stewart(a)pobox.com> writes: >I have heard of one case where somebody was stopped in Nevada, and instead of >presenting his California driver's license, if any, he presented his >somewhere-in-the-Caribbean non-photo license and an international driver's >license, and that was just fine for Nevada. That's because non-US licenses constitute automatic permission for minor traffic law violations. The scenario is something like the following: [Driver gets pulled over]. Driver: "Gidday mate, hows it going?" [Cop asks for license, looks at it] Cop: "Ahhhh, screw it, too much paperwork. Don't do it again. HAND". Peter.

1 0

Re: JILT: New Rules for Anonymous Electronic Transactions? An Exploration of the Private Law Implications of Digital Anonymity
by Bill Stewart 26 Jan '03

26 Jan '03

At 07:56 AM 01/24/2003 -0500, Bob Hettinga wrote: >http://elj.warwick.ac.uk/jilt/01-2/grijpink.html There's some interesting discussion about the ability of the Dutch legal culture to provide useful tools for regulating transactions in anonymous or semi-anonymous environments - if you can't find somebody, can you speak of enforcing contracts, etc. Not surprisingly, this has been discussed extensively by the Cypherpunks and other people exploring applications for cryptographically-protected communications. Some of the standard references are Tim May's "Cyphernomicon" paper (on the web), Orson Scott Card's novel "Ender's Game", and Vernor Vinge's story "True Names". (As the JILT paper says, systems like this may be quite complex to actually implement in practice, and fiction provides a good tool for exploring the social implications without doing the difficult detail work.) I do want to comment on the concept of pseudonymity and semi-anonymity. The paper appears to be using a definition in which a Trusted Third Party provides a pseudonym service, which knows the True Name behind each pseudonym and can provide it when required for a limited number situations, such as collecting unpaid debts or prosecuting ThoughtCrime, but otherwise the pseudonym is adequate for many activities, and the user can protect his privacy and conduct various activities under different pseudonyms without them being linked to each other or to his True Name. Unfortunately, the definitions of ThoughtCrime have been radically expanded in recent years, primarily due to "intellectual property" concerns from the music and movie publishers and the Church of Scientology, so the usefulness of these pseudonyms has decreased, even for pure communications applications without the anonymous digital payment systems that can enable anonymous business. An alternative definition of pseudonymity, which is more common in the Cypherpunks discussions, is the use of a persistent identity, verified by digital signatures, which permits the development of reputations without the need for True Names. The types of businesses that can be supported in this environment are more limited, because there's no way to throw somebody in jail if they default, but much of European merchant law evolved without this ability. For some applications, "Reputation Capital" provides enough protection - a name that's used for months or years of good transactions or writing good essays or making good investment recommendations has a value that will be lost if it's abused, but for other applications, escrow services substantially increase the types and values of transactions that are possible. Escrow can be used on a per-transaction basis, or the escrow service may be part of establishing a pseudonym, providing an amount of money that can be seized in a dispute resolution process without needing the True Name of the pseudonym-holder. Pseudonymity is becoming increasingly common in practice. AOL "screen names" were primarily intended to allow multiple family members to share an account, but are also useful for protecting privacy, especially of children in chat rooms. There's no explicit requirement for a True Name, though most accounts use credit cards which do provide some tracing ability, but the depth of credit checking performed by AOL is "did their credit card company approve paying for their service this month", rather than "how big a transaction can their assets cover" or "where do they sleep, in case the police want to arrest them". Yahoo Mail and Hotmail systems are relatively untraceable, however. EBay accounts have an organized reputation capital system, allowing buyers and sellers to rate whether the other party has met their obligations, and to allow prospective buyers and sellers to see the ratings and estimate whether they'll be defrauded or not. Unfortunately, EBay recently bought Paypal, so the privacy of Paypal users is no longer protected by the separation between the auction system and the payment system, since Paypal uses credit cards and therefore semi-traceable identities to pay people. Julf Helsingius's original Anonymous Remailer was originally intended to provide the stronger form of pseudonymity, but unfortunately he was forced to reveal the information he had about a user (because of the intellectual property Throughtcrime problem), though in fact that identity was another disposable email address. >In order to respond to a growing need for anonymity in legal transactions, >the regulations for organised semi-anonymity could also be extended (e.g. >under property law), so that it will be possible to break through a >person's anonymity retrospectively if necessitated by court order or by >the law. Organised semi-anonymity (or pseudonymity) in legal transactions >is therefore a useful weapon against a number of disadvantages of acting >absolutely anonymously or spontaneously semi-anonymously, while retaining >the envisaged protection of privacy. It is only with the guarantee of this >organised protection of a person's true identity without that being >abused, that identity fraud can be kept under control and that pseudonyms >can provide anonymity towards third parties without damaging the legal order.

1 0

Re: Deniable Thumbdrive?
by John Kelsey 26 Jan '03

26 Jan '03

At 10:06 PM 1/24/03 +0100, Eugen Leitl wrote: ... >Frankly, the fingerprint is a lousy secret: you leak it all over the >place. You can't help it, unless you're wearing gloves all the time. Ditto >DNA. That's generally true of biometrics. Unless taking the measurement is so intrusive it's obvious when it's taken (e.g., maybe the geometry of your sinus cavities or some such thing that requires a CAT scan to measure properly), there's no secret. People constantly seem to get themselves in trouble trying to use biometrics in a system as though they were secret. The best you can usually do is to make it moderately expensive and difficult to actually copy the biometric in a way that will fool the reader. But this is really hard. In fact, making special-purpose devices that are hard to copy or imitate is pretty difficult. It seems enormously harder to find a hard-to-copy, easy-to-use "token" that just happens to come free with a normal human body. I think the best way to think about any biometric is as a very cheap, moderately hard to copy identification token. Think of it like a good ID card that just happens to be very hard to misplace or lend to your friends. --John Kelsey, kelsey.j(a)ix.netcom.com

1 0

Re: Deniable Thumbdrive?
by Ben Laurie 26 Jan '03

26 Jan '03

Tyler Durden wrote: > I got a hold of a little gadget recently that is very nearly perfect for > certain forms of data storage. It's called a "Thumbdrive" and I bought > it online somewhere (64Meg for about $179 or so). > > The cool thing about this drive (small enough that it has holes for use > as a keychain) is that it's got a "Public" area and a private area, and > the private area is accessible (if one desires) only via the little > fingerprint reader on the top of the drive. (It's also USB based, and on > Windows2000 and beyond you don't need any software drivers--just plug it > in to a USB port and it appears as a drive). > > ANyway, I was wondering. I'd really like a nice software mod of this > thing so that, depending on which finger I use for verification, a > different private area on the drive will open (right now several users > can be assigned access by the master user to use their fingerprint for > access to the single private area). Of course, there should be no > indication that there even IS more than one private area. > > So...anyone heard of such a hack/mod, or is there a straightforward way > to go about doing it oneself? Nice! Get them to cut _all_ your fingers off instead of just one. Just say no to amputationware. Cheers, Ben. -- http://www.apache-ssl.org/ben.html http://www.thebunker.net/ "There is no limit to what a man can do or how far he can go if he doesn't mind who gets the credit." - Robert Woodruff

2 1

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

new services
by support＠cyberexcite.com 26 Jan '03

26 Jan '03

dear sir / madam u would be surprised with this mail , but we do have got your email address after great efforts! this is all about a new company , offering services for domain registration and web hosting.we actually want to gather information that would our rates be good for a simple user. domain registration : $ 7.99 web hosting ( Linux ) starting from $ 3 / month having facilities as " 100 MB Web Space reserved " 10 POP E-mail Address/ Forwarding addresses " Your Own CGI-BIN " High Speed Servers connected with multiple OC3 . " Unlimited hits per month " Free Response Form " WebBased Control Panel " Real audio and video Support " 24 hours FTP Access. please inform us that is it suitable for a common user to set up his/her web account. with regards! sarfraz shah cyberexcite team support(a)cyberexcite.com +92-333-5141016 www.cyberexcite.com

1 0

Re: DoD badly protected web form lets "users" administer .mil domain names.
by Declan McCullagh 26 Jan '03

26 Jan '03

On Fri, Jan 24, 2003 at 07:05:45PM -0800, Bill Stewart wrote: > A well-known non-US journalistic source reports: [...] > By Thomas C Greene in Washington The company may be incorporated overseas, but Thomas lives not that far up the street from me. I'm not sure what having an overseas HQ gains him if some of the Feds choose to pursue legal action (a very small chance, though, I'd wager). -Declan

1 0

Re: DoD badly protected web form lets "users" administer .mil domain names.
by Kevin S. Van Horn 25 Jan '03

25 Jan '03

>>Care to register a .mil Web site of your own for free? The DoD has gone out of its way to make it a snap. [...] >> >That's great. How about "kill-iraqis-regardless.mil" or "want-to-buy-some-oil-in-iraq.mil" or "we-lust-for-another-war.mil" > I think your aim is off here. It's the politicians and political appointees who are agitating for this war, not the career military. A lot of the top military leadership is against the idea of attacking Iraq, I suppose because they have a keener appreciation of just how dangerous, messy, and unpredictable war can be.

1 0