November 2003 - cypherpunks-legacy

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by Hallam-Baker, Phillip 21 Nov '03

21 Nov '03

Yeah, Yeah dictionary attacks... The key is that the search space is actually thinly populated enough to make dictionary attack hard. Most usernames are 6 characters or more, many include numbers, that is about 26^6 worth of search space per domain. Of course this is not evenly populated, but the odd thing is that the usernames turn out to be more random than the average password. This is because random is not unguessable. Many usernames are surnames, many are compounds of initial plus surname, only a relative handfull are commonly used names and those tend to get grabbed fast. so you have a pretty big search space, millions of possibilities and that for each one of fifty million domains. The same does not hold for do-not-call lists. The problem there is that something like 80% of the numbers available at active exchanges are already allocated. Most of the stock of unused numbers are on exchanges that have not yet been allocated. Since something like 30% of subscribers sign up for do not call the result is that dictonary attacks are easy. Also we add out of service addresses that get spammed anyway to the list. So the list is not an accurate way to find out if an address is in service or not. Alan knows quite a few addresses that get spammed that are invalid. > -----Original Message----- > From: Hallam-Baker, Phillip [mailto:pbaker@verisign.com] > Sent: Friday, November 21, 2003 7:21 PM > To: 'Steve Schear' > Cc: cypherpunks(a)lne.com; asrg(a)ietf.org > Subject: RE: [Asrg] Re: [Politech] Congress finally poised to vote on > anti -spam bill [sp] > > > We need to consider the technical workings of the do-not-spam > list and the > requirements that we would like the FTC to meet. > > I propose as a minimum: > > 1) Allow individual subscribers to list their email addresses with the > service. > 2) Permit mail sender to quickly determine whether a given > email is on the > list > 3) Be distributable in a form that does not permit use as a > mailing list. > 4) Permit the storage of attributes in association with each listing, > minimally the date of subscription. > > In addition we might add: > > 5) Allow domain name owners to list their domains. > 6) Provide for authentication of listing requests > > > These requirements can be met using completely generic and to > my knowledge > unencumbered technology. For the purposes of avoiding patent > encumberabces I > disclose the following - I published note on the basic idea > of using a one > way hash to conceal an email address on a do not spam list in > 1995, I also > implemented the scheme at that time. The idea is not entirely > novel, hash > databases have been used for at least twenty years, there may also be > similar ideas in the cryptography litterature. > > My proposal would be to use a message authentication function such as > HMAC-SHA1 with a key such as SHA1 ("FTC Do Not Spam List") > to create a > unique digest function for the purpose. There is a security > consideration > here, use of a digest such as SHA1(email) might lead to > chosen protocol > attacks. > > To add an individual email address "alice(a)example.com" to the list we > calculate HMAC ("alice(a)example.com") to create the key. A > domain may be > represented by the string "example.com". > > To determine whether the address "bob(a)example.com" is on the > list it is > necessary to test for both the specific email address and the domain. > > [This can be made to meet arbitrarily complex requirements] > > > The list is distributed as a set of key/value pairs. Sorting the list > according to the key values allows rapid lookups by means of > binary search, > or since the hash function is guaranteed homogenous using > ranged search > using the hash value as an estimator for the index position. It is not > necessary to distribute the list sorted. > > There are also a few tricks that can be used to reduce the > usefulness of > such a list for address validation. > > This same concept can be used to conceal the filter terms used in > cersorware. > > Phill > > _______________________________________________ > Asrg mailing list > Asrg(a)ietf.org > https://www1.ietf.org/mailman/listinfo/asrg

1 0

Vivendi to Destroy MP3.com archive
by proclus＠gnu-darwin.org 21 Nov '03

21 Nov '03

Vivendi et al. about to demonstrate how they value artists and their work. http://www.kuro5hin.org/story/2003/11/21/14616/561 Somebody please tell me that this is a nightmare, and I am about to wake up. Regards, proclus http://www.gnu-darwin.org/ -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------ [demime 0.97c removed an attachment of type APPLICATION/pgp-signature]

2 1

RE: [Asrg] Re: [Politech] Congress finally poised to vote on anti -spam bill [sp]
by Hallam-Baker, Phillip 21 Nov '03

21 Nov '03

We need to consider the technical workings of the do-not-spam list and the requirements that we would like the FTC to meet. I propose as a minimum: 1) Allow individual subscribers to list their email addresses with the service. 2) Permit mail sender to quickly determine whether a given email is on the list 3) Be distributable in a form that does not permit use as a mailing list. 4) Permit the storage of attributes in association with each listing, minimally the date of subscription. In addition we might add: 5) Allow domain name owners to list their domains. 6) Provide for authentication of listing requests These requirements can be met using completely generic and to my knowledge unencumbered technology. For the purposes of avoiding patent encumberabces I disclose the following - I published note on the basic idea of using a one way hash to conceal an email address on a do not spam list in 1995, I also implemented the scheme at that time. The idea is not entirely novel, hash databases have been used for at least twenty years, there may also be similar ideas in the cryptography litterature. My proposal would be to use a message authentication function such as HMAC-SHA1 with a key such as SHA1 ("FTC Do Not Spam List") to create a unique digest function for the purpose. There is a security consideration here, use of a digest such as SHA1(email) might lead to chosen protocol attacks. To add an individual email address "alice(a)example.com" to the list we calculate HMAC ("alice(a)example.com") to create the key. A domain may be represented by the string "example.com". To determine whether the address "bob(a)example.com" is on the list it is necessary to test for both the specific email address and the domain. [This can be made to meet arbitrarily complex requirements] The list is distributed as a set of key/value pairs. Sorting the list according to the key values allows rapid lookups by means of binary search, or since the hash function is guaranteed homogenous using ranged search using the hash value as an estimator for the index position. It is not necessary to distribute the list sorted. There are also a few tricks that can be used to reduce the usefulness of such a list for address validation. This same concept can be used to conceal the filter terms used in cersorware. Phill

1 0

Vivendi to Destroy MP3.com archive
by proclus＠gnu-darwin.org 21 Nov '03

21 Nov '03

Vivendi et al. about to demonstrate how they value artists and their work. http://www.kuro5hin.org/story/2003/11/21/14616/561 Somebody please tell me that this is a nightmare, and I am about to wake up. Regards, proclus http://www.gnu-darwin.org/ -- Visit proclus realm! http://proclus.tripod.com/ -----BEGIN GEEK CODE BLOCK----- Version: 3.1 GMU/S d+@ s: a+ C++++ UBULI++++$ P+ L+++(++++) E--- W++ N- !o K- w--- !O M++@ V-- PS+++ PE Y+ PGP-- t+++(+) 5+++ X+ R tv-(--)@ b !DI D- G e++++ h--- r+++ y++++ ------END GEEK CODE BLOCK------ [demime 0.97c removed an attachment of type APPLICATION/pgp-signature]

1 0

Re: [Politech] Congress finally poised to vote on anti-spam bill [sp]
by Steve Schear 21 Nov '03

21 Nov '03

At 04:13 PM 11/21/2003 -0600, Declan McCullagh <declan(a)well.com> wrote: >A copy of the bill is here: >http://news.com.com/pdf/ne/2003/FINALSPAM.pdf I interpret paragraph 1037(a)1 - 5 as possibly prohibiting the use of anonymous remailers, or proxies and nyms in registering email accounts, for the purpose of commercial speech. steve

1 0

Re: article on Rivest and Micali's Peppercoin system
by Steve Schear 21 Nov '03

21 Nov '03

At 11:37 AM 11/17/2003 -0500, Steve Bellovin <smb(a)research.att.com> wrote: >http://www.technologyreview.com/articles/huang1203.asp A nice puff piece but it steers clear of well know, if not respected, prognosticators that poo-poo any near-term potential for micro-payments. Conspicuously absent is e-gold which predates all of the listed vendors, does a daily average of $3 million in transactions, relatively simple to use, requires no special end-user software and internally cost effective enough to handle payments less than $0.01. It seems e-gold has been smeared (unfairly I think) in the press as only attracting gray market types. steve --------------------------------------------------------------------- The Cryptography Mailing List Unsubscribe by sending "unsubscribe cryptography" to majordomo(a)metzdowd.com

1 0

Re: e voting
by John Washburn 21 Nov '03

21 Nov '03

I agree. The paper printout may be unconnected to fraudulent tally numbers produced later for publication. This is better than the literal nothing produced at present. There is a small chance many voters could use there receipts to counter fraudulent tally in low-vote ward. -----Original Message----- From: Roy M. Silvernail [mailto:roy@rant-central.com] Sent: Friday, November 21, 2003 12:12 PM To: cypherpunks(a)lne.com Subject: Re: e voting On Friday 21 November 2003 12:19, Tim May wrote: > On Nov 21, 2003, at 8:16 AM, Major Variola (ret.) wrote: > > Secretary of State Kevin Shelley is expected to announce today that as > > of 2006, all electronic voting machines in California must be able to > > produce a paper printout that voters can check to make sure their votes > > are properly recorded. > > > > http://www.latimes.com/news/local/la-me-shelley21nov21,1,847438.story? > > coll=la-headlines-california > > Without the ability to (untraceably, unlinkably, of course) verify that > this vote is "in the vote total," and that no votes other than those > who actually voted, are in the vote total, this is all meaningless. Quite true. But given the fact that we don't have that ability *now*, what exactly is the difference? Other than streamlining and centralizing the present distributed corruption?

1 0

RE: DigiCash Saves PayPal?
by Scott Guthery 21 Nov '03

21 Nov '03

Not to mention the pneumatic tube systems in department stores that sent your charge plate upstairs for approval. "Those who do not learn from ..." Oh, never mind. Cheers, Scott -----Original Message----- From: R. A. Hettinga [mailto:rah@shipwright.com] Sent: Friday, November 21, 2003 3:20 PM To: cryptography(a)metzdowd.com; cypherpunks(a)lne.com; mac_crypto(a)vmeng.com; Digital Bearer Settlement List; fork(a)xent.com; epay(a)ca0.net; internet-payments(a)ls.fstc.org; DIGSIG(a)LISTSERV.TEMPLE.EDU; CYBERIA-L(a)LISTSERV.AOL.COM; InfoSec News; nettime-l(a)bbs.thing.net Subject: DigiCash Saves PayPal? >And Greg Aharonian, San Francisco-based patent expert, said eBay could get >the case dismissed if it finds a company or institution that developed its >own "trusted intermediary" or similar electronic payment system even >before AT&T researchers filed for their patent. Bingo. Somebody at First Data should haul out the old DigiCash pitch-ware they probably have laying around, and beat AT&T over the head with it... Cheers, RAH ------ <http://finance.lycos.com/qc/news/story.aspx?story=36570023> Lycos AT&T: EBay, PayPal Infringe on Patents E-mail orPrint this story 20 November 2003, 6:03pm ET By RACHEL KONRAD AP Business Writer SAN JOSE, Calif. (AP) -- AT&T Corp. reached out and smacked eBay Inc. with a patent infringement lawsuit Thursday, claiming the online auction company has been using a payment system that the telecommunications giant developed more than a decade ago. The case, filed in federal court in Delaware, comes on the heels of an August verdict in which a Virginia judge ordered eBay to pay $29.5 million to an inventor who accused the company of stealing his ideas for fixed price sales formats. AT&T's suit demands that eBay pay an undisclosed amount in licensing fees because its lucrative PayPal division functions as a "trusted intermediary" between buyers and sellers who may not know each other. The system _ widely regarded as critical to eBay's gangbuster growth and a boon to e-commerce in general _ lets buyers provide credit card or bank account information to a reliable third party instead of individual sellers around the world. Buyers merely have to trust PayPal, and they don't have to worry about disreputable sellers using sensitive financial data for fraudulent purposes. AT&T says three senior engineers working for the phone company filed for a patent in 1991 for exactly such a process, which they called "Mediation of Transactions by a Communication System." The patent was granted in 1994, AT&T said. EBay spokesman Chris Donlay dismissed the lawsuit as "meritless," and he said customers should count on continuing to use PayPal. EBay acquired PayPal in October 2002, and the division immediately became an engine of profits for San Jose-based eBay, one of the few Silicon Valley companies to emerge unscathed from the dot-com collapse. PayPal produced $106.4 million in revenue in the third quarter of 2003, nearly twice what it generated in the same period last year. More than 11 million people used PayPal to conduct transactions from July to September, according to eBay's most recent earnings statement. Before PayPal, eBay relied on a similar system called Billpoint, which is also named in the lawsuit. Mentioned Last Change INDU 9605.7913.63 (0.14%) EBAY 51.800.23 (0.44%) T 19.630.53 (2.77%) AT&T spokesman Gary Morgenstern said the lawsuit is the result of more than a year of negotiations between the two companies. EBay refused to pay any licensing fees, he said. "AT&T invests hundreds of millions of dollars every year in our research and development efforts, which have yielded a sizable portfolio of patents _ that's what we're vigorously protecting here," Morgenstern said. "EBay and PayPal have refused to compensate us for patented technology, and so we're forced to take this to the courts." Numerous inventors and small companies have sued or threatened to sue eBay, and legal experts have been skeptical of many such claims. But some said the newest plaintiff's heft gives the AT&T lawsuit the credibility that cases brought by obscure inventors and operators of now-defunct dot-coms lacked. "To be sure, AT&T's involvement makes this case different from others," said Neil A. Smith of the San Francisco-based law firm Howard, Rice, Nemerovski, Canady, Falk & Rabkin. "AT&T's a well respected company that doesn't just wave around patent lawsuits unless there's some merit." Others, however, said that AT&T is unlikely to even force a settlement _ which is the way Amazon.com and Barnesandnoble.com resolved what might have been the last such high-profile legal skirmish over Internet sales strategies. That case, involving Amazon's "one-click" checkout method, was filed in 1999 and settled last year. The companies have refused to disclose the terms. David Pressman, a San Francisco patent lawyer and author of "Patent It Yourself," said at least half of all patent infringement lawsuits are won by the defense or eventually dropped before reaching the courtroom. And Greg Aharonian, San Francisco-based patent expert, said eBay could get the case dismissed if it finds a company or institution that developed its own "trusted intermediary" or similar electronic payment system even before AT&T researchers filed for their patent. "The question is, did anyone else have trusted third parties in the 1980s? My gut reaction is that they existed," said Aharonian, publisher of the daily Internet Patent News Service newsletter. "Some university professor could have written an article on this, but no one paid attention and no banks adopted it. Something like that could invalidate the lawsuit completely." ___ On the Net: http://www.att.com http://www.ebay.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

DigiCash Saves PayPal?
by R. A. Hettinga 21 Nov '03

21 Nov '03

>And Greg Aharonian, San Francisco-based patent expert, said eBay could get >the case dismissed if it finds a company or institution that developed its >own "trusted intermediary" or similar electronic payment system even >before AT&T researchers filed for their patent. Bingo. Somebody at First Data should haul out the old DigiCash pitch-ware they probably have laying around, and beat AT&T over the head with it... Cheers, RAH ------ <http://finance.lycos.com/qc/news/story.aspx?story=36570023> Lycos AT&T: EBay, PayPal Infringe on Patents E-mail orPrint this story 20 November 2003, 6:03pm ET By RACHEL KONRAD AP Business Writer SAN JOSE, Calif. (AP) -- AT&T Corp. reached out and smacked eBay Inc. with a patent infringement lawsuit Thursday, claiming the online auction company has been using a payment system that the telecommunications giant developed more than a decade ago. The case, filed in federal court in Delaware, comes on the heels of an August verdict in which a Virginia judge ordered eBay to pay $29.5 million to an inventor who accused the company of stealing his ideas for fixed price sales formats. AT&T's suit demands that eBay pay an undisclosed amount in licensing fees because its lucrative PayPal division functions as a "trusted intermediary" between buyers and sellers who may not know each other. The system _ widely regarded as critical to eBay's gangbuster growth and a boon to e-commerce in general _ lets buyers provide credit card or bank account information to a reliable third party instead of individual sellers around the world. Buyers merely have to trust PayPal, and they don't have to worry about disreputable sellers using sensitive financial data for fraudulent purposes. AT&T says three senior engineers working for the phone company filed for a patent in 1991 for exactly such a process, which they called "Mediation of Transactions by a Communication System." The patent was granted in 1994, AT&T said. EBay spokesman Chris Donlay dismissed the lawsuit as "meritless," and he said customers should count on continuing to use PayPal. EBay acquired PayPal in October 2002, and the division immediately became an engine of profits for San Jose-based eBay, one of the few Silicon Valley companies to emerge unscathed from the dot-com collapse. PayPal produced $106.4 million in revenue in the third quarter of 2003, nearly twice what it generated in the same period last year. More than 11 million people used PayPal to conduct transactions from July to September, according to eBay's most recent earnings statement. Before PayPal, eBay relied on a similar system called Billpoint, which is also named in the lawsuit. Mentioned Last Change INDU 9605.7913.63 (0.14%) EBAY 51.800.23 (0.44%) T 19.630.53 (2.77%) AT&T spokesman Gary Morgenstern said the lawsuit is the result of more than a year of negotiations between the two companies. EBay refused to pay any licensing fees, he said. "AT&T invests hundreds of millions of dollars every year in our research and development efforts, which have yielded a sizable portfolio of patents _ that's what we're vigorously protecting here," Morgenstern said. "EBay and PayPal have refused to compensate us for patented technology, and so we're forced to take this to the courts." Numerous inventors and small companies have sued or threatened to sue eBay, and legal experts have been skeptical of many such claims. But some said the newest plaintiff's heft gives the AT&T lawsuit the credibility that cases brought by obscure inventors and operators of now-defunct dot-coms lacked. "To be sure, AT&T's involvement makes this case different from others," said Neil A. Smith of the San Francisco-based law firm Howard, Rice, Nemerovski, Canady, Falk & Rabkin. "AT&T's a well respected company that doesn't just wave around patent lawsuits unless there's some merit." Others, however, said that AT&T is unlikely to even force a settlement _ which is the way Amazon.com and Barnesandnoble.com resolved what might have been the last such high-profile legal skirmish over Internet sales strategies. That case, involving Amazon's "one-click" checkout method, was filed in 1999 and settled last year. The companies have refused to disclose the terms. David Pressman, a San Francisco patent lawyer and author of "Patent It Yourself," said at least half of all patent infringement lawsuits are won by the defense or eventually dropped before reaching the courtroom. And Greg Aharonian, San Francisco-based patent expert, said eBay could get the case dismissed if it finds a company or institution that developed its own "trusted intermediary" or similar electronic payment system even before AT&T researchers filed for their patent. "The question is, did anyone else have trusted third parties in the 1980s? My gut reaction is that they existed," said Aharonian, publisher of the daily Internet Patent News Service newsletter. "Some university professor could have written an article on this, but no one paid attention and no banks adopted it. Something like that could invalidate the lawsuit completely." ___ On the Net: http://www.att.com http://www.ebay.com -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Congress about to pass anti-spam bill -- the details
by Declan McCullagh 21 Nov '03

21 Nov '03

[...] ' 1037. (a) IN GENERAL.Whoever, in or affecting inter- 23 state or foreign commerce, knowingly 24 November 21, 2003 (2:42 p.m.) 13 (1) accesses a protected computer without au- 1 thorization, and intentionally initiates the trans- 2 mission of multiple commercial electronic mail mes- 3 sages from or through such computer, 4 (2) uses a protected computer to relay or re- 5 transmit multiple commercial electronic mail mes- 6 sages, with the intent to deceive or mislead recipi- 7 ents, or any Internet access service, as to the origin 8 of such messages, 9 (3) materially falsifies header information in 10 multiple commercial electronic mail messages and in- 11 tentionally initiates the transmission of such mes- 12 sages, 13 (4) registers, using information that materially 14 falsifies the identity of the actual registrant, for 5 15 or more electronic mail accounts or online user ac- 16 counts or 2 or more domain names, and inten- 17 tionally initiates the transmission of multiple com- 18 mercial electronic mail messages from any combina- 19 tion of such accounts or domain names, or 20 (5) falsely represents oneself to be the reg- 21 istrant or the legitimate successor in interest to the 22 registrant of 5 or more Internet protocol addresses, 23 and intentionally initiates the transmission of mul- 24 S:\WPSHR\LEGCNSL\XYWRITE\CON03\SPAMCOMP.3 November 21, 2003 (2:42 p.m.) 14 tiple commercial electronic mail messages from such 1 addresses, 2 or conspires to do so, shall be punished as provided in 3 subsection (b). 4 (b) PENALTIES.The punishment for an offense 5 under subsection (a) is 6 (1) a fine under this title, imprisonment for 7 not more than 5 years, or both, if 8 (A) the offense is committed in further- 9 ance of any felony under the laws of the United 10 States or of any State; or 11 (B) the defendant has previously been 12 convicted under this section or section 1030, or 13 under the law of any State for conduct involv- 14 ing the transmission of multiple commercial 15 electronic mail messages or unauthorized access 16 to a computer system; 17 (2) a fine under this title, imprisonment for 18 not more than 3 years, or both, if 19 (A) the offense is an offense under sub- 20 section (a)(1); 21 S:\WPSHR\LEGCNSL\XYWRITE\CON03\SPAMCOMP.3 [...]

1 0