November 2003 - cypherpunks-legacy

Re: [AntiSocial] Re: FLASH: DHS wants info on store refunds?
by Tim May 03 Nov '03

03 Nov '03

On Monday, November 3, 2003, at 11:41 AM, Keller, Nick wrote: > Thst is BS - I just received cash back from my Grocery Store (Giant) - > No ID asked... > > What was the amount? > It's probably B.S., but if it isn't, and HomeSec is actually requiring this, then they are doing so without a specific warrant. Note that similar attempts in the past to get the names of book buyers, or other customers, have failed even when general warrants were sought. A store is, unless the Constitution has been rewritten lately, free to tell any Fed that its paperwork is its paperwork, save for matters relating to taxation, and that if the Feds want a _specific_ transaction or name, they can seek the appropriate search warrant before a judge. --Tim May

1 0

RE: [AntiSocial] Re: FLASH: DHS wants info on store refunds?
by J.A. Terranson 03 Nov '03

03 Nov '03

On Mon, 3 Nov 2003, Keller, Nick wrote: > Thst is BS - Exactly my point! > I just received cash back from my Grocery Store (Giant) - > No ID asked... > > What was the amount? $19.99 plus tax. > -Nicolas > > > > -----Original Message----- > > From: Steve Schear [mailto:s.schear@comcast.net] > > Sent: Monday, November 03, 2003 1:54 PM > > To: cypherpunks(a)lne.com > > Cc: antisocial(a)mfn.org > > Subject: [AntiSocial] Re: FLASH: DHS wants info on store refunds? > > > > > > At 06:11 PM 11/1/2003 -0600, J.A. Terranson wrote: > > >Well, when I brought back the returns, they wanted a drivers > > license. > > >Odd, considering it was a cash sale and I was holding the receipt. > > > > > >"It's required by the Homeland Security Department" says the > > kid behind > > >the register. Sorry. I need ID, and I have to enter it into the > > >computer and forward it to the Homeland Security Office. The > > >Terrorists are using this kind of thing to wash money." > > > > > >I must have looked pretty stupid with my jaw hanging down like that. > > > > > >I made a scene of course. A *big* scene. Lots of loud argument, > > >pointing out all the obvious things: as a cash sale, the > > money did not > > >need "washing". Cash sales are inherently ID agnostic. Etc., etc., > > >etc. > > > > > >No dice. > > > > > >They want ID, and they are not going to budge. > > > > Was this information prominently displayed either behind the > > register or on > > the sales receipt prior to purchase? Most state laws require this. > > > > steve > > > > > > --------------------------------------------------- > > To unsubscribe: send mail to majordomo(a)mfn.org with > > "unsubscribe antisocial" as the entire message. > -- Yours, J.A. Terranson sysadmin(a)mfn.org "Every living thing dies alone." Donnie Darko

1 0

RE: [AntiSocial] Re: FLASH: DHS wants info on store refunds?
by Keller, Nick 03 Nov '03

03 Nov '03

Thst is BS - I just received cash back from my Grocery Store (Giant) - No ID asked... What was the amount? -Nicolas > -----Original Message----- > From: Steve Schear [mailto:s.schear@comcast.net] > Sent: Monday, November 03, 2003 1:54 PM > To: cypherpunks(a)lne.com > Cc: antisocial(a)mfn.org > Subject: [AntiSocial] Re: FLASH: DHS wants info on store refunds? > > > At 06:11 PM 11/1/2003 -0600, J.A. Terranson wrote: > >Well, when I brought back the returns, they wanted a drivers > license. > >Odd, considering it was a cash sale and I was holding the receipt. > > > >"It's required by the Homeland Security Department" says the > kid behind > >the register. Sorry. I need ID, and I have to enter it into the > >computer and forward it to the Homeland Security Office. The > >Terrorists are using this kind of thing to wash money." > > > >I must have looked pretty stupid with my jaw hanging down like that. > > > >I made a scene of course. A *big* scene. Lots of loud argument, > >pointing out all the obvious things: as a cash sale, the > money did not > >need "washing". Cash sales are inherently ID agnostic. Etc., etc., > >etc. > > > >No dice. > > > >They want ID, and they are not going to budge. > > Was this information prominently displayed either behind the > register or on > the sales receipt prior to purchase? Most state laws require this. > > steve > > > --------------------------------------------------- > To unsubscribe: send mail to majordomo(a)mfn.org with > "unsubscribe antisocial" as the entire message.

1 0

Chaumian blinding & public voting?
by Major Variola (ret) 03 Nov '03

03 Nov '03

Is is possible to use blinding (or other protocols) so that all votes are published, you can check that your vote is in there, and you (or anyone) can run the maths and verify the vote? Without being able to link people to votes without their consent. Currently voting is trusted because political adversaries supervise the process. Previously the mechanics were, well, mechanical, ie, open for inspection. The current genre of voting machines.. well, you know the scam. And still reliant on a few adversarial human monitors. Something like this: The day after elections a list of hex codes -votes- are published. You can find in that list the code that you received (on paper) when you voted, to verify that your vote counted. You can run an algorithm on any subset of codes, including just your own, and learn which candidate that code corresponds to. Everyone can run on the entire dataset, verifying the tally. You don't have to divulge which code is yours if you want it to remain secret. Perhaps the code could contain not only the intended vote, but a unique voter ID so that hexcodes could not be added to the dataset (cf dead people not allowed to vote except in Chicago) without setting off alarms. Perhaps anyone could verify that someone voted, or not, but could not figure who they voted for without their cooperation. Apologies if I should know this, I haven't gotten my head around all the M of N, blinding, database translucency, etc protocols.

6 9

Re: Chaumian blinding & public voting?
by John Washburn 03 Nov '03

03 Nov '03

The Soviet Union and Pre-Invasion II Iraq had voter turnouts of 98+%. If voter turnout were important the same could be done here. What is wanted is a high turnout of INTERESTED voters. Only ballot choices produce that. Nevada has consistently higher voter turnout at all levels than any other state. Nevada also is the only state with No Of The Above (NOTA) as a pre-printed ballot option which must be included in all elections; even the "uncontested" races. I do not think this is a coincidence. Unfortunately the NOTA votes are non-binding as is the case in Australia. With binding NOTA, if NOTA with there is a new race with new candidates; none of whom can have appeared on the ballot where NOTA won. In Nevada, you have the ignominy of being listed as coming in second behind NOTA. But, you still get to exercise the levers of political power. Still, even Nevada's miniscule expansion of ballot options demonstrated my point. Interesting ballots (more candidates or more options) draw more voters because the pool of interested voters is larger. Another simple option I would like to see is a star next to the current office holder. This would slightly offset the staggering advantages of incumbency. After binding NOTA and incumbency identification, then you can begin to work on the rigged ballot access game create by the Democrat/Republican hegemony. -----Original Message----- From: Neil Johnson [mailto:njohnsn@njohnsn.com] Sent: Friday, October 31, 2003 9:18 PM To: Major Variola (ret); cypherpunks(a)lne.com Subject: Re: Chaumian blinding & public voting? On Friday 31 October 2003 12:10 pm, Major Variola (ret) wrote: > Is is possible to use blinding (or other protocols) so that all votes > are published, you can check that your vote is in there, and you > (or anyone) can run the maths and verify the vote? Without being > able to link people to votes without their consent. > Doing this would allow vote buyers to verify a voter voted the way they wanted. That is one of the main reasons you can't take a copy of your paper ballot home with you now. One option might be to give the voter a MAC of their ballot and then print the MAC's in the paper. The voter could check to see if their vote had been altered. I still think far better methods for improving voter turn out other than Internet voting are: 1. A National Election Holiday (but in the middle of the work week so people can't use it to extend a vacation). 2. Couple the Election with a National Lottery with local, state, and national prizes. With appropriate delink of voter's identity from the way they voted of course. (I'm not claiming that this would actually improve things overall, just increase voter turnout). -- Neil Johnson http://www.njohnsn.com PGP key available on request.

1 0

RE: FLASH: DHS wants info on store refunds?
by Trei, Peter 03 Nov '03

03 Nov '03

> J.A. Terranson[SMTP:measl@mfn.org] > > Well, when I brought back the returns, they wanted a drivers license. > Odd, > considering it was a cash sale and I was holding the receipt. > > "It's required by the Homeland Security Department" says the kid behind > the > register. Sorry. I need ID, and I have to enter it into the computer and > forward it to the Homeland Security Office. The Terrorists are using this > kind of thing to wash money." > I strongly suspect that this is not DHS policy - it would have to apply to *every* cash refund, regardless as to whether the underlying purchase was weapon related or not. We'd have heard a lot more about it if this were the case. For more gubmint nonsense on things that go bang, take at look at: http://www.premierreticles.com/ "Effective immediatly, US State Dept. regulations prohibit the export of any riflescope with a mil-dot reticle outside the United States." Peter Trei

1 0

Freenet and DHCP
by Roy M. Silvernail 03 Nov '03

03 Nov '03

In looking over the Freenet FAQ (specifically the Firewall/NAT stuff), it looks like a static public IP address is assumed/needed. My DSL connection is DHCP, so my visible IP changes periodically. Even more fun, the visible IP isn't visible from my side. (I get a 10.x.x.x address from my DSL modem) I can do some sneaky stuff to recover the visible IP, but can Freenet work under these conditions?

1 0

Cypherpunks List Info
by cpunk＠lne.com 02 Nov '03

02 Nov '03

Cypherpunks Mailing List Information Last updated: Oct 13, 2003 This message is also available at http://www.lne.com/cpunk Instructions on unsubscribing from the list can be found below. 0. Introduction The Cypherpunks mailing list is a mailing list for discussing cryptography and its effect on society. It is not a moderated list (but see exceptions below) and the list operators are not responsible for the list content. Cypherpunks is a distributed mailing list. A subscriber can subscribe to one node of the list and thereby participate on the full list. Each node (called a "Cypherpunks Distributed Remailer", although they are not related to anonymous remailers) exchanges messages with the other nodes in addition to sending messages to its subscribers. A message posted to one node will be received by the list subscribers on the other nodes, and vice-versa. 1. Filtering The various CDRs follow different policies on filtering spam and to a lesser extent on modifying messages that go to/from their subscribers. Filtering is done, on nodes that do it, to reduce the huge amount of spam that the cypherpunks list is subjected to. There are three basic flavors of filtering CDRs: "raw", which send all messages to their subscribers. "cooked" CDRs try to eliminate the spam on that's on the regular list by automatically sending only messages that are from cypherpunks list subscribers (on any CDR) or people who are replying to list messages. Finally there are moderated lists, where a human moderator decides which messages from the raw list to pass on to subscribers. 2. Message Modification Message modification policy indicates what modifications, if any, beyond what is needed to operate the CDR are done (most CDRs add a tracking X-loop header on mail posted to their subscribers to prevent mail loops). Message modification usually happens on mail going in or out to each CDR's subscribers. CDRs should not modify mail that they pass from one CDR to the next, but some of them do, and others undo those modifications. 3. Privacy Privacy policy indicates if the list will allow anyone ("open"), or only list members, or no one ("private") , to retrieve the subscribers list. Note that if you post, being on a "private" list doesn't mean much, since your address is now out there. It's really only useful for keeping spammers from harvesting addresses from the list software. Digest mode indicates that the CDR supports digest mode, which is where the posts are batched up into a few large emails. Nodes that support only digest mode are noted. 4. Anonymous posting Cypherpunks encourages anonymous posting. You can use an anonymous remailer: http://www.andrebacard.com/remail.html http://anon.efga.org/Remailers http://www.gilc.org/speech/anonymous/remailer.html 5. Unsubscribing Unsubscribing from the cypherpunks list: Since the list is run from a number of different CDRs, you have to figure out which CDR you are subscribed to. If you don't remember and can't figure it out from the mail headers (hint: the top Received: line should tell you), the easiest way to unsubscribe is to send unsubscribe messages to all the CDRs listed below. How to figure out which CDR you are subscribed to: Get your mail client to show all the headers (Microsoft calls this "internet headers"). Look for the Sender or X-loop headers. The Sender will say something like "Sender: owner-cypherpunks(a)lne.com". The X-loop line will say something like "X-Loop: cypherpunks(a)lne.com". Both of these inticate that you are subscribed to the lne.com CDR. If you were subscribed to the algebra CDR, they would have algebra.com in them. Once you have figured out which CDR you're subscribed to, look in the table below to find that CDRs unsubscribe instructions. 6. Lunatics, spammers and nut-cases "I'm subscribed to a filtering CDR yet I still see lots of junk postings". At this writing there are a few sociopaths on the cypherpunks list who are abusing the lists openness by dumping reams of propaganda on the list. The distinction between a spammer and a subscriber is nearly always very clear, but the dictinction between a subscriber who is abusing the list by posting reams of propaganda and a subscriber who is making lots of controversial posts is not clear. Therefore, we tolerate the crap. Subscribers with a low crap tolerance should check out mail filters. Procmail is a good one, although it works on Unix and Unix-like systems only. Eudora also has a capacity for filtering mail, as do many other mail readers. An example procmail recipie is below, you will of course want to make your own decisions on which (ab)users to filter. # mailing lists: # filter all cypherpunks mail into its own cypherspool folder, discarding # mail from loons. All CDRs set their From: line to 'owner-cypherpunks'. # /dev/null is unix for the trash can. :0 * ^From.*owner-cypherpunks@.* { :0: * (^From:.*ravage@ssz\.com.*|\ ^From:.*jchoate@dev.tivoli.com.*|\ ^From:.*mattd@useoz.com|\ ^From:.*proffr11@bigpond.com|\ ^From:.*jei@cc.hut.fi) /dev/null :0: cypherspool } 7. List of current CDRs All commands are sent in the body of mail unless otherwise noted. --------------------------------------------------------------------------- Algebra: Operator: Subscription: "subscribe cypherpunks" to majordomo(a)algebra.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)algebra.com Help: "help cypherpunks" to majordomo(a)algebra.com Posting address: cypherpunks(a)algebra.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- CCC: Operator: drt(a)un.bewaff.net Subscription: "subscribe [password of your choice]" to cypherpunks-request(a)koeln.ccc.de Unsubscription: "unsubscribe <password>" to cypherpunks-request(a)koeln.ccc.de Help: "help" to to cypherpunks-request(a)koeln.ccc.de Web site: http://koeln.ccc.de/mailman/listinfo/cypherpunks Posting address: cypherpunks(a)koeln.ccc.de Filtering policy: This specific node drops messages bigger than 32k and every message with more than 17 recipients or just a line containing "subscribe" or "unsubscribe" in the subject. Digest mode: this node is digest-only NNTP: news://koeln.ccc.de/cbone.ml.cypherpunks Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Infonex: Subscription: "subscribe cypherpunks" to majordomo(a)infonex.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)infonex.com Help: "help cypherpunks" to majordomo(a)infonex.com Posting address: cypherpunks(a)infonex.com Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Lne: Subscription: "subscribe cypherpunks" to majordomo(a)lne.com Unsubscription: "unsubscribe cypherpunks" to majordomo(a)lne.com Help: "help cypherpunks" to majordomo(a)lne.com Posting address: cypherpunks(a)lne.com Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to lne CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. messages are demimed (MIME attachments removed) when posted through lne or received by lne CDR subscribers 2. leading "CDR:" in subject line removed 3. "Reply-to:" removed Privacy policy: private Info: http://www.lne.com/cpunk; "info cypherpunks" to majordomo(a)lne.com Archive: http://archives.abditum.com/cypherpunks/index.html (thanks to Steve Furlong and Len Sassaman) --------------------------------------------------------------------------- Minder: Subscription: "subscribe cypherpunks" to majordomo(a)minder.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)minder.net Help: "help" to majordomo(a)minder.net Posting address: cypherpunks(a)minder.net Filtering policy: raw Message Modification policy: no modification Privacy policy: private Info: send mail to cypherpunks-info(a)minder.net --------------------------------------------------------------------------- Openpgp: [openpgp seems to have dropped off the end of the world-- it doesn't return anything from sending help queries. Ericm, 8/7/01] Subscription: "subscribe cypherpunks" to listproc(a)openpgp.net Unsubscription: "unsubscribe cypherpunks" to listproc(a)openpgp.net Help: "help" to listproc(a)openpgp.net Posting address: cypherpunks(a)openpgp.net Filtering policy: raw Message Modification policy: no modification Privacy policy: ??? --------------------------------------------------------------------------- Sunder: Subscription: "subscribe" to sunder(a)sunder.net Unsubscription: "unsubscribe" to sunder(a)sunder.net Help: "help" to sunder(a)sunder.net Posting address: sunder(a)sunder.net Filtering policy: moderated Message Modification policy: ??? Privacy policy: ??? Info: ??? --------------------------------------------------------------------------- Pro-ns: Subscription: "subscribe cypherpunks" to majordomo(a)pro-ns.net Unsubscription: "unsubscribe cypherpunks" to majordomo(a)pro-ns.net Help: "help cypherpunks" to majordomo(a)pro-ns.net Posting address: cypherpunks(a)pro-ns.net Filtering policy: cooked Posts from all CDR subscribers & replies to threads go to local CDR subscribers. All posts from other CDRs are forwarded to other CDRs unmodified. Message Modification policy: 1. leading "CDR:" in subject line removed 2. "Reply-to:" removed Privacy policy: private Info: http://www.pro-ns.net/cpunk

1 0

cryptoIDs
by Trevor Perrin 02 Nov '03

02 Nov '03

Hi cypherpunks, First-time poster. I've lurked awhile. I'm working on a system for key infrastructure, and I'd like to invite criticism, comments, help, etc., from anyone interested. You can find the paper and code here: http://trevp.net#cryptoID Here's a summary - The system is based on a critique of X.509-style PKI. The critique is this: Any key infrastructure has to handle the twin tasks of: - Public-key distribution (Bob finding Alice's public-key) - Private-key management (Alice keeping her private-key(s) secure yet accessible) PKI handles the former through certificates, and the latter through certificate revocation. These force a tight coupling between subjects (e.g. Alice) and CAs - subjects must contact CAs to get their certificates, and also to revoke keys and renew certificates. Since the function of Trusted-Third-Parties (e.g. CAs) is to provide information to *relying parties* (e.g. Bob), I argue that this coupling of *subjects* with TTPs is inappropriate for a decentralized environment like the Internet. In such an environment, different relying parties will trust different TTPs. For the subject to procure certificates that would satisfy all these RPs, he'd have to predict the future to know which RPs will contact him, read the minds of these future RPs to know what they care about, and then contact the hundreds of TTPs these different RPs trust to procure relevant certificates. It would be better to decouple subjects from TTPs, so that subjects could perform private-key management without the involvement of TTPs, and so that TTPs could perform key distribution without the involvement of subjects. The key to this separation of tasks is to use fingerprints as the interface between the "private" and "public" domains: the subject will use private-key management to perpetuate a long-lived public-key. The fingerprint of this key will be the subject's "cryptographic identifier" - it will be passed around by TTPs and RPs to "speak about" the subject. Now, private-key management and public-key distribution can proceed independently. For private-key management, the subject will most likely keep his long-lived "root key" in a safe place, and use it only occasionally to certify "subkeys". The subject may also do things such as splitting the root key into shares, using proactive and/or threshold signing schemes, using "threshold subjects" a la SPKI, using multiple layers of subkeys as "intermediate CAs", using revocation/revalidation to quickly disable compromised subkeys, or even just giving his root key to someone he trusts who has better security, and more competence with these techniques, than himself. For public-key distribution, online trusted directories (such as DNS, LDAP, XKMS, etc.) should replace CAs. Users would have address books containing trusted fingerprints, which they populate manually or by querying directories. In sum, the argument is that fingerprints are better than certificates for key distribution, but that fingerprint key distribution is most effective when supported by cert-based private-key management, to secure the long life of the fingerprints. This is similar to PGP (without the Web of Trust) - PGP uses fingerprints to authenticate distributed keys, and has subkeys that can be used for private-key management. However, if you take this approach seriously, PGP's fingerprints and subkeys aren't good enough. PGP fingerprints are too long, and PGP subkeys don't support important techniques like revalidation, threshold subjects, or multiple layers of subkeys. So the paper presents "cryptoIDs", which are 20-character-long fingerprints; and cryptoID certificates, which are a certificate format designed solely for private-key management. Anyways, I'm interested to hear what anyone thinks. Thanks, Trevor

1 0

Re: Spelling corrections are now export-controlled
by Major Variola (ret) 02 Nov '03

02 Nov '03

At 11:12 AM 11/2/03 -0800, Steve Schear wrote: >At 01:47 AM 11/2/2003 -0800, Major Variola (ret) wrote: >>"Congress shall make no law respecting an establishment of religion, or >>prohibiting the free exercise thereof; or abridging the freedom of >>speech, >>or of the press; or the right of the people peaceably to assemble, and >>to >>petition the Government for a redress of grievances." >>Everything else is, of course, allowed. -Sunder > >So, for those of us who worship science it looks like we're home free. It >seems that such a religious bent isn't too far out. Both the recognized >religions and scince fall within the academic category of philosophy. Both >attempt to explain the nature of the world around us. Has there ever been >a 'formal' attempt to legitimize science as a religion? 1. You might try "empirical gnostic" when dealing with lawyer types. 2. There's also the Church of Strong Cryptography. Its kind of uptight though, it has sins, even mental sins, like considering arithmetical methods of producing random digits. 3. Always remember that the 14th restricts not only Congress but State and local vermin. And everything they give money to.

1 0