December 2003 - cypherpunks-legacy

Re: toolkits?
by droelke＠spirit.aud.alcatel.com 17 Dec '03

17 Dec '03

> > > >Third - provide services to the citizenry. For example - provide > >a public key server. Or how about a digital time-stamping service. > >If the crap was kept out of these services, and they were free for > >anyone to use, then it would advance the idea of encouraging people to > >use crypto in their daily lives. > > > > Now were getting specific. These are things that us ordinary folk can do > which show the 'leaders' how to follow. What software, hardware, > applications, support and sysadmin experience is required and where is it > available on what terms. What are the cash flow opportunities to support > such services? PGP Public key servers - see MIT's key server as a good example. Digital time-stamping service - see Betsie (sp?) from Bellcore as a basis. These are things that are already out there, BUT I think that we can use more services like this. Comercially there probably isn't the demand to support these yet, but I think we have a chicken and the egg problem here. People can't use encryption easily if they don't have good access to the tools, but people won't demand services like key-servers until they start useing the tools. A good service would be to provide and support distribution of of privacy enhancing tools to universities and companies that want them. i.e. have people who will help set up firewalls, PGP, encrypted telnet (pick your flavor), etc. A state wide group that has grants to provide internet connectivity for universities and companies could have a person that does nothing but work with these companies to help incorporate encryption into their networks. For instance, my employeer has hardware engineers putting VLSI designs on tape, and then fed-ex'ing them to the chip manufacturer, because they can't get good encryption set up that allows secured ftp transfers. (and get the manufacturer to agree to the same encryption technology, etc. etc. etc.) Yes - I know that most of this stuff is out there already, but having people *willing* to integrate it for you without charging an arm and a leg would go a long way towards convincing the suits that this is a *good* thing. Dan ------------------------------------------------------------------ Dan Oelke Alcatel Network Systems droelke(a)aud.alcatel.com Richardson, TX

1 0

Photuris 512bit Prime Challenge? (Re: Photuris Primality verification needed)
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hilarie Orman <ho(a)cs.arizona.edu> wrote: >> Well, since we already require 56-bit DES in ESP in the interests of >> promoting basic interoperability, wouldn't a 512-bit prime be >> similarly sufficient? > >If you are willing to accept that in all likelihood, one year from >now, some group will announce that can "crack" all key exchanges that >using the published modulus, then sure, call it sufficient. Sounds like someone just threw down a gauntlet. Is it even possible to do the precomputations in a distributed manner in less than a year or two? Or maybe starting a few years down the road? It would be nice to give Photuris a chance to get established before the least common denoninator shared modulus gets taken out, if we even can take it out. Richard -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKDVvfobez3wRbTBAQHpkgP9Fg+MGMz8U6Bisv45PZohoZxWbiEYuxJK tg8oHD8TZRQsuqCwveWFRTnmPGiGKs2cBs5ZKXkFNU6ot7lZLO8d/1BSSjo0yX2Q 0FSXDSaBjUKIFcjHHGYBWrZZ+gjc/bdab94EqQvmFSUmAp73/mnKZgcyUPGL3Cmt MW3jZhlVMdw= =bfsQ -----END PGP SIGNATURE-----

2 1

Re: expiration dates on cryptography
by David E. Smith 17 Dec '03

17 Dec '03

At 07:21 AM 11/8/95 -0500, John Curtis wrote: >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? It's a nice idea, really. The problem is - how do you verify the absolute time? For instance, by resetting a PC's internal clock you can instantly circumvent that measure. Possibly by forcing the application to consult a "reliable" clock like one of the cesium clocks, but that could be hacked. Unless you can absolutely, reliably, and without fear/danger of being hacked around, verify the correct time, self-destruct crypto probably won't happen. ----- David E. Smith, dsmith(a)midwest.net, PGP ID 0x92732139 http://www.midwest.net/scribers/dsmith

1 0

Re: DejaNews all over again--a URL for Usenet Searching
by Kevin S. Van Horn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- tcmay(a)got.net (Timothy C. May) wrote: > >Paul Robichaux pointed me to another searcher, http://www.excite.com/, >which _does_ index the alt groups. I'm sure more are coming, reaching >further and further back in time. A small point of information. I work for Architext, the company that provides the excite service. We only keep the last two weeks of USENET news around, and don't keep any archives going further back than that. USENET is just too damn huge for us to go to the trouble of keeping comprehensive archives around without good evidence of demand for it among our target audience. - ------------------------------------------------------------------------------ Kevin S. Van Horn | Uncle Sam needs YOU! vanhorn(a)atext.com | But not vice versa. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMKEY8ioZzwIn1bdtAQFFEgGA1e12AazfexoLEvlrQDWFGPqFOXafAgBZ NxKKd+nWATgsUQhwI7jQ0P8pTQ9XvI1k =7sgB -----END PGP SIGNATURE-----

1 0

Return of the Cyber-Censors
by John Young 17 Dec '03

17 Dec '03

The Washington Post, November 8, 1995. Return of the Cyber-Censors [Editorial] When the Senate passed its ill-advised "Exon amendment" to the telecommunications bill last spring, which would criminalize the transmission of obscene, pornographic or "indecent" material on the Internet, the measure got an overwhelming 84 votes, many of them from senators who didn't understand the implications of the move. Only a few weeks later, the House went even more overwhelmingly the other way, voting 420 to 4 for an amendment (co-sponsored by Reps. Ron Wyden and Christopher Cox) that would bar the Federal Communications Commission from regulating cyberspace and would instead make it legally easier for commercial Internet providers to use their own technical tools to regulate questionable material. The contrast was the result of a burst of public discussion in which more technologically astute members, including House Speaker Newt Gingrich, caught on to the disturbing fact that the kinds of far-reaching liability imposed by Sen. James Exon's formulation -- hastily adapted from an existing measure on telephone transmission -- would cripple practically any commercial Internet provider and effectively lame the new medium as a venue for moneymaking activity. Now these vastly different measures are in conference committee along with the rest of the telecommunications bill (in other areas of which, we remind readers once again, The Washington Post Co. has some interests). But the seeming clarity afforded by the House response to the Exon amendment and by Mr. Gingrich's appreciation of the need for untrammeled development of the new medium is nowhere to be seen. A letter from Christian Coalition head Ralph Reed, Phyllis Schlafly and other prominent spokesmen for the religious right is urging the conferees toward an Exon-style approach that's as destructive now as it ever was. The House bill also could end up including an amendment sponsored by Rep. Henry Hyde that adds some criminal liability to the transmission of obscene (but not "indecent") images via the new technologies. The argument against "criminalizing" the transmission of "indecent" images via the Internet remains stark and simple, and it goes not to the awfulness of child pornography or even to the ability of parents to control what their children do on the computer (a wide variety of off-the-shelf technological filters now exist that let parents do this themselves) but to the impossibility of regulation by the electronic middleman industries that are developing. Commercial providers such as America Online continue to pass along millions of messages a day, the interactive "newsgroups" unfold quickly and internationally, and the kind of central filtering envisioned by would-be regulators erases the very quality that makes the Internet a live and promising medium -- its inexpensive accessibility. If the Internet were like a telephone system, there would at least be the possibility of identifying a specific "sender" and "recipient." On the Internet it's "receivers" who do the selecting of what to look at and where. Giving those recipients the tools they need remains the way to go. The conferees should resist the urge to censor cyberspace.

1 0

Cybercensor in Singapore
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

NY Times, November 8, 1995, Editorial Cyberspace in Singapore. The Internet Threat to Official Censorship "The Internet is like fire," Mr. Yeo said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Singapore. From his 37th-floor office overlooking Singapore Strait, George Yeo can survey the oil refineries and bustling dockyards that helped make Singapore the trade and financial center of Southeast Asia. But the view that interests the Minister of Information and the Arts these days is not the vista beyond his window. It is the image on the computer terminal at his desk. Mr. Yeo, like the rest of Singapore's top politicians, wants his country to be a leader in the manufacture and use of computer technology without relinquishing the Government's chokehold on the dissemination of information in Singapore. Singapore's effort to find a balance point will be closely watched by other Asian countries that mix capitalist economics with authoritarian politics. The difficulty was underlined last week. Even as Mr. Yeo worried about the perils of the Internet, the Government announced it was relocating 500 industrial enterprises to make room for the development of advanced electronics manufacturing plants. Contradictions like that abound in Singapore, a country that eludes simple classification. With its gleaming skyscrapers and shopping arcades, it can seem like Dallas transplanted to the South China Sea. Conversely, the dominance of one political party and the presence of a paternalistic Government can make it feel like a remnant of the Soviet bloc. Salman Rushdie's "Satanic Verses" and Cosmopolitan magazine are banned, yet the city's largest bookstore stocks a selection of contemporary literature and the works of Chee Soon Juan, Singapore's opposition leader. Singapore's gaudy prosperity challenges the American faith that individual liberty is essential for a vital marketplace. George Yeo is the personification of that challenge. Born in Singapore in 1954, educated at Cambridge University and Harvard Business School, he is disdainful of the cacophony and untidiness of American democracy. Like Lee Kuan Yew, the architect and ruler of modern Singapore, he believes the vulnerabilities of his ethnically divcrse city-state can be best handled by a strong government that encourages a sense of community and limits individual rights. But controlling semiconductors is not the same as controlling newspapers, television networks or political opponents. With the aggressive use of libel and slander statutes Singapore's leaders have intimidated the newspapers that publish here, including The International Herald Tribune. To control television broadcasting, the Government has banned household use of satellite dishes. Some political pluralism is permitted, but no one doubts the primacy of Mr. Lee's People's Action Party. Recognizing the risk of bottling up public demand for foreign television broadcasts, Singapore's leaders are wiring the country for cable television. That way viewers will receive many more channels, including MTV, while the Government will still be able to screen out programming it finds objectionable. It is the quintessential Singapore solution. Singapore's approach to controlling cyberspace is equally ingenious, but harder to enforce. Mr. Yeo, essentially, hopes to control the Internet by embracing it. He is encouraging use of the Internet by equipping schools with computers, and establishing systems that allow Singaporeans to link up with the computer network by dialing a local phone number. The catch is that the Government will be able to monitor use of the Internet that goes through local servers, and is already intervening to block material it considers pornographic. The Government has blunted an uncensored Internet forum on Singapore political life by assembling a group of users who make sure the Government's views are represented. Mr. Yeo concedes that more sophisticated and affluent users can outflank many of his defenses by dialing into the Internet through foreign phone systems. His purpose, he says, is to lay down markers for citizens, expecting that most will abide by them. "The Internet is like fire," he said. "If you don't learn how to control it, it will burn you." In Singapore, a little democracy can be a dangerous thing. Philip Taubman -----

1 0

Re: expiration dates on cryptography
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:21 PM 11/8/95, John Curtis wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptograhy raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? An interesting twist. There are two broad things to consider: 1. Cryptography, what can mathematically be done. 2. Economics and social systems, what "business ecologies" can do. Pure cryptography is about #1, with minimal consideration of #2. Much of what interests me involves #2. How this relates to your interesting question goes as follows. Even the "timed-release cryptography" is NOT a pure cryptographic system, as the idea of "temporal state" in crypto is iffy. That is, clocks can be jiggered. Even "sealed clocks" can be jiggered. But just as Haber and Stornetta's "digital timestamps" use time, such a thing is possible once _economic agents_ enter the picture. And once economic considerations are used. The "timed-release crypto" system depends for its security on the likelihood that N agents holding pieces of something--something they don't know the value of--will likely hold those pieces for as long as they are being paid. (If you want to discuss why this is likely, even in a world of mistrust and malice, we can discuss it.) "Self-destruct crypto" would work roughly the same way: -- N agents holding pieces of puzzle, contracted to destroy those pieces on such-and-such date. It is likely that some or even all of them would comply, if properly paid. Caveats: 1. Sure, they could make backups. Probably do. But just as archival files are shredded, a system for eliminating "expired" files would be possible. 2. Sure, they could cheat. Ditto for "timed-release crypto." (Time is symmetric for this problem.) 3. Again, the security of the system to a large extent depends on the N agents not knowing what the pieces are part of, nor knowing who the other holders are. They never know whether a given piece is part of an audit, a test, etc. 4. There is a slight asymmetry, despite what I said, in that one can "test" agents to see if they'll release their pieces as contractually obligated to, but one can never be sure that agents have actually destroyed their pieces. 5. Still, distributing a secret amongst, say, 30 agents and having them "agree" to destroy their pieces on January 20, 2002, seems pretty likely to result in the collective secret (n-out-of-m pieces) being recoverable after that date. Such a system would need more consideration of backup strategies, etc. (If everyone is carefully backing up and the backup tapes are somewhere, then quite clearly the secret would not be gone; hence the issue of backup strategies.) >I suspect that the laws of thermodynamics might prohibit this >in classical cryptography because as a message expired the >amount of entropy would decrease. Quantum cryptography >might work, but that will be science fiction for some time to >come. I'm always interested in the links between information theory, algorithmic complexity, and notions of entropy, but I am skeptical in the extreme that the "laws of thermodynamics" have anything to do with whether one can throw away bits. If I make a list on my computer, and then erase it, have I violated a "law of thermodynamics"? Of course not. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: expiration dates on cryptography
by Bill Stewart 17 Dec '03

17 Dec '03

[ Hmmm, maybe I'd better get this message out quickly, before it expires... :-] At 07:21 AM 11/8/95 -0500, John Curtis <jbell(a)capecod.net> wrote: >The discussion between Mr. May and Mr. Shields concerning >time-release cryptography raised an interesting question in my >mind. > >Given that trust is often of an ephemeral nature, it would be >quite useful to set time limits on secrets. Would it be possible >to cryptographically protect a secret such that it could not be >decrypted after a certain time? Decryption is equivalent to knowing a secret plus doing some work. There are two ways to make information available/unavailable - by depending on calculations from known data, or by having people agree to publish/delete it. The former method is trustable, but doesn't have time built in to it - either you know stuff or you don't. The latter method is harder to trust - you can build contractual mechanisms to encourage people to keep their commitments, and use crypto methods like splitting shared secrets to limit the impact of some of them not keeping them - but it's basically not cryptographic. Getting people to keep information secret for a while and then publish is possible; that's within their control. Getting people to keep information public, and then delete all the copies they own is possible, but if the information is _public_, anybody in the world could have a copy - deleting it requires finding them all, and getting them all to agree to delete it. That's _much_ harder. You could build a system where an escrow agent keeps a piece of information private, but available upon request, and deletes it on a certain date. That lets you know that _if_ nobody's asked for the information by then, and the agent has done its job, that nobody else will be able to decrypt it. Again, you can secret-share among multiple agents to decrease the impact of defaults (either failure-to-delete or failure-to-deliver.) A related approach is for the agent to provide a service of decrypting data encrypted with the agent's public key, and agreeing only to decrypt data before or after some date specified in the message. Another technique you can use is to for the agent to keep the data until paid for delivery; the retrieval token includes a digital check with an expiration date. In this case, you're trusting the bank to not honor the check after its expiration date, and the escrow agent not to deliver the data without getting paid. For this service, you want checks rather than cash - if the check goes stale, the money is still in your account. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

Re: PGP Comment feature weakens remailer security
by Patrick J. LoPresti 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- bill.stewart> So, for safety, either turn off PGP comments before bill.stewart> using it with remailers, or wipe out the comments by bill.stewart> hand before each layer of encryption (easy to do with bill.stewart> GUI-based systems like Private Idaho; I don't know if bill.stewart> premail lets you do this or not.) Incidentally, Mailcrypt's remailer support strips the comment field after each encryption, and has done so since version 3.2. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.4, an Emacs/PGP interface iQCVAwUBMKEmVHr7ES8bepftAQEPSgP9FJYeKUSZKyFN/VWIwLjKIaDVzPtzyqHR tbj1UqbDl1trrKCoV6uud5qfK/FQwqQylnv1YsYNIVPPav66ImUvgSaXUMvZJBvC 8vinQI66s3M1PBJ8VIaLuVtay826JDazGHEexHpDLwNVGLdJq0RrNLVr2H9oLA8g 5aE9MHVfAcM= =MdHQ -----END PGP SIGNATURE-----

1 0

RE: using pgp to make an otp
by amp 17 Dec '03

17 Dec '03

-- [ From: amp * EMC.Ver #2.3 ] -- -----BEGIN PGP SIGNED MESSAGE----- From: John Curtis \ Internet: (jbell(a)capecod.net) To: amp \ Internet: (alan.pugh(a)internetmci.com) Subject: RE: using pgp to make an otp JC> I was confused and answered a question you didn't ask. I guess you JC> can use PGP to generate a set of pseudorandom numbers. I'm not sure JC> that this would be different from using the IDEA cypher (the JC> underlying PGP cypher) to generate random numbers. I am also not JC> convinced that this would be quicker or cheaper than any number of JC> other mechanisms. JC> If I really wanted a true one-time pad, I'm inclined to explore the JC> thermal noise of a zener diode. isn't the noise generated by such a diode more accurately described as chaotic rather than random? i would think that there might be potential problems with using chaos as a random number source. it might be somewhat less random than you may think as most chaotic system's 'noise' operates within definable parameters. (like a lorenz system). i _would_ think that it would act as a most excellent prng, but exactly how _truely_ random it actually would be i couldn't say. while it may not be _truely_ random, it would most likely be cryptographically secure though. i think generating _true_ randomness is pretty difficult without measuring something similar to radioactive decay. the system that i proposed setting up is, admittedly, a p-otp at best. i'm much more convinced of this than i was when i initially proposed it. the comments i've gotten on it were most enlightening. amp <0003701548(a)mcimail.com> (since 10/31/88) <alan.pugh(a)internetmci.com> PGP Key = 57957C9D PGP FP = FA 02 84 7D 82 57 78 E4 E2 1C 7B 88 62 A6 F9 F7 November 9, 1995 11:41 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMKIvRIdTfgZXlXydAQG0zAf/Y0qX8X6mFa932Egm0PdBZr4RCBHqPccx 5Nb5KZi1jQPRFnoAoEgU6Z6P+SLWCGhZisn1UxvlD2eX6HbbPB/B0mHReoWw/qp2 hI7rWCn+JtSwUvxeno88zFmZ/AreAukm8LNi/PdJp+5lunDgclrOWoR5BklglqT8 iE2nxd6dhbUEKUYXzsN6yEXDRl/tUDiriEVev2YhttTZuyUg9krMa32VtyxyUCeB UfhidSjgwkNkSO3QQaHVHUCby8NHQJPRdKR4ym8tDfFjNXxieUQKwxi8r/0ofo5g 1UxtBwJICd+/LxOZovtKGYDqHJc4vPRqdY7x4VbTff0FM4i4W0ZpUQ== =6ty1 -----END PGP SIGNATURE-----

1 0

DUF_ibf
by John Young 17 Dec '03

17 Dec '03

Pal has provided a gopher-FBI paper: "Computer Crime Categories: How Techno-criminals Operate." By David L. Carter, a professor in the School of Criminal Justice, Michigan State University Types of Computer Crimes Computer As the Target Computer As the Instrumentality of the Crime Computer Is Incidental to Other Crimes Crimes Associated With the Prevalence of Computers Perspective on Legal Issues Special Problems with Computer-Related Crime Intellectual Property Malfeasance by Computer International Issues Conclusion Criminals have adapted the advancements of computer technology to further their own illegal activities. Unfortunately, their actions have far out-paced the ability of police to respond effectively. DUF_ibf (21 kb in two parts)

1 0

Re: DejaNews all over again
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Perry E. Metzger wrote: > anonymous-remailer(a)shell.portal.com writes: > > I wish that Detweiler could (seriously) go back to wherever he came from. > > What a fascinating statement to make, considering that you are > probably Detweiler. Fascinating. First, I'm accused of being noted computer viral expert, Dr. Frederick B. Cohen, (simply because he agrees with my assessment of the critical algorithm flaw in Netscape Navigator) and now I'm accused of perhaps being at the other end of the spectrum. Of being Detweiler, simply because he can take my signature and identity by signing an email, as Alice de 'nonymous or simply accusing me of posting in his "style". I see that the character assassination sport continues, and I am now a targetted. Hunter become hunted. I wonder why?? And why, by of all people, Perry? Is it perhaps because, I speak the truth, and the truth makes people very, very nervous. Is it because the flaw which is in the Navigator product is woven into the code fabric, and can't be *fixed*. Afterall, Netscape (and AT&T) have had, over THREE WEEKS to work on this problem or to make some form of public comment, and have done nothing, but put some of their programmers -- unofficially ... speaking for myself ... not speaking for the Company -- programmers on this list Meanwhile people are having their PGP keyrings collected, their passwords monitorred, and all of the information -- even information which they have NOT posted to Usenet, information that is simply on their personal hard drives, or on a private corporate network that is behind a firewall -- collected by anyone who actualy understands *how* to use Netscape Navigator's standard features to do it. And so the question is: Why am I having my character asassinated while this threat continues?? And while the loss and damage continues. Why are Netscape and AT&T not mitigating the damage? Is it because what I say is simple common sense stripped of the veneer of "technical language" and jargon?? And can't be *commented* on or *fixed*. Is this the fear which any truth teller faces, not only on the Internet, but in any forum where they try to challenge Goliath. Maybe, that's one reason to post anonymously. To clear the record definitively, I am neither Detweiler nor Dr. Frederick B. Cohen, and I am not the issue. I am simply myself, and I will _reveal_ my identity to the international public once the timing is appropriate. If anyone wants to know who I am, they can contact the PR department of AT&T or Netscape and ask. (Their address can be requested from either postmaster(a)att.com or postmaster(a)netscape.com, respectively.) Both companies have an email address for me, and would _likely_ *cough* forward any email enquiries to me without any editing. That way, everything is done clearly and out in the open. Nothing hidden, and nothing private, and none of my comments will become "their sole property to be used in their sole discretion". Neither company can accuse me of attacking them with daggers in the dark of night, from behind a shield of anonymity, when I advocate public open disclosure and commentary. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

True Random (short c-source)
by Frank Andrew Stevenson 17 Dec '03

17 Dec '03

I have written a short random number generator which appears to produce reasonable random numbers even in DOS, at the heart of the code is the short function fGetRand, the amount of entropy derived from this function varies from >1 to >>6 depending on system load, I haven't made any effort to whiten it at all. I am not making any claims about its usefulness. I am only trying to demonstrate the ease at which good random number may be obtained. Any comments and analysis will be mostly welcome, the source is hereby placed in the public domain: I have used WATCOM10 to compile and test under DOS/WIN95, where clock is running at 18hz. I have also tested on IRIX with impressive results. --- START ---- #include <time.h> #include <stdio.h> int fGetRand (void); main (void) { long vCount; FILE *out; int byte; int tick; out=fopen("random.bin","wb"); if(out==NULL) { printf("cant write to file random.bin\n"); exit(1); } for(vCount=1;vCount<=512;vCount++) { tick=fGetRand()&0x01; byte=byte+byte+tick; if((vCount & 0x7)==0) fputc((char)byte,out); fputc((char)tick,out); } fclose(out); } int fGetRand (void) { int count; clock_t tick; tick=clock(); while(tick==clock()) count++; return (count); } ----- END ----- PGP encrypted mail preferred, finger for key. The above views are ONLY endorsed by BoggleMind Inc. (not to be confused with MindBoggle Ltd.)

3 2

ecash speed
by Hal 17 Dec '03

17 Dec '03

A few days ago I got my ecash account set up with the Mark Twain bank. Presently only one merchant is officially listed at <URL: http://www.marktwain.com/shops.html>, Delorie Software. As I understand it, only people with merchant accounts are eligible to be listed here. However, you don't have to have a merchant account to receive ecash or to set up shop software. If anyone else has set up a shop to receive Mark Twain ecash using a user account, perhaps they could post here and we could keep a list of unofficial vendors. The other thing I wanted to write about is ecash speed. One idea people have had is to use ecash for micropayments, such as one cent to read a web page. The question is, is the current ecash software sufficiently fast for this? Maybe someone could set up a site using either Twain ecash or DigiCash ecash which actually charged you a penny for each page you browsed around. It would be interesting to see how much of an obstacle it presents in browsing the web. The impression I've had from the few times I've used ecash is that in fact it does slow things down way too much for this to be practical. But it would be good to actually do the experiment. One reason I was thinking about this is reading a new paper by Rivest and Shamir, <URL:http://theory.lcs.mit.edu/~rivest/RivestShamir-mpay.ps>. It is about a couple of proposed systems for micropayments, specifically oriented towards the penny-per-web-page model. They are offline systems, designed so that a minimum of calculation is done by the vendor, user and bank. So they should be very efficient. However, the big problem is that they are not anonymous. The cash tokens are recognizable by the bank when spent tokens are sent in by the vendors - the bank knows who spent them. Maybe for penny level transactions that is not a big deal, although if for-pay web browsing becomes common then it does seem like it would present a privacy threat. Every web site you visit (not the specific pages, but the overall site names) would be known by the bank - quite a significant piece of marketing data. The point is that if the anonymity afforded by ecash is too costly in terms of time, then we may end up stuck with a non-anonymous system simply because that is the only one efficient enough to work. It would be good to find out if that is a serious problem. Hal Finney

3 4

Re: PGP Comment feature weakens remailer security
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Wed, 8 Nov 1995, Raph Levien wrote: > On an unrelated topic... cypherpunks like to count bits, right? Mmmm, sometimes we do ... <g> Sometimes we even think, if I were a lil wa'bbit, where would I go hide ... especially when we do a bad Elmer Fudd impression of Bugs Bunny. <p> > What is the correct number of pseudorandom bits to use in a MIME > multipart separator? If the data has a line which matches the > separator, the message is corrupted. Of course, if you can take > multiple passes through the data, you can simply verify that it does > not contain a line which matches the separator. But if you're > restricted to a single pass, then the only way to do it is to use a > randomly generated separator. An interesting problem. If you are going to take multiple passes, and do top-down and bottom up analysis, then you can't really parse on the fly. It pretty much has to be a batch job, I think. You have to get your data, and then check it. You can't simply *trust* that there is not any corruption, and pass all of your data through. And if you're going to parse in a single pass, then we're back to the problem of monkeys sitting at typewriters and Shakespeare's sonnets. > I figure that 128 bits should _definitely_ be enough (that's what > is in the new premail code now). Even 64 bits should ensure that it is > unlikely that anyone will ever experience message corruption over the > expected lifetime of premail. However, it makes me nervous. What do > people think? Unfortunately, it's not quite that simple. The likelyhood of corruption is not based on each past run. It's just like rolling dice. The odds of rolling boxcars is 1 in 36 (I think) no matter how many prior times, you've rolled boxcars. Twenty passes doesn't influence whether you crap out or not on a single roll. Nothing *remembers* past performance to ensure that something doesn't happen (or happens) many, many times in a row. I guess, this is why Atlantic City, Baden Baden, and Las Vegas generally do as well as they do. Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

"Industry Group Rebuffs U.S. on Encryption" (NYT 8Nov95, C3)
by John Gilmore 17 Dec '03

17 Dec '03

A group of 37 companies and trade and privacy associations sent a letter to Al Gore yesterday, complaining about Clipper-II and crypto export controls, and promising to send their own policy proposals to Congress and the Administration within six months. It's a short story. I'll leave the exact text to John Young :-). I've heard that there's a better story in the Washington Post today, too. I expect we'll see the letter itself within a day or two. John Gilmore

1 0

Re: Market Value of Web Pages
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 13:28 11/9/95 -0800, Timothy C. May wrote: >With all due respect to Bill--his mention of agorics tells me he knows >something about computational ecologies and markets--, there is no >reasonable way to say what price is "closer to the current market value of >the page content," except by what the market will bear! Tim is absolutely correct that the market determines the current market value. I mentioned some low value items in the current market and he mentioned some high value ones. However, there is not really a problem in paying for high valued web pages (like the $400/photo consultant report he mentions). The various network payment schemes that have been proposed and implemented will handle these quite adaquatly. What concerns me is building systems that can support low-cost high-volume markets. If I have to pay a penny/page, I am going to ask whether Netscape can use a whole gigabyte disk for its cache and have basically a pay/copy system. If the cost is low enough, I will pay/view and avoid stale data in the cache problems. However, there are very few systems where the transaction costs are low enough to support low-cost high-volume markets. Bill ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

ACLU Cyber-Liberties Update: Nov. 8, 1995
by ACLUNATL＠aol.com 17 Dec '03

17 Dec '03

----------------------------------------------------------------- November 8, 1995 ACLU CYBER-LIBERTIES UPDATE A bi-weekly e-zine on cyber-liberties cases and controversies at the state and federal level. ----------------------------------------------------------------- IN THIS ISSUE: * ACLU Statement and ACTION ALERT on Federal Wiretap Bill * ACTION ALERT on Federal Online Indecency Legislation * State Utility Commissions Consider Online Access and Privacy Issues * News on Electronic Access to Public Information in Washington State * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington * ACLU Student Chapter President at Georgetown University Law Center Writes About Marty Rimm Controversy * Conferences * Online Resources from the ACLU National Office and State Affiliates ----------------------------------------------------------------- FEDERAL PAGE (Congress/Agency/Court Cases) ----------------------------------------------------------------- * ACLU Statement and ACTION ALERT on Federal Wiretap Bill Last week, the ACLU emphatically urged the FBI to withdraw its proposal for greatly increased wiretapping powers. "Given the government's own statements on the usefulness of wiretaps, we can only guess at the FBI's motives," said Laura W. Murphy, Director of the ACLU's National Washington Office. "But if Congress were to allow this system to go into place, we'd have a national surveillance apparatus that would pale in comparison to the infamous security state of the former Soviet Union." "This proposal, Murphy added, "would make the KGB look like privacy advocates." "The proposal would dramatically reduce the privacy rights in the United States because it would -- no matter what the Justice Department says -- result in significant increase in the number of innocent third party conversations intercepted by law enforcement officials," Murphy said. "Already too many innocent conversations -- nearly two million in the last year alone -- are intercepted by federal and local law enforcement wiretaps." According to the government's own statistics, 1,800 innocent conversations are intercepted each and every time a wiretap or other form of electronic surveillance is placed. Just last week, the ACLU joined with the National Rifle Association and a broad coalition of other gun advocates and civil liberties organizations in calling for Congress to institute a 24-point reform plan for federal law enforcement. In a letter to Congress, the groups said that the excesses of Waco and Ruby Ridge demonstrate that Congress and the Administration must begin to reign in the powers of federal police authorities. [The 24-point reform plan and related documents are available on America Online, at keyword ACLU, under "federal law enforcement reforms." For an e-mailed copy of the reform plan, send a message to infoaclu(a)aclu.org with "fed law enforcement reform" in the subject line.] URGENT ACTION NEEDED: -Call the FBI at 202-252-7296 and urge it to withdraw the proposed wiretapping system. You can also find the phone number of the FBI's local field offices at the FBI web site at http://www.fbi.gov. -Call the Attorney General at 202-514-2001 and urge her to order the FBI to withdraw its wiretapping proposal. -Call your members of Congress and tell them to urge the Justice Department and the FBI to withdraw the wiretap proposal. Urge your representatives to oppose any funding for this wiretap scheme. You can reach the Capitol Switchboard at 202-224-3121 for the Senate and 202-225-3121 for the House of Representatives. -Call Rep. Bob Barr (R-GA), a former federal prosecutor and leading opponent of funding effots for wiretap: Rep. Bob Barr U.S. House of Representatives 1607 Longworth Building Washington, DC 20515 (202) 225-2931 -Call your own telephone companies, both local and long distance, and urge them to oppose the wiretap proposal and to stand up for the privacy rights of their customers instead of becoming the snooping arm of a prying government. ----------------------------------------------------------------- * ACTION ALERT on Federal Online Indecency Legislation The conference committee on the telecommunications bill will soon consider whether to remove provisions that would make "indecency" a crime in cyberspace. On Monday, November 6, we distributed an action alert urging individuals to call Congress to express opposition to any measures to censor the Net. THIS MAY BE YOUR LAST CHANCE TO STOP UNCONSTITUTIONAL RESTRICTIONS ON YOUR RIGHT TO FREE SPEECH IN CYBERSPACE!! [You can find the action alert on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace," or on the Internet at http://www.vtw.org/] In addition to the call to action for individual Net users, the ACLU and People for the American Way obtained signatures from over 75 organizations to a letter opposing the federal online indecency provisions. The letter will be sent to Senator Pressler and Representative Bliley on the conference committee later this week. [After 11/13, you can find a copy of the organizational letter on America Online, at keyword ACLU, under "threats to civil liberties in cyberspace." To receive a copy of the letter via e-mail, send a message to infoaclu(a)aclu.org with "organizations opposed to online censorship" in the subject line.] The ACLU continues to prepare for a constitutional challenge to the online censorship provisions if they become law. Please contact Ann Beeson, beeson(a)aclu.org, if your organization is interested in being a plaintiff in this ground-breaking litigation that will define First Amendment rights in cyberspace. ----------------------------------------------------------------- STATE PAGE (Legislation/Agency/Court Cases) ----------------------------------------------------------------- * State Utility Commissions Consider Online Access and Privacy Issues Many state utilities commissions are considering issues that can affect your online access and privacy rights, from approving caller ID to defining universal access. Online users are urged to stay informed and involved in utilities commission decisions in their states that may affect cyberspace rights. Consumer Project on Technology has put up a list of information about state utility commissions. The list includes contact information for all 50 state utility commissions, and also lists utility consumer advocates in 40 states. See http://www.essential.org/cpt/isdn/contacts.html ----------------------------------------------------------------- * News on Electronic Access to Public Information in Washington State A Washington State task force has been examining the issue of electronic access to information maintained by government agencies. The ACLU of Washington submitted comments commending the task force for requiring some form of free electronic access, and limiting all fees to incremental costs. But the task force was criticized for not paying sufficient attention to privacy, especially increased threats to privacy presented by accumulation of information on individuals from diverse sources. Also in Washington State, King County Superior Court Judge George Finkle ruled that Geographical Information System databases are public records and must be made available to the public for nominal copying fees. (GIS systems are databases that contain information associated with a physical location, such as the location of utility cables, public buildings, roads, demographic information, zoning info, or traffic density.) As in many locations around the country, the City of Bellevue had attempted to charge far higher fees for GIS databases, which were created for government use but also have commercial value. This ruling reaffirms the notion that public information should be available to all, not just those with deep pockets. ----------------------------------------------------------------- * John Perry Barlow Launches Cyberspace Lecture Series Co-Sponsored by the ACLU of Washington The ACLU of Washington began a series of talks in Seattle to explore the impact and implications of the technology revolution on art and culture. John Perry Barlow, former Grateful Dead lyricist and co-founder of the Electronic Frontier Foundation, launched the series on November 3rd. "Cyberspace is largely about conversation that ultimately could include everybody on the planet . . . . Cyberspace can be the greatest venue for freedom of expression humans have ever had," said Barlow. Barlow talked of the spiritual dimension of cyberspace, which he sees as an egalitarian ecosystem with the potential to link "every synapse on the planet." For him cyberspace must be a place where anybody can say anything they think without fear of reprisal. But he tempered his lyrical vision of cyberculture with a warning of the dangers of censorship from elected officials who do not appreciate -- or even understand -- how new forms of communication function. "When I visit Congress, I feel like Tom Paine in the Court of King George," Barlow quipped. ----------------------------------------------------------------- * ACLU-Georgetown University Law Center President Writes Articles on the Marty Rimm controversy Alan Lewine, President of the ACLU student chapter at GULC, has written a series of articles for the Georgetown Law Weekly on the Georgetown Law Journal's involvement in the controversial publication of Marty Rimm's purported study of net porn. They are available at http://www.tripod.com/userland/A/alewine/index.html ----------------------------------------------------------------- CONFERENCES ----------------------------------------------------------------- Nov 8, 6 pm: "Regulating the Internet: Should Pornography Have A Free Ride on the Information Superhighway?" Benjamin N. Cardozo School of Law, 55 Fifth Avenue, New York, New York. Panelists include Nadine Strossen, National President, ACLU; Bill Burrington, Staff Counsel of the Electronic Frontier Foundation; and Barbara Bennett Woodhouse, Professor of Law at University of Pennsylvania Law School. Sponsored by the Cardozo Arts & Entertainment Law Journal. Nov 16, 5 pm: Nadine Strossen (National President, ACLU) speaks on "Defending Pornography: A Feminist Perspective on New Technologies and Old-Fashioned Sex," GULC, 600 New Jersey NW, 12th Floor Ballroom, Gewirz Hall. Co-sponsored by ACLU-GULC and the Student Bar Association Speakers Fund. ----------------------------------------------------------------- ONLINE RESOURCES FROM THE ACLU NATIONAL OFFICE ----------------------------------------------------------------- Stay tuned for news on the ACLU's world wide web site, under construction at http://www.aclu.org. America Online users should check out our live chats, auditorium events, *very* active message boards, and complete news on civil liberties, at keyword ACLU. ----------------------------------------------------------------- ONLINE RESOURCES FROM ACLU STATE AFFILIATES ----------------------------------------------------------------- Florida: ACLU of Pinellas County Florida http://www.stpt.usf.edu/~greek/aclu.html Illinois: Illinois Civil Liberties Union http://www.aclu-il.org/ Champaign County, Illinois ACLU Chapter http://www.prairienet.org/cc-aclu/ (The chapter also maintains an Illinois Civil Liberties Alert List. To subscribe send a message to cla(a)prairienet.org) Indiana: Indiana Civil Liberties Union http://www.inetdirect.net/iclu/ South Carolina: ACLU of South Carolina http://www.cris.com/~katrinan/aclu/index.html ----------------------------------------------------------------- ACLU Cyber-Liberties Update Editor: Ann Beeson (beeson(a)aclu.org) American Civil Liberties Union National Office 132 West 43rd Street New York, New York 10036 To subscribe to the ACLU Cyber-Liberties Update, send a message to infoaclu(a)aclu.org with "subscribe Cyber-Liberties Update" in the subject line of your message. To terminate your subscription, send a message to infoaclu(a)aclu.org with "unsubscribe Cyber-Liberties Update" in the subject line. For general information about the ACLU, write to infoaclu(a)aclu.org. ----------------------------------------------------------------- **PLEASE REPOST WITH HEADER INTACT**

1 0

This is an Architext Document: Read Carefully!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:54 PM 11/8/95, Kevin S. Van Horn wrote: >A small point of information. I work for Architext, the company that provides >the excite service. We only keep the last two weeks of USENET news around, >and don't keep any archives going further back than that. USENET is just too >damn huge for us to go to the trouble of keeping comprehensive archives around >without good evidence of demand for it among our target audience. Small world. "Architext" is also the hypertext program I use to cross-index many articles. I'm surprised the new company, also called "Architext," picked a name which will increase confusion. ("Architext," BrainPower, Inc., Agoura Hills, CA.) No Cypherpunks relevance, except to show how name collisions can occur. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Industry Group Rebuffs U.S. on Encryption
by John Young 17 Dec '03

17 Dec '03

The New York Times, November 8, 1995. Industry Group Rebuffs U.S. On Encryption By John Markoff The campaign by the Clinton Administration to create a standard for data encryption acceptable to industry, civil liberties and law enforcement groups broke down yesterday when a group including some of the nation's most powerful technology companies rejected a compromise proposal. The aim is to set a policy that meets the needs of electronic commerce as well as the concerns of the National Security Agency and other Federal offices that are opposed to the proliferation of data-coding software, feeling it will make it impossible for them to gather intelligence overseas. The Administration offered a compromise plan and had been seeking comment from the public. But the industry coalition said yesterday that it found the Government unwilling to compromise. Thus, the group of 37 companies said, it would formulate its own policy proposal to present to the White House and to Congress in the next six months. High-technology industries want a data-coding standard secure enough that both businesses and overseas customers could use it for sensitive financial and business correspondence. They seek a longer and more powerful encryption key than the Government is willing to grant, and object to Government demands that law enforcement agencies have "back-door" access to such transmissions that would allow them to intercept coded messages. The letter is signed by several of the country's leading computer, software and on-line companies, among them America Online, Apple Computer, AT&T, Eastman Kodak I.B.M.'s Lotus Development division, MCI Communications, Microsoft, Novell, Oracle Sybase and Tandem Computers. On Aug. 17, the Administration proposed a liberalization of export-control procedures for "key escrow" software products, or those providing law-enforcement access. "The current policy directive also does not address the need for immediate liberalization of current export restrictions," the letter said "Such liberalization is vital to enable U.S. companies to export state-of-the-art software products during the potentially lengthy process of developing and adopting a comprehensive national cryptography policy." [End] ---------- The Washington Post, November 8, 1995 Encryption Control Plan Sparks Industry Protest High-Tech Groups Say Proposals Unworkable By Elizabeth Corcoran High-technology companies and advocacy groups are writing to Vice President Gore and House Speaker Newt Gingrich to protest what they contend are unworkable federal proposals for controllng the export of data scrambling technology. The letters deepen an industry-government rift that began only days after federal officials unveiled an outline of what they hoped would be a palatable plan at an industry meeting in August. Two separate coalitions are criticizing the administration's draft proposal, which the government circulated on the Internet on Monday. Current export regulations prohibit companies froan sending overseas any encryption, or data-scrambling technology, that exceeds a certain degree of sophistication. The government argues that it needs to be able to peek at messages and files with proper court authorization -- to do its job of protecting U.S. citizens from terrorist groups and other malevolent organizations. In July, some French students demonstrated they could readily break the type of encryption technology that the U.S. government lets companies export. In August, the administration said it would let companies include more complex types of encryption, provided they pledged to entrust to an authorized agent a "spare key," or the means for unscrambling the information. Unlike early proposals in which the government said it would hold such keys, the administration is suggesting that companies and individuals would be able to select private keyholders, much the way people pick their banks. But after a brief honeymoon, industry and civil liberties groups began to find flaws with the details in the new proposals. This week's letters indicate that whatever fragile compromise the government had hoped it had found has grown even weaker. One coalition, pulled together by the Washington advocacy group Center for Democracy and Technology, includes about three dozen high-tech companies and associations. The group has promised to draft an alternative plan within six months. "There is a very serious message here: that national security can't be controlling the Internet," said Jerry Berman, executive director of the center. "There are other issues, global competitiveness and privacy, that need to be placed in the balance -- and the administration's policy doesn't do that." A second coalition of about 10 free-market and libertarian groups, led by another policy group, Americans for Tax Reform, plans to send their letter to Gingrich in the next day or two. The group contends the administration's encryption proposals are an encroachment on citizens' civil rights. The administration's proposals would not restrict tbe encryption technologies that people use within U.S. boundaries. But it would require that if they electronically send an encrypted message to parties outside the United States, a spare key must be stored with an authorized agency. "Even though we recognize [the administration] has worked hard on its proposals, it's not the right direction," said Rebecca Gould, director of policy at the Business Software Alliance, a trade association of software firms. "We've been in this [debate] since July 1994," she added, a long time for companies that churn out a new version of most products every 18 months. "That means lost sales for us and a loss of U.S. industry sales abroad." [End] ---------- Both slipped by gummed eyes, thx gnu.

1 0

Virus-Blocker
by James M. Cobb 17 Dec '03

17 Dec '03

Friend, This item from 11 07 95 Edupage may be of interest to you: VIRUS-BLOCKER McAfee Associates has a new product called WebScan that identifies virus-tainted programs before they're downloaded and warns the user not to continue. Security experts say WebScan is the first product that prevents viruses from in- fecting a computer to begin with, rather than attacking the problem after it's already occurred. (Wall Street Journal 6 Nov 95 B6) Cordially, Jim NOTE To subscribe to Edupage, send a message to: listproc@ educom.unc.edu In the body of the message type: subscribe edupage <your name>

1 0

Re: PGP Comment feature weakens remailer security
by James A. Donald 17 Dec '03

17 Dec '03

At 05:47 PM 11/8/95 -0800, Raph Levien wrote: > So let me rephrase the question: what's the minimum number of entropy > bits that can be used and still give you that warm and fuzzy feeling > that you don't have to worry about the possibility that the message > might be corrupted? I guess that if comet hits the earth and exterminates the human race you would not be unduly worried by a corrupted message, so let us make the odds equal to human civilization being destroyed on the same day. We get roughly one massive extinction every hundred million years, or so and a smaller blast that would demolish our technology every ten million years or So the probability of an error was equal to the human race and most major species being destroyed the same day, you would not be unduly worried. Probability of human civilization and all large animals being wiped out by comet impact tonight is 2.7E-11, so thirty five bits should be sufficient. But, if you want to feel really comfortable, make it forty bits. The probability of hitting a forty bit combination by chance is equal to the probability that all large animals on earth will be wiped out by comet impact in the next three quarters of an hour. But you might have a million lines, and send a million messages, each of a million lines. So let us make the probability that one of those fails equal to the chance that all large animals on earth get wiped out in the next half hour. Well in that case make it eighty bits. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Register
by viking＠pacifier.com 17 Dec '03

17 Dec '03

Register I'd like to sign up for email Bob

1 0

Pegasus Mail 2.20
by Scott Staedeli 17 Dec '03

17 Dec '03

The new beta release of Pegasus Mail (one of the better e-mail apps available) has a new feature: -------------------------------------------------------------- Runtime-loadable encryptor/decryptor modules for Pegasus Mail. Pegasus Mail System, Copyright (c) 1990-95, David Harris, All Rights Reserved -------------------------------------------------------------- The hot topic on everyone's lips is "privacy". And, as usual, the computer industry is in the process of confusing and disrupting the issue beyond recognition... We have factions all over the place each arguing passionately for its own most beloved encryption scheme, and some of the rhetoric is getting pretty heated. Add to the proliferation of interests the USA's ridiculous export laws on encryptors and the sum is trouble. As far as I can tell, encryption is going through what seems to be an industry-standard cycle of chaos: everyone suddenly realises there's a lack/opportunity/need and rushes to promote the idea they like best; a small war develops during which the users and peripheral developers are left bemused and bewildered amongst the welter of extravagant claims and counter-claims, then eventually (usually after two or three years of total pandemonium) the group with the most clout (although not necessarily the best product) will win out and become "the standard". I've been through this rat race several times and have no desire whatever to go through it again; on the other hand, my USERS have very legitimate concerns about privacy. So what do I do? Easy - I pass the buck. WinPMail v2.2 and later supports third-party, runtime loadable modules to handle encryption and decryption of mail. A special mechanism has been defined that allows Pegasus Mail to detect that a third party encryptor has been used and to determine whether the matching decryptor is available on the system. The built-in encryptor will remain available for those sites who only need moderate levels of message security. WinPMail will define an open interface for third-party encryptors and it is then up to other people to write the code. What I envisage actually happening is people writing "shell interfaces" for WinPMail - i.e., modules that take the calls I make and translate them into calls to other programs, such as PGP or whatever, returning the result. Let the games begin. --scottst@ionet.net------http://www.ionet.net/~scottst-- >~<^xXx | "The Internet is simply a means of xX # | communication. Efforts to stop infor- (XXX) # | mation by enjoining it are doomed to (XXXXXXX) | failure in a free society." DON'T TREAD ON ME| -- Prof. Frank Tuerkheimer ======================================================== =========NSA trip phrase of the week: DEUTERIUM=========

2 1

Re: ecash speed
by Bill Stewart 17 Dec '03

17 Dec '03

>"Perry E. Metzger" <perry(a)piermont.com> writes: >>I suspect that as CPU speed exponentiates this will become less and >>less of a problem. It doesn't especially worry me. CPU speed in desktop or notebook computers isn't much problem; CPU speed in smartcards is still an issue, and it may be one or two more rounds of exponentiation before we'll see cards that are both fast enough and really secure. At 09:08 PM 11/8/95 -0800, Hal <hfinney(a)shell.portal.com> wrote: >Consider, though, what happens in the current ecash system if it were >used to charge a penny per page. You would click on a link in your web >browser to go to the new page. It would set the GET request to the >remote server as usual. For penny-a-page on-line services, unless ecash transaction costs are _radically_ cheap, it probably makes more sense for the service to sell its own tokens, bought with (anonymous or non-anonymous) ecash, which you then trade for pages. No calculation required, just an on-line lookup for double-spending and you don't get your page if you double-spend. An alternative to them picking the token numbers is for you to give them the numbers and them to keep them in their database, but that's probably unlikely to be done and doesn't really buy you much privacy. If that's not anonymous enough for you (because your IP address could be traced when you buy the tokens, and coordinated with them later), use a packet laundry, or connect from your dialup access provider, which will tell the newspaper you're port43.server29.netcom.com or something equally uninformative; or dial in from the public library or cafe. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0