December 2003 - cypherpunks-legacy

GE's Transaction Tech
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GE Info Services Launches New Transaction Technology Rockville, Md., 6 February 1996 -- General Electric's GE Information Services division said it is launching a new set of hardware and software products that will protect business transactions over the Internet. One of the features of the new system, called "GE InterBusiness," involves using one-time use encryption codes for each online session. The new offering combines the one-time, or dynamic, encrypted session key, mutual authentication, and advanced firewall technology, officials said. By using standard Internet protocols, a user can conduct electronic data interchange, electronic messaging, and electronic file transfers via a secure "pipeline." Those three elements are key in both electronic commerce and GE Information Services' Business Productivity solutions. Anne Biehl, manager of market development for GE Information Services, said one of the key differentiators between her company's secure business transaction technology and offerings from other companies lies with the dynamic encrypted session key. "This is the first system on the market today, that we know of, that's using (this technology)," she said. "It's a pretty powerful 'ring of security' for our users. It's a nice feature we've integrated into our total solution." With the dynamic session key, the session is encrypted to secure all information passed from sender to receiver. The key itself is never seen on the Internet, and hackers can't break the encryption, officials stressed. The new system uses the standard networking and connectivity of the Internet to interface with systems used by GE's 40,000-plus customer companies, officials said. GE InterBusiness runs on all browsers, resides on any Internet-compatible desktop, and interacts with standard Internet applications. GE InterBusiness is available now, Biehl said. Pricing varies depending on the client's requirements, she said. Biehl said today's announcement has nothing to do with the completed sale of the group's GEnie online service to Queens, New York-based Yovelle Renaissance Corporation, reported last month. For additional information, those with Internet World Wide Web access can surf to GE Information Services' Web site at http://www.geis.com/. --

1 0

ATT Waives Fraud Fee
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

AT&T WorldNet Spurs Online Credit Use Bridgewater, NJ, 6 February 1996 -- In a teleconference today, officials of AT&T's WorldNet and Universal Card services announced a program aimed at allowing users to "feel safe" in making online transactions by waiving the standard $50 deductible fee on the use of credit cards for "fraudulent" purposes. The new program, to begin within eight weeks, will apply to all dial-up customers of both WorldNet and Universal Card Services, as well as to corporate users of WorldNet's LAN (local area network) Service who use their Universal Cards upon registering for WorldNet, said Tom Evslin, VP of AT&T Gateway Services, speaking during the teleconference. Some $200 billion in sales were conducted over AT&T's 800 numbers last year, in comparison to only $500 million in sales over the Internet, Evslin pointed out. "Secure credit card" technology is an important ingredient in spurring more electronic commerce, the VP acknowledged, noting that AT&T is one of the partners in the new SET (Secure Electronic Transactions) alliance unveiled by Mastercard and Visa last week. But based on the results of studies conducted by AT&T among consumers, it is just as important that consumers "feel safe" in doing business online as that they "be safe," Evslin told the reporters and analysts. "What's important to consumers is that AT&T put its money where its mouth is, rather than ask consumers to take the risk," the VP asserted. AT&T will launch the new "deductible fee waiver" in conjunction with the availability of dial-up access to WorldNet, a new Internet "content aggregation" service now in beta, by the end of this quarter, according to Evslin. AT&T rolled out the WorldNet LAN Connectivity Service together with BBN Planet last fall. AT&T plans to be "aggressive" in promoting WorldNet in the US and overseas, though mechanisms that will include cross-marketing programs with AT&T Universal Card Service as well as with third-party partners such as Netscape, Verity, McKinley, and as of last week, Broderbund, he told the press. AT&T Universal Card now has more US card holders than any other credit card, according to Evslin. The AT&T also told reporters that he expects other credit card companies will follow AT&T's lead in suspending the $50 deductible charge in online transactions. --

1 0

GTE's Virtual CA
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GTE's CyberTrust For Web Electronic Commerce Washington, D.C., 6 February 1996 -- GTE officials say that the company's new CyberTrust electronic commerce program will allow companies for the first time to handle most of the CA (Certification Authority) function by themselves, by means of secure Web servers. At the Comnet press conference, reporters were told that GTE, a partner of both Mastercard and Visa, will introduce its new "Virtual CA" capability for Webmasters in conjunction with a trio of related services. The four new services from GTE are aimed at financial institutions, online merchants, and government agencies, as well as at the corporate and consumer markets, said Charles S. Walton, Jr., CyberTrust's program director, speaking at the Comnet press event. One component of CyberTrust, called the Electronic Commerce Service, will provide an "infrastructure" for credit card companies using new secure payment standards for online transactions, Walton added. Another new service, the Partner Forum, will provide online test services and tech support for developers and integrators in the electronic commerce arena. Through GTE's new Cybersign service, GTE will directly handle the maintenance of public key certificates, as well as the issuance, renewal, and revocation of these certificates. But with Virtual CA, GTE will manage certificate management only, permitting Webmasters at subscribing companies to do their own issuance, renewal, and revocation of certificates. Walton acknowledged that GTE's new suite of services will be targeted at the same market now dominated by Verisign. But the GTE services, he maintained, will be differentiated on the basis of general "operational environment," as well as by Virtual CA. In a follow-up interview later, Walton said that GTE, a long-time consultant to Mastercard, began working with both Mastercard and Visa last November on development of SET (Secure Electronic Transactions), a new joint standard for online credit card transactions. GTE, he added, hosted both Mastercard and Visa last week at GTE headquarters in Needham, Massachusetts. Aside from GTE, Mastercard and Visa, other partners in the SET effort include Verisign, IBM, Microsoft, Netscape, SAIC, and Terisa Systems. GTE had previously helped Mastercard to create the SEPP standard, according to Walton. GTE's new CyberTrust, first announced as supporting SEPP, will now support its "successor," SET, he noted. CyberTrust will also comply with the SSL protocol for Web security. During the press event at Comnet, Walton reported that Cybersign and Virtual CA will implement a "dual card, split RSA key design," with "strong access controls." The two systems will use PCMCIA cryptographic hardware token technology and X.509-certificate-compatible software. Virtual CA, he continued, will initially be available on Sun Solaris-based secure Web servers, but will be ported to Windows NT-based secure Web servers by the end of 1996. End users will be able to access Virtual CA through Netscape browsers. The Web server-based service will introduce "verification at the server level, which is really where you want it to be," asserted the GTE official. On-site Webmasters are in a particularly good position to confirm that users "are who they say they are," the journalists were told. As a result, Virtual CA will use a technique called "pre- verification," in which the Webmaster, or RA (Registration Authority), will validate and approve users' certificate requests before the requests go to CyberTrust. CyberTrust will then return a certificate for the end user, in the form of an algorithm, either direct to the end user or through the RA. Companies subscribing to Virtual CA will receive custom home pages for certificate data entry, and for issuing, renewing, and revoking certificates, Walton said. The CyberTrust program director said that the special PCMCIA hardware will be used at the "CA level" only, and will not be required by either end users or Webmasters. No "actual cards" will be issued to, or needed by either group, he added. GTE plans to begin offering both Virtual CA and Cybersign in the second quarter. --

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I wrong?
by lunaslide＠loop.com 17 Dec '03

17 Dec '03

>>>1. Governments will no longer be "necessary," if they ever were. >>2. Protection will no longer depend on having a "government." >>>3. Anonymous networking technology will protect our rights, to the extent >>>they can be protected. >>>4. Your statement, "...anarchy is a massive step backward..." is absolutely >>>incorrect. > >>That's fine that you believe the things, but for acceptance by others you >>will have to provide support for your position. I, personally, would like >>to see your premises so that I may evualuate your claims. You may indeed >>be correct in your assessment. > >Well, here's my "Assassination Politics" essay. > You all should have a copy of this, so I won't waste bandwidth posting it again. If you didn't read it, I encourage you do to so, no matter what your initial reaction is. It is a facinating proposal and it brings to mind a multitude of questions about privacy, anonymity, ethics and the nature of human beings in general. Now, in respose to Mr. Bell. As I stated above, I found your proposal absolutely facinating, to say the least. As with many others, I'm sure, it struck an initial chord in me that tempted me to disregard it out of hand. However, I was determined to read it through thoroughly and without bias. I have done so and I have the following thoughts about it. The plan it self is feasable, and with more thought, all the wrinkles could be ironed out. I am impressed with the detail of it. I would be curious to see what an open minded laywer would say about it's legality under close scrutiny. However, I must point out, and I'm sure you realize this, that it would not be adopted by the public at large for some time to come, or more likely never. There are too many people who believe that it is wrong to take a life for any reason and that no action justifies death. I count myself among these people. The barganing power of death is indeed great, but some would still realize that a vote would make them responsible, at least in part, for a murder. There is an ethical stumbling block here that may never be overcome. Further, I don't believe you have enough support for your claim that other targets would not be sought. It is one thing to say that enough people won't vote for someone picked out of the phone book, but what if the predicted individual is a doctor who performs abortions, or an activist for gay rights (or *against* gay rights), or Bill Gates ;-). There are also the individuals who are trying to bring about change in society that is unpopular, but is still in the interest of humanity. Abraham Lincoln surely would have been killed by this system, for example. Also, big corporations would be able to cut down their political enemies such as envornment activists, fair business practice activists and competetors' high ranking officers. Even if only one person in charge of such a business were to put out a digital contract, he would have no problem suppling the money for the hit. People who have tried to make changes for humanity that went against the social norm at the time are revered today for their efforts. In this system, they would likely be assasinated. Nothing would ever change because people are always afraid of change and afraid of things they do not understand and the people who fight that ignorance will likely be killed. Your statement that Organization B, the one that collects for any target, is not well supported. They would still be doing *plenty* of business, in spite of the higher prices. Organization B would thrive, make no mistake. And the people who would be getting in on all the action are the rich. All the politicians who oppose their interests would be hit immediately. Anyone trying to change the status quo would be eliminated. Why do you think we are still using combustion engines in the last decade of the 20th century? We could have had better alternatives 20 years ago, but the oil companies would loose out so they have either bought out these ideas or had killed the inventors and bought their patents and are sitting on them. A capitalist economy does not always breed competition that brings out the best and most desireable products because some advancements are bad for all the businesses involved in that market. Big business and the rich would benifit the most from the Assination Politics model. But what if OrgB stops taking donations for "predictions" for "Non-Initiation Of Force Principle" (NIOFP) offenders? Some other organization will crop up to take their place AND the people operating OrgB could be hit for their "ethical" action. There is simply too much opportunity offered by OrgB type organizations for people to pass up. They will not let the higher prices stop them. If the answer to that problem is to regulate the lists of "victims", then the next question is who are these people who are regulating and what guidelines are they following? Who decides who gets to be the moderators? Could there be exceptions to the (NIOFP)-offender standard? Who would they be and why? Could the organizations be anonymous as well? How would the money be transmitted to them in that case? How can we trust or redress grivances with an organization? There are still many concerns regarding the organizations. If the organizations fail, the whole system fails. That's all I can think of at the moment. Like I said before, once one can get past the bias, it is an endlessly intriguing proposal bristling with questions and issues concerning our very beings. This is precisely why I would like to know if I may take a copy of your proposal to my ethics class. I think this is a great topic for discussion and I would like your approval. Respectfully, Jeff Conn lunaslide On the meridian of time there is no injustice, only the poetry of motion creating the illusion of truth and drama. Henry Miller -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQBvAzD3EHEAAAEDAMVwZzXozPjX18mCenA5fJsdWZXcrhJCxPR+SoVCmR7d4ZVU mwITzPTHo/GyLvJrWyk5YdhheczyY2VSawaMrCN/nWA7K9lwAylbKyPxqBhRYJ3C 2wi2uD5LY2wypNOQyQARAQABtB5KZWZmIENvbm4gPGx1bmFzbGlkZUBsb29wLmNv bT6JAHUDBRAw+1bqS2NsMqTTkMkBAQkTAwCersFbCyk8O0MbGlNcZDAe24CLEWQ0 0C5EHni33W76UsG1bybcLsuMH6HVwLF7IqZivnzc7wkujYPQvCqn8HEYYTld8V9V Cou4dOvA8kV7rHvAn/LuLx7DRruLFrRoPSk= =OIT9 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Need a "warning" graphic of some kind for CDA
by Greg Broiles 17 Dec '03

17 Dec '03

At 01:48 PM 2/4/96 EST, you wrote: >"David K. Merriman" <merriman(a)arn.net> writes: >> >Now that we all have web pages that are naughty and might be seen by >> >little children, I'd like to hve some kind of a graphic that can >> >universally be seen as a "Warning: The following material is unsuitable >> >for children and close-minded twits". (or words to that effect). >> >> Hmmmmm. Maybe a doll with an international 'no' sign superimposed? > >Either the 'no' sign (red crossed circle) or a wide red cross over one of: > rattle > baby bottle / pacifier > disposable diapers (with contents visible) > safety pin? How about the circle-slash "no" symbol superimposed on the Constitution? -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

2 1

Re: has this been on cypherpunks? (fwd)
by zinc 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- cpunks, i particularily like this quote: "Role Of Encryption For added protection, users of Anonymous Re-mailers tend to encrypt their messages just in case one of the remailing links are compromised. PGP (Pretty Good Privacy) encryption is favored because it is freely available and easy to use. A typical digital signature would look like this: [...]" hell, i'd like to see these guys hang out on alt.security.pgp answering questions all day... pjf, 'easy to use' my ass "Those that give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety." -- Benjamin Franklin (1773) finger for PGP key zifi runs LINUX 1.3.57 -=-=-=WEB=-=-=-> http://zifi.genetics.utah.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by mkpgp1.6, a Pine/PGP interface. iQCVAwUBMRha1E3Qo/lG0AH5AQESIwP9HUKUmvlVqOteom2xWLKW7az4V1lH4lex e3MJMK1e5a6C2JRbs6JeoEj2o3hUIKwcF8DF0HmnAeETfXyM2qtY6PdkLQlWy+Qh 9w3BDi+m6cxy7TmADcLyBtg0bc6imdJGHyeTtcsT7XUyrKlf/O+o6QX9ip4FOqZz 5/OZ8j8KwK0= =6K1U -----END PGP SIGNATURE-----

1 0

Re: paper on remailers in the intelligence community
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

At 12:37 AM 2/7/96, Timothy C. May wrote: >But more seriously, any mil-info complex effort to demonize remailers must >of course invoke one of the Horsemen. At this time, "Russian Mafia >terrorists" is the putative focus of joint U.S.-Russian intelligence >activities, and was even the plot of the latest James Bond movie. Yup. <sigh> In essence, remailers and other anonymizing/pseudonymizing techniques democratize "deniability"--the MO of circumventing the law that states have arrogated to themelves. Institutional dynamics aside, the proverb that "A man reveals his character best when describing that of another" applies to governments, too, I think: we can expect governmental and paragovernmental anti-anonymity arguments to focus on the most extreme ways in which governments have used their power to modulate identity--i.e., law-breaking. I don't want to start up a Cypherpunk[TM]-approved PR debate, but I do think we (quote unquote) might do well to think a bit about some arguments that can sidestep the arguments we can reasonably anticipate. Plenty of folks have very recognizable nyms, so... nym as PO box, nym as a way of tracking who's tracking you (like misspelling your name this or that way when you know the organization you're giving it to will sell it), nym as backup (for when your mailserver's down [yeah, I know...]). Anonymity, after all, is only one of many possible uses for a remailer. No one could possibly require that your email address bear your first and last names in recognizable form--so what's so different about a nym? In terms of the fundamental issues, these are sidelights, obviously, but they could come in handy. US culture has a deep-seated mistrust of unstable identities (viz., the "con man") going back a century or more; fighting on behalf of unstable and multiple identities will be an upstream swim. But we might do pretty well arguing that remailers are more similar to than different from net.staples--nutty email addresesses, multiple addresses, etc. Sometimes the best way to win an argument is to refuse to have it. Ted

1 0

Re: has this been on cypherpunks? (fwd)
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

I just sent this to the remailer operators' list, but it may be of interest here too. I think Tim or Lucky or someone suggested something like GAI (Government Access to Identities) here a while back.... Forwarded message: > Lance writes: > > Is it just me, or does this guy make a convincing case for the need for > > remailers without ever showing one shred of evidence to back up his fear > > mongering? > > Exactly. Ted Byfield mentioned on cpunks that it reads like a free > association session. I find the piece quite schizophrenic. (IANA > psychologist :) They alternate between fairly eloquent arguments for the > roots of remailers in fundamental principles of freedom and privacy, and > the bizarre "anonymity as a disease" analogy. > > I hypothesize that the Strassmann & Marlow paper is meant to lay the > groundwork for some sort of eventual Government Access to Identities proposal > (which would more likely be termed "identity escrow" by the Feds). It's > about the only way I can reconcile statements like the following > (juxtaposed by me, not them): > > "...it becomes politically unacceptable to suppress remailers > as potential sources of criminal acts. Such absolute > prohibitions would never pass through a legislative process...." > > "As in the case of [various diseases] it will take disasters > before the public may accept that some forms of restrictions > on the electronic freedom of speech and privacy may be > worthwhile." > > "We trust that this will be seen as a useful contribution to an > already raging debate of how to find a balance between the > desirable and the dangerous." > > I suspect the key phrases there are "absolute prohibitions", "some forms of > restrictions", and "find a balance". > > I'm still surprised that the paper takes such a conciliatory stance towards > anonymity and pseudonymity. Strong crypto and GAK-free crypto have big > corporate constituencies, but I see strong and GAI-free anonymity/pseudonymity > as much more vulnerable. I'm tempted to declare this a guarded preliminary > success of the cpunks remailer community -- we are seen as a viable player > in "the game", potentially capable of forcing at least a compromise on > nymity issues. > > -Lewis >

1 0

Re: How to prevent a virus infection :-)
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Lucky Green wrote: > > Just watched an "expert" on Bay TV (SF Cable). He stressed that websites > without firewalls pose the risk of spreading viruses when downloading files > from them. A GIF was being downloaded in the background... (chuckling) I remember when one of the Michaelangelo scares was going on (hey, is it that time of year again?) the place where I was working got a telemarketing call selling anti-virus software. String that one up with conspiracy theories... - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRimFioZzwIn1bdtAQHyIAF/YKlGvU0JeP9V4+VoDHksXn0SCd6wE86x 1HptGTwiHjH1I/BhjRLyY9xiCFqNLwSf =Kqj2 -----END PGP SIGNATURE-----

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I wrong?
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:43 AM 2/7/96 -0800, lunaslide(a)loop.com wrote: > Now, in respose to Mr. Bell. As I stated above, I found your proposal > [assasination politics] absolutely facinating, to say the least. > [...] > However, I must point out, and I'm sure you realize this, that it would not > be adopted by the public at large for some time to come, or more likely > never. There are too many people who believe that it is wrong to take a > life for any reason and that no action justifies death. This, of course, explains why war is impossible these days and why the public is outraged whenever the government executes a murderer. :-) --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

A Warning Re: Hardware RNG support for PGP 2.63
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- rngaugp(a)alpha.c2.org wrote: > Here is the README file that comes with the modifications. > - ------------------------------------------ > Hardware Random Number Support for PGP. > PGP 263 international version > > Ever get tired of typing in keyboard timing strokes while generating a > PGP key? Ever want to use PGP unattended, but be foiled because there is > no one there to type the keyboard timing strokes? > > Ever wonder if PGP's method of generating random number might have some > subtle flaw which would expose it to cryptanalysis?[..] Ever wonder that a random number device driver or hardware will have a subtle flaw??? Relying on the /dev/random NOISE.SYS driver now while it's still in beta isn't nec. a good idea. For experimentation, sure. I'm also rather concerned as to how this version of PGP handles it. Very much so. The current and latter versions of NOISE.SYS parallels the Linux random.c driver in that there are two devices, /dev/random and /dev/urandom... the older versions (pre version 0.4) will return as many bytes as are requested (from /dev/random) whereas the current version returns only as many bytes as are conservatively estimated to be "truly random". If you are using the older NOISE.SYS /dev/random or the newer version's /dev/urandom for key generation then essentially you're using a pseudo-RNG based on SHA rather than real random data. The implementation should try to get as many bits as are needed from the driver and then request some keystrokes, collect more data, etc. until you have enough bits (advantage over older PGP method? You only need to sample from driver, and not worry about processing raw samples yourself; driver also samples from other sources than keystrokes as well...) I'd be wary of relying on NOISE.SYS or any similar driver for PGP-key generation until the driver gets more thorough examination; I'd also be VERY wary of an improper use of the driver. - --Rob (who wrote NOISE.SYS). - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRjSNSoZzwIn1bdtAQEn+wF/ZxQKqOCRyKrJjmdtYtE2kVG6v+3NkOOb 84JMpWkpzkMVe8L7LHr7bLdgzkVxDB+8 =m54+ -----END PGP SIGNATURE-----

1 0

Re: [noise] the individual and the tribe
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

>Rob said: >> ... in the sense that >>tribal societies are individualist. Jean-Francois Avon (JFA Technologies, QC, Canada) wrote: >I absolutely don't agree. The subordination of the individual to the tribe >is fundamental of their vision of the world. Some tribal societies are individualist, some are not: Most of the myths and legends of the Australian Aboriginals have a lone ranger character as the hero or villain, or at least most of the ones that I have read feature a person whose life is dramatic or heroic in part because he is tribeless, perhaps for the same reason as most heroes in Disney cartoons are orphans. Individualism is not about the >personnal opinions, it is about the vision of Man as an entity in itself, not >a type of cattle that owe his service to the collectivity of the tribe. > >Crypto makes the tribe (and it's sorcerers) loose their grip... :) > >JFA > > > --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Strong Crypto Weak
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>The seven experts who wrote the new paper -- "Minimal Key >Lengths for Symmetric Ciphers to Provide Adequate >Commercial Security" -- say the achievement by the >students at the Ecole Polytechnique was trivial. For this they needed "designated heros" ? Have been saying the same thing for two years. Warmly, Padgett

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Peter Conrad 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi, Duncan Frissell wrote: >At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: > >>If the Privacy Act were rewritten to be as strict as the BDSG, businesses >>would have a (mandatory) legal requirement to: >> [...] >Unfortunately, it would also: > >* Require government registration of computers and databases containing >information about people (whether these computers are used by business or >individuals). This eases regulation of computers and future confiscation. This is not true. Individuals are not required to register anything, the BDSG simply does not apply do them (see. Par. 1 Section (2) ). Businesses are required to register (besides their address and the kind of business they do) a person who is responsible for any personal information they want to keep and a general description of the kind of data they intend to keep (see Par. 32 Sect. (2) ). Computers are hardly mentioned anywhere in the BDSG, in fact, most of it applies to any method of processing personal information. It doesn't matter if a business keeps data printed on paper or stored in a computer. >* Reduce market efficiency by making it harder to match buyers and sellers >(because neither could easily find out about he other) thus causing higher >prices and poorer people. Oh well. In the past buyers and sellers have always found each other without keeping large databases. Most buyers are quite capable of finding appropriate sellers (that's what advertisement and commercials are good for). The goal of the BDSG is to give the individual control of information kept about him. An example: The Deutsche Bundesbahn issues so-called 'BahnCards'. If you buy a BahnCard you can use the Bundesbahn-trains for half the normal price. Until a couple of months ago, the Bundesbahn gave all the information they got from their BahnCard customers to the Citybank AG. The Citybank AG sent their junkmail to all Bahncard customers and tried to make them get a credit-card. This was in violation of the BDSG. And I still know where to get a credit-card if I want one. >* Do nothing to protect personal information from the government which >would get to collect more of it than ever in the course of enforcing data >protection laws. Oh yes it does. The same rules (or even stricter ones) that apply to businesses apply to all government organizations. If any government organization (even the police) violates the BDSG you have the right to file a lawsuit against the organization (or the individual who violated your rights). >If you don't want people to know things about you, don't tell them. You sometimes have no choice. Those of you capable of understanding german might take a look at http://www.fh-ulm.de/bvd/gesetz.html Bye, Peter NB: I subscribe to this list through a digest only. Please CC: me on followups. - -- Peter Conrad | "They say time is the fire in which we burn." Am Heckenberg 1 | Dr. Soran, Star Trek - "Generations" 56727 Mayen Germany Email: p_conrad@informatik.uni-kl.de,conrad@unix-ag.uni-kl.de -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAgUBMRiPe7FFskV8RCVHAQEMwQP7B6/QSo0E8bAiPcusg9+Etzx+WdIi6nuP WVvnJ7RWrwoScnPkRJs7uaBfCpedFu3TZX7RyOm6bVAX4mwFe/dtqhBxcy8U3lQg fqa3WUAhyBNPcr6tF38sVocKs6hWRiw+KckzvnCx9grJpqVHz6kvimAcVOIg027O Zzk8jyopYDw= =PBa7 -----END PGP SIGNATURE-----

1 0

Re: CypherPunks as Teachers; source material [Re: Hey,we are quaint! , (Was: A Sign of the Future)]
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"attila(a)primenet.com" "attila" 6-FEB-1996 02:05:25.34 > Jefferson certainly would role over at the degeneration of "his" party which began in the 30s as liberal news, particularly radio, demagougues discovered they could fan the riff-raff and control the direction of government. --------------- An interesting example of Jefferson's thoughts on the subject of the "Natural Aristocracy" can be found at http://ils.unc.edu/~vreer/aristoi.txt -Allen

1 0

Re: Telecoms Bill
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Deranged Mutant <wlkngowl(a)unix.asb.com> >Encrypted/truly anonymous ftp would be nice (though some folx would understandably have problems with truly anonymous uploads, and crypto export restrictions in the US could be problematic legally). I think there is already work on encrypted telnet (stel) by the CERT/IT people. ---------------- If a completely encrypted http method (ssl) is indeed available, a (clunky) solution to both of the above would be a web proxy on an encrypted server that would act like a ftp or telnet proxy. I'm not sure about the limits of the html language for doing this (updates, et al)- it may have to be graphics to the user and form input back, which would take a while. -Allen

1 0

Re: Assassination Politics--isn't it gambling?
by banelaw＠med.com 17 Dec '03

17 Dec '03

Jim: as to "Assassination Politics." Isn't the structure you describe gambling? Placing money on a prediction, with the correct predictor winning? And if so, isn't it illegal if done over the wires, i.e., federal commerce? I'm not looking for a way to declare your scheme illegal, I'm just pointing out that there are other angles, especially if done over the wires. I guess you could move the structure off shore--pity the poor country hosting such an entity! If you were at all succesfull, the server accepting digital cash would be moving from place to place--remember pirate radio? Philip BaneLaw Suite 210W 1800 112th Ave NE Bellevue, WA 98004 206.455.5537 Fax:206.812.2032

1 0

RE: Why am I wrong?
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

(Was referring to the govs ability to control communications *with them*) >Perhaps I do not understand your point. They can perhaps >control the communication between them and me, but not between me and >everyone else. Ok please view my three points fromn the standpoint that so much of the total traffic would be affected by at least one, that "uncontrolled" communications would be minimal. >>2) communications using someone else's equipment/network (university, >> employer, etc) >Employers nor universities have any jurisdiction over whether you use >encryption in your transmissions while using their networks unless it >specifically does not allow it when you first agree to have an account with >them. I think you had better review the concept of "property rights". Unless you have a contract that says you can, or can establish "expectation", the property owner who allows you to use their equipment may control how it is used. >>3) communications with anyone (Internet merchant, etc) who says "this >> is not what <MasterCard|Visa|AmEx> approves..." >I don't quite understand your meaning. I am a merchant and I encourage my >customers to use PGP when they send information over the internet, whether >to me or to anyone else. That is fine but what if MasterCard refuses to accept this method ? (Not saying they will, just "what if" ? You are free to use digicash if you want but is not "legal tender for all debts public and private". >Comments? Bring 'em on! :-) I dood it. Warmly, Padgett

1 0

Internet Passports, Identity Escrow, and Back Doors
by tcmay＠got.net 17 Dec '03

17 Dec '03

lmccarth(a)cs.umass.edu risks violating the terms of his PC probation by writing: >I just sent this to the remailer operators' list, but it may be of interest >here too. I think Tim or Lucky or someone suggested something like GAI >(Government Access to Identities) here a while back.... > >Forwarded message: >> Lance writes: >> I hypothesize that the Strassmann & Marlow paper is meant to lay the >> groundwork for some sort of eventual Government Access to Identities proposal >> (which would more likely be termed "identity escrow" by the Feds). It's >> about the only way I can reconcile statements like the following >> (juxtaposed by me, not them): Indeed, several of us have written extensively about the rationales for "is-a-person" credentialling by government, what I have quipped is a kind of "identity escrow" (further abusing the term "escrow"). I lack the time to write a concise summary, so will instead mention a bunch of points. Searching the archives for mentioned terms may yield more comprehensive articles. * "Internet Driver's License." This is not just a joke, although the reported systems are not called this. But the idea is the same. A credential, probably a signed key certificate, that is granted after proof of age is presented. (For example, one might show a passport or conventional Driver's License at a Post Office and they'd issue a signed key....something they'd like to get into the business of doing, from various reports.) * An age credential such as this is essentially going to be necessary, in the worst case, for accessing the Net and Web. If the CDA is upheld--which may take several years to decide for sure--then sites will probably have to take positive steps to verify that users are not minors. Unless they carry only G-rated Barney material (but no Barney jokes, as children might be traumatized). * This age credential obviously cannot be just the "I swear that I am old enough to view adult images" sort of click button. (Although it mostly works with ordering adult material through the mail to immunize a provider, except in this case there is the additional "check" of mail delivery, where a postal carrier may may informal inquiries about the age of the recipient. Plus the parents can intercept the subscription to "Hustler" that 14-year-old Johhny ordered.) * The various schemes for signature authorities, which I admit to not following very closely, all the stuff about Verisign and whether Netscape will or will not accept signatures of rogue signers....all this suggests a worrisome situation in which all messages must be signed by the True Name (see above) of the message originator. (For a good fictional treatment of this, see John Brunner's "The Shockwave Rider.") * Remailers and Web proxies obviously represent an end-run around the CDA and key escrow, in various ways, so I think it likely that these will come under attack. The legal means of attacking them may be one or more of the following: - holding the remailer site operator legally responsible for what can be traced back to his system, especially if in plaintext. (This would make the last site in a chain of otherwise-encrypted messages especially vulnerable if the message is delivered in plaintext to the recipient. Of course, with wider use of crypto, the message can be delivered in encrypted form. I see more and more remailers insisting on encrypted (high entropy) messages.) - for sites that charge any kind of fee for remailing, extensions of the business laws to require that logs be maintained ("so that customers can dispute bills"!!). These logs could then be subpoenaed to aid in tracing messages back to origins. (Sure, it gets hard when hops outside the country are involved...I'm not saying this'll be easy or effective, just a possible avenue of attack on remailers.) - finally, outlawing of remailers and proxies. Or extensive registration of them. (We've had this debate a couple of times, about whether mail-forwarding services really have to register, get proof of ID, send records along to the government, etc.) * Identity Escrow obviously fits in closely with key escrow in general. In closing, I think the next couple of years will see increasing pressure to require some kind of "Internet Driver's License," at least within the U.S. Other countries will jump at this (Germany, China, France, the usual suspects). Call it an "Internet Passport." For some interesting insights into the thinking of some in the crypto community, go back to around 1986-8 in the "Crypto" Conference Proceedings and you'll find some papers, by Fiat and Shamir I believe, on the "problem" of "rogue governments" (they cited Libya for their example) issuing "false passports." (I have commented in the past that the U.S. government has a reported 50,000 or more people in the Witness Security (aka Protection) Program, under the U.S. Marshal's Service, and reserves the right to create completely fake "legends" (dossiers) for these people, including false credit records, false education records, and false employment records. Not to mention their various secret agents. Clearly the government would want "back doors" into any Internet Passport system!) --Tim May Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

strong cryptography for Java
by Jyri Kaljundi 17 Dec '03

17 Dec '03

I found today a Java package, implementing some cryptography (MD5, DES, RSA and Diffie-Hellman). Seems quite interesting. It is called JCrypt alpha release 0.1. The information is on: http://www.cs.utexas.edu/users/achou/JCrypt/packages.html Sorry if this has been on this list already. Jüri Kaljundi jk(a)digit.ee Digiturg http://www.digit.ee/

1 0

POTP gets good press
by Bryce 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Sun Observer -- "An Independent Journal Devoted to the Sun and Compatible Markets" -- ran an article in the Feb 96 issue entitled "New technology eliminates need for keys to encrypt e-mail messages". Byline: Bob Harvey. About the author: "Bob Harvey is vice president of the Internet Security Corp., a Lexington, Mass.-based network security solutions provider." Content: includes diagrams entitled "Link Level Encryption" in which sender transmits keys to receiver, and "Packet Level Encryption" in which sender transmits key sto certificate authority which transmits them to multiple receivers, and "Synchronized Random Key Generation (SRKG)" a la "Power One Time Pad" in which no keys are transmitted and multiple recievers magically decipher messages via built-in encryption devices. Am I right in thinking this is utter unmitigated bullsh snake oil? Does anybody have any other dirt on this Bob Harvey guy and his Internet Security Corp? What is his relationship with the POTP folks? An Alta Vista search revealed several Bob Harveys, but none who matched with "Internet Security". I'm Cc'ing this to the editor in chief of The Sun Observer. If he doesn't know about the cypherpunks he might want to request some explanation... Regards, Bryce "Toys, Tools and Technologies" the Niche New Signal Consulting -- C++, Java, HTML, Ecash Bryce PGP sig follows -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Auto-signed under Unix with 'BAP' Easy-PGP v1.01 iQCVAwUBMRkD8/WZSllhfG25AQESBgP8CmmKb0+VMqs14FNQ2YoAllXcaqAtc09Y 99KljeM0gHpm19x14Tj011bngS59EyUCDvoFaY6HtOmOPNqR2SpQxoHp9IBWNJmS dGEGwuqCLEB2gxMwgtjrwCNWyJmXk6Wp8UTRPcoG/woXWBCkyllbc62dV/RbILva OeKJR5FpQ9Y= =YT6V -----END PGP SIGNATURE-----

5 6

Re: Windows PGP mail reader
by Ted Garrett 17 Dec '03

17 Dec '03

At 09:56 PM 2/3/96 GMT, you wrote: >In article <4eaksb$6i9(a)recepsen.aa.msen.com>, jims(a)conch.aa.msen.com says... >>Hi. Can anyone recommend a Windows based email/POP3 reader that can decrypt >>content? Please reply via email: > >Have a look at Pegasus Mail. It handles PGP very nicely with a recent >addition. by John Navas, both are free: >http://users.aimnet.com/~jnavas/winpmail.htm > I recently picked up "PGP Windows Shell". I have found it to be an excellent utility for encrypting and decrypting messages as easily as cutting to and pasting from the clipboard. All operations are automated, you can use whatever mailer you want, and it's freeware. The URL is http://iquest.com/~aegisrc/utils2.shtml Also, if you want something to automate usage of the cypherpunk style remailers, check out Joel McNamara's Private Idaho. It's an excellent tool, also freeware, and is available at URL http://www.eskimo.com/~joelm/pi.html Another utility you might like to look at (of course it's freeware too) is PGP WinFront. While it's a little more cumbersome than PGP Windows Shell, it has all the same functionality. There is also a shareware utility available from the same URL, called PGP QuickFront. The combination of QuickFront and WinFront make using PGP under windows almost pleasant. It can be found at http://netaccess.on.ca/ugali/crypt/ .

1 0

How to prevent a virus infection :-)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Just watched an "expert" on Bay TV (SF Cable). He stressed that websites without firewalls pose the risk of spreading viruses when downloading files from them. A GIF was being downloaded in the background... LOL. I only wonder who the fuck is hiring such idiots. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Reasons in support of crypto-anarchy WAS Re: Why am I (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"ravage(a)ssz.com" "Jim Choate" 6-FEB-1996 21:15:10.47 >If the intent is to motivate others to kill or otherwise harm others simply because you don't agree with them or their actions is reprehensible and moraly or ethicaly undefensible. ------------------- So you don't believe in self-defense, or the defense of another? While I'm not as sure as Jim whether such a system would just be used by the good guys, if someone has taken action to seriously violate the rights of another I can see the death penalty as being appropriate. -Allen

1 0

Re: Need a "warning" graphic of some kind for CDA
by Gordon Campbell 17 Dec '03

17 Dec '03

At 01:48 PM 04/02/96 EST, Dr. Dimitri Vulis wrote: > >Either the 'no' sign (red crossed circle) or a wide red cross over one of: > rattle > baby bottle / pacifier > disposable diapers (with contents visible) > safety pin? I've file-attached a first attempt at something like this to Robert Hayden (the original poster.) It's the international 'no' sign superimposed over a drooling baby. If he likes it and is able to post it somewhere, he's free to do so. I'd post it myself, but I have no web access (not yet, anyway). ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

1 0