December 2003 - cypherpunks-legacy

Re: proxy servers in Singapore
by Scott Schryvers 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 11:10 PM 8/16/96 -0400, you wrote: >Did anyone else catch the AP wire story >(it ran here in the SF Chronicle on Thursday) >about the Singapore government cracking >down on "undesirable" (e.g., sex smut, anti-govt. >postings etc.) content on web sites, usenet etc. >Their basically forcing, by law, Singapore ISPs to use >proxy servers that contain the information >that the govt. deems fit. > >Scary if you ask me. But then they have a govt. >that acts like it's the management of Disneyland. > >"Have a nice ride!" >-B >===================================================== >Brendon Macaraeg >http://www.itp.tsoa.nyu.edu/~brendonm >Finger macaragb(a)acf2.nyu.edu for my PGP Public Key > > "Disneyland with the death penalty" To quote William Gibson. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMhXI9P+hzPlzwZAdAQFgNAgA0qjtwaCv+O8+Ye0OtCmxAzW0LBsXfRtK 1nZmbUqh5NIDHSviQrDDGEX1/Oajai1cpiCZtt3MbhlWUXWgzcbxOX2ZZDUA/4xc 4/TCBeRZ5lRfSnUeV0NhmLnrX4hgVuwMS+x0Z5LnkK0hg39GByMoiqM7MFJHKBQ3 PXTqSnGnNv+dDG1ZcClZff2JIAiNLHcxx8MOk60E9kLAPVYv2XAkID3FmuuHRS2G 6zPDe6Jlgs2tmCP8u5fQEnfaGYqQiUvfg8bqJt2x5BeMGJfY7Nbj0SureFZ7lQs6 /soG82FQkdUykewoOk+lnTJ3S3UY6am3GNwCFzPuMhfpuMizBzEF8g== =RFbe -----END PGP SIGNATURE----- PGP encrypted mail preferred. E-Mail me for my key. Scott J. Schryvers <schryver(a)radiks.net>

2 1

Re: Unix passwd-cracker online?
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

I've given this some thought before, and there are some optimizations required... First of all, assuming you have one plaintext password for every crypt()'d combo and salt (I think there are actually a bunch of possible plaintexts for each encryption, but I'll assume that we'll save the one that looks most like an english somethingorother as any of them should work.) If you just sort them, you only need to store the 8 char plaintext, which helps with the storage, and halves it approximatly (a little more, actually.) Now...Still too much sotrage for one system, but if we had a network of machines around the Internet, with multi-gig tape changers (i've seen 40GB changer things a discount places for $1000) I figure DNS could server as a way of reaching the system that has the range you want..say we have maxhines named xJG*a.crackcrypt.com, with a leading letter on each hostname, followed by enough characters to represent how much of a range that system holds. I don't have a back of the envelop handy, and it's too early in the morning...so I'll do the calc later. But, for a small fee, anything can be arranged :) Ryan The real problem becomes regeneration when someone's tape goes corrupt.... ---------- Previous Message ---------- To: al177820 cc: cypherpunks From: wmono @ Direct.CA (William Ono) @ smtp Date: 08/17/96 01:27:53 AM Subject: Re: Unix passwd-cracker online? On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > person has obtained a specific password by entering the desired > adresses'passord on a submnit form in a Web page. [deletia] > never have it if there really is such, but this came to my mind when i read > the posts on the plate-numbers-in-Oregon polemica. I would appreciate Somehow I have a hard time believing this to be true. I run crack, a password searching program that uses a dictionary as its base, on my /etc/passwd regularly to locate any users with easily guessed entries. With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I can run through about 9700 passwords per second on this P6-150. Now, this is a back-of-the-envelope calculation: Assuming that the password can be one to eight characters of the following: abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890!@#$%^&*() we find that we have a set of 72 characters. That gives us 72^8 + 72^7 + 72^6 + 72^5 + 72^4 + 72^3 + 72^2 + 72^1 or 732376025552520 possible combinations. At 9700 encryptions per second, it would take my system 2401 years to brute force -one- password to completion. That means that, most likely, if this 'locate password on demand' system existed, it would not work in real time, or in any time during any person's life. Moore's Law might shorten this timeframe considerably, but still not to any reasonable time frame. Continuing with my back-of-the-envelope estimate, we have the length of a crypt()'d password as being 13 characters. The password in plaintext has to follow, with a length of 8 characters. At a size of 732376025552520 * 21 characters, we would have a database of 15379896536602920 bytes, or 22565249 650mb CD-ROMs. That's for the passwords of one salt, without any formatting. Even if we could achieve a 95% compression rate on this data (it is text, after all) we would end up with 237528 CD-ROMs. Most likely my set of characters will be found to be incorrect, but anything that includes even a-z, A-Z, and 0-9 in one to eight character combinations most likely will not be a favourable crack target. Sorry, I don't think this is feasable, or possible. (Please do correct my calculations if errors are detected, especially if the corrected numbers make this possible.. it's getting late at night, and my mind is fogging up, so these calculations/estimates/wild guesses may be off more than usual. It does sound like an interesting project to undertake, if it were possible, but not on my equipment!) -- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! William Ono <wmono(a)direct.ca> PGP Key: F3F716BD fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint PGP-encrypted mail welcome! "640k ought to be enough for everybody."

1 0

Re: Unix passwd-cracker online?
by ScottMorris 17 Dec '03

17 Dec '03

At 01:27 AM 8/17/96 -0700, you wrote: >On Fri, 16 Aug 1996, Carlos L. Mariscal may have written: > >> person has obtained a specific password by entering the desired >> adresses'passord on a submnit form in a Web page. >[deletia] >> never have it if there really is such, but this came to my mind when i read >> the posts on the plate-numbers-in-Oregon polemica. I would appreciate > >Somehow I have a hard time believing this to be true. I run crack, a >password searching program that uses a dictionary as its base, on my >/etc/passwd regularly to locate any users with easily guessed entries. >With ultra fast crypt (UFC), the fastest crypt() replacement I can find, I >can run through about 9700 passwords per second on this P6-150. >[snip] You of course are assuming they are using a Unix box. I commonly offload the etc/passwd file to my pc (p-100) and run Crackerjack against the file. With a single username a 5 meg wordlist will run in about 30 seconds (mileage will vary). The concept is certainly interesting and is another case for good passwords. Of course you need to get the password file first which is another story for another group. >Sorry, I don't think this is feasable, or possible. While I believe this is possible feasable is another story. >(Please do correct my calculations if errors are detected, especially if >the corrected numbers make this possible.. it's getting late at night, and >my mind is fogging up, so these calculations/estimates/wild guesses may be >off more than usual. It does sound like an interesting project to >undertake, if it were possible, but not on my equipment!) > > >-- ** NOTE NEW KEY ** As of 08/28/95! Old key 0x2902B621 COMPROMISED! >William Ono <wmono(a)direct.ca> PGP Key: F3F716BD > fingerprint = A8 0D B9 0F 40 A7 D6 64 B3 00 04 74 FD A7 12 C9 = fingerprint >PGP-encrypted mail welcome! "640k ought to be enough ----- Scott L. Morris Systems Security Consultant smorri59(a)icubed.net Data Forensics Finger smorri59(a)ally.ios.com for my pgp public key.

2 1

No Subject
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 09:08 PM 8/16/96 +0800, rednax wrote: >Speaking of NT, I downloaded the full version of msie 3.0 the other day but >when I tried installing it, an error message came up saying that it requires >a Win95 or WinNT4.0 build of 1381 or higher. I am currently running NT 4.0b >that has a build of 1314, does anyone know of where is the upgrade or >service packs(if available)? I have tried looking around microsoft.com, but >they neither provided any detail nor did they provide an e-mail. Build 1381 is the final release of NT 4.0, not a beta version. Build 1381 was released to OEMs about a week and a half ago. It should reach a retail outlet near you before September. There is no free upgrade from the beta version of NT 4.0 to the final version. You may want to purchase a copy from Microsoft, or sit in IRC for a while and wait for someone to hand it to you. --- Jeremy L. Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ gt4436c(a)prism.gatech.edu | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

1 0

Re: "world communications being monitored"
by Wayne H. Allen 17 Dec '03

17 Dec '03

At 08:44 PM 8/16/96 -0700, Vladimir Z. Nuri wrote: > >------- Forwarded Message >From: "Mat Guthrie" <matguthrie(a)enterprise.net> >To: mmlist-l(a)newciv.org >Date: Wed, 14 Aug 1996 20:14:39 +0000 >Subject: All Int' Communications Are Monitored > > >- - -> SearchNet's snetnews Mailing List > >Hi there all, > >I heard an amazing news report on the radio today, that confirmed >what I've heard and suspected for a long time - all international >communications *are* continually being monitored!! No, what this guy heard was a book report. I don't know how well a writer Mr. Hager is but if he doesn't have proper documentation then he confirms nothing. > >The report was on "The World at One" news report on BBC Radio 4 - >about as respected, reliable and informative a source as any >mainstream media is ever likely to be. The feature spoke about a >book that's come out in New Zealand called "Secret Power" by Nicky >Hager, that has been endorsed by the former (?) Prime Minister of New >Zealand himself. It supposedly goes into great detail about an >international agreement called "Echelon" of which the US, UK, >France, New Zealand, Australia and several other nations are all >participants. According to Nicky Hager - who was interviewed on the >program - a system of monitoring stations have been set up in various >countries in the world that continually monitor ALL fax, email, >telephone and satellite communications etc, "sniffing" for keywords >using super computers. When these key words are identified the >information is automatically logged and according to Hager, sent >directly to the US intelligence services. > >Now whilst many of us have undoubtedly come across this sort of >information before and undoubtedly many of us have probably scoffed >at such ascertions as merely impossible and blatantly paranoid, >something very significant sets this report apart. Before the book >was published, Hager went with his manuscript to the New Zealand >Prime Minister who had been responsible for signing NZ up to the >agreement (I got the impression that he is no longer in power). If anyone cares to look up the political history of the western Pacific rim, it would seem very suspicious that N.Z and Australia would have any intelligence commitment with France at all. >Anyway, the PM was so shocked by the revelations that the book >contained, that he has written the forward to the book. Supposedly he >says that he had no idea of the true nature of the agreement and the >powers which it bestowed on the intelligence services and is >obviously trying to distance himself from the storm that's beginning >to brew up about it. Maybe he's just covering his arse or maybe he >was just another puppet head of government who wasn't properly >informed about what was really taking place in his own country, but >either way, the fact that he has got involved with the book adds >considerable credibility to it's claims. If the PM has no credibility (his saying he knew nothing) how does his input add credibility to the book? Those of you who have often >said that such wide-scale monitoring is "obviously impossible" might >be wise to re-evaluate your positions! > Those of us in-the-know won't be reevaluating anything. Save your money and wait for the book to get into the local library. Better to spend your money on David's book on Enigma. Wayne H.Allen whallen(a)capitalnet.com Pgp key at www.capitalnet.com/~whallen

1 0

Re: Imprisoned Capital
by James A. Donald 17 Dec '03

17 Dec '03

[In response the argument that attempts to imprison capital will cause capital flight] At 10:50 PM 8/16/96 +-200, Bart Croughs wrote: > This is a good point when you talk about governments that will > prevent *all* capital from flowing out. But a government could > prevent the outflow of capital of it's own citizens, and still > allow capital of foreigners to leave the country. As long as > foreign capital isn't imprisoned, foreign capital could be > attracted. Been tried. Does not work. 1. If foreign capital is allowed to freely enter and leave, internal players find ways to sneak their capital out. This forces the government to start regulating and supervising foreign businessmen in ways that at best terrify them (such controls look very much like creeping confiscation), and at worst cause them huge harm with no real benefits to anyone. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: National Socio-Economic Security Need for Encryption Technology
by Bart Croughs 17 Dec '03

17 Dec '03

Timothy May wrote: >Others have shown how meaningless your repeated calls for a proof are, as >so many assumptions must be carefully spelled out. >To give an example of how hard the situation is to analyze, consider the >computer and chip industries. (If you argue that your "theorem" is for >nations in the aggregate, and not any particular companies or even >industries, then I will maintain that my example holds pretty much true for >automobiles, pharmaceuticals, chemicals, and so on._ >The computer and chip industries move certain investments abroad, to >Malaysia, the Phillipines, Indonesia, Mexico, and so forth. But by moving >these investments abroad, they believe their net market size, >profitability, shareholder value, etc., will be enhanced. Else they >wouldn't do it. >Multiply this by all the industries.... >Now, would "the economy" be "better off" if Intel, say, had not moved >assembly operations to Malaysia in the 1970s? Perhaps Intel would now be >bankrupt and gone, as so many of its rivals of the time are now gone and >barely remembered. >You see the problem? Who can say what "better off" is, given that we can't >run history down alternate paths as an experiment. >Your one-track mind is truly astounding. We've had kooks and oddballs on >the list before, but never one who has written a dozen or more posts asking >the same ill-phrased question over and over again. So you say that my question can't be answered because the situation is too difficult to analyze, "given that we can't run history down alternate paths as an experiment." The situation is indeed hopelessly difficult if you think that economics is an empirical (experimental) science. But, as an Austrian, you should know that economics isn't an empirical science; it's a science that deals with the logic of human action. It starts from the axiom of human action, and all the other axioms of economics follow from this axiom by deductive reasoning. This is called the praxeological method. The answer to economic problems can only be given by reasoning, not by running experiments in the real world. Read Mises (Human action), Rothbard (Man, economy and state) etc. for further information. To prevent you from claiming this isn't true, I will quote Rothbard (in 'The foundations of modern Austrian economics', p. 19, ed. E. Dolan): "Praxeology rests on the fundamental axiom that individual human beings act(...) The praxeological method spins out by verbal deduction the logical implications of that primordial fact." etc. So, it really doesn't matter at all that we can't run history down alternate paths as an experiment, because the kind of empirical 'data' that such experiments would generate are not very helpful in the first place. Fortunately, situations that are at first sight hopelessly difficult can sometimes be analyzed and simplified by performing a thought experiment. That's what I did when I offered my 'reductio ad absurdum' proof. I didn't use empirical data, I used logic and reasoning; that's the way it should be done in economics. So far, you didn't rebut the proof I offered. You only argue that my proof must be wrong because the situation is too difficult to analyze because of all the empirical data that are lacking. That argument is, as I explained above, not to the point. And the fact that you take refuge in name-calling makes me suspect that subconsciously you don't find it very to the point yourself either. I understand it's not pleasant to be rebutted every time you answer my posts, but I fear it's something you will have to get used to. Of course, you could also consider making better arguments (after reading the books I suggested), or else stop posting on the subject. Bart Croughs

2 1

Re: Ad Hoc Bay Area Cypherpunks Thing--Sat., 24 Aug, 3 pm, Menlo Park
by mccoy＠communities.com 17 Dec '03

17 Dec '03

> On Sat, 17 Aug 1996, Timothy C. May wrote: > > > There is no Cypherpunks event scheduled for that Saturday, but we can have > > an ad hoc gathering, informally arranged. I suggest meeting at 3 p.m. at > > Cody's Bookstore, on El Camino Real in Menlo Park (hard to miss). Or at the > > coffee shop next to it...either should be sufficient Schelling points to > > Do you mean Kepler's? That's the one right near Menlo Park caltrain > station; the coffee shop next to it is Cafe Borone. Get the Mocha. [Typing from the courtyard outside Cafe Barone (love that Ricochet...)] For those needing better directions, Cafe Barone/Keplers is at the Menlo Park Center, at the corner of El Camino and Ravenswood in Menlo Park... jim

1 0

Re: Software manpower exports and the power of governments
by Vincent L. Diaz 17 Dec '03

17 Dec '03

At 06:17 PM 8/17/96 +0600, you wrote: >In the case >of Coke, I can understand the government not wanting to spend >precious foreign exchange on sugared water in a country where >there is a serious shortage of drinking water. Tim made the >perfectly valid point that such decisions cost the country in >reputation, but the Indian government doesn't mind loss of >reputation in matters it firmly believes in, as in the current CTBT discussion. There is a central point here that you are missing. Many of us here believe in the absolute, sovereign freedom of the individual. Governments should only be minimally involved with the earning of individuals. Control over the distribution of currency abroad, (i.e. foreign exchange controls) is definitely not one of them. As I understand the story of Coke in India, New Delhi was bent, among other things, on stealing proprietary information, (i.e. the formula for Coke) from the company. In short, they told Coke that they could stay only on condition that the formula was turned over to New Delhi. Yes, they cloaked their proposed theft in high sound nationalistic tripe, however it was nothing but a blatant attempt to steal what was not theirs. I do not claim a complete knowledge about the availability of fresh water on the Indian Sub-Continent. But I would be willing to wager that lack of progress in this area was severely hampered due to the typical, Statist meddling of the Indian government in the lives of its own people. It is immoral for any government to interfere in the personal choices of free men and women. If any person wishes to partake of a high quality, and probably locally expensive soft drink in preference to either local brands or water, scare or not, such a choice should be left to them, not to an Collectivist cabal of bureaucrats. What the Socialist Governments of India have never comprehended is that a government intent on doing you good is capable of doing you out of everything you own! Simplistic? Yes......simplicity is one of freedom's chief virtues. Regards, VINCENT L. DIAZ U-SAVE COMMUNICATIONS Business Line: 619-277-2411 Fax Line: 619-277-0298 http://www.cognigen.com/agencies/

1 0

CS8191 data sheet and ordering info...
by Eric Blossom 17 Dec '03

17 Dec '03

Attached is the ascii version of the data sheet, followed by ordering information. Full protocol specifications will be available in about 2 weeks. Eric ---------------------------------------------------------------- Communication Security Corporation CS8191 Triple-DES Telephone Privacy Device With the growing number of tools available to assist in wiretapping, anyone using a telephone in the '90's is vulnerable to unwanted eavesdropping. With many of today's standard technologies, anyone can gain access to our most private of conversations. As a result, the telecommunications industry has an increasing need for private, secure voice communication devices. The Communication Security Corporation has dedicated its resources to addressing this need by designing the CS8191, our flagship product and the most secure telephone privacy protection available. Unsurpassed Security Truly open, encryption technology is at the heart of the CS8191 telephone security unit. With the press of a button, the CS8191 is activated. Within seconds your conversation is kept secure from the intrusion of any type of wiretapping. Open-Standard Encryption How are you assured that your tele-security unit is really working to protect your telecommunications? In truth, the "trust-us" proprietary solutions used by competing products are an indication of weak privacy protection. They "hide" from the user, the ability to verify proper functioning of the unit. Communication Security provides users with the best privacy protection by incorporating leading-edge encryption technology that utilizes the power of truly open standards. Our commitment to an open specification allows sophisticated users the ability to "check under the hood" and evaluate the security attributes of the system. Portable And Easy To Use The CS8191 has been designed to work with conventional analog telephone systems (POTS). The unit connects between your telephone and the wall, much like a telephone answering machine. Plug in the power, and that's it. In "clear mode" your telephone continues to work as it normally does. To begin an encrypted conversation, simply press the 'go secure' button and wait for the green light to come on. The system is easy to use and compact, making it the perfect telephone security solution for home, travel or office use. Superior Performance * As a standard component, Communication Security has incorporated a leading-edge speech coder for clarity unsurpassed in secure telephone devices, to date. * Voice clarity is virtually undisturbed whether the system is in secure or clear mode. * LED indicators on the unit let you know instantly that your call is being transmitted securely. Service And Support The Communication Security Corporation provides a one year warranty for all parts and labor. Upgrades are included in the price of the CS8191 and are available under the terms of the warranty. For More Information To get more information on securing your phone communications, send email to info(a)comsec.com or call (707) 577-0409, fax (707) 577-0413. Features Benefits * Open standard encryption Allows independent evaluation and verification of protocol and behavior * Excellent speech quality Superior clarity is assured with leading-edge speech coder as a standard component * Auto Secure Allows for secure, unattended operation for all-hours data protection * Small size and weight Makes the CS8191 the perfect solution for secure home, office or travel telephone communications Specifications: Modem * ITU V.32bis (14,400 bits/sec) Interfaces * Two buttons (Go Secure, Go Clear) * Two LEDs (Secure, Clear) * External power supply * Two modular phone jacks Power * Input voltage: 110 volts AC, 50-60 Hz. Approvals * FCC, part 15 and 68 Warranty * 12 months parts and labor Software Upgrades * One year of upgrades included in purchase price Voice Nodes * Clear voice * Secure voice Secure Mode Speech Compression * International standard GSM 06.10 full rate speech transcoding (13,000 bits/sec) Notes: * Specifications subject to change without notice. * Government regulations apply for export license. * Completing the circle of secure communication requires the receiving end of your call to also have a CS8191 unit connected to their phone. Cryptographic Details: * Unique session key generated for each conversation using Diffie-Hellman exponential key exchange (2048 bit modulus) (U.S. Patent No. 4,200,770 licensed by Cylink Corporation) * Defense against "man in the middle" active attack using interleave protocol combined with voice verification of six digit key name derived from the public exponentials * Hardware Random number generator based on Johnson noise * Three Key Triple-DES (168 bit key), operating in modified counter mode. * No back door, "Key-Escrow" or GAK * Open standard. Full protocol specifications available. Communication Security Corporation 1275 Fourth St. Suite 194 Santa Rosa, CA 95404 Tel: 707-577-0409 Fax: 707-577-0413 info(a)comsec.com ---------------------------------------------------------------- Yes, I want real telephone privacy protection! Send me ________ CS8191's at $995.00 each: $____________ Shipping and Handling: $_______10.00 California residents add sales tax: $____________ Total: $____________ I'm paying with Check or M/O ____ Visa / MC ____ Name on Card:______________________________ Card Number:_______________________________ Exp. Date:__________ Ship To: _________________________________________ _________________________________________ _________________________________________ __________________________________________ Allow 6-8 weeks for delivery. I am a US citizen or "Lawful Permanent Resident" Yes____ No____ Make checks payable to: Communication Security Corp. Mail or fax this order form to: Communication Security Corp. 1275 Fourth St., Suite 194 Santa Rosa, CA 95404 v: 707-577-0409 f: 707-577-0413

2 1

US Taxes on X-Pats
by Vincent Cate 17 Dec '03

17 Dec '03

Robert Hettinga <rah(a)shipwright.com> > However, as Black Unicorn has noted here before, the Phillipenes are the >only other country besides the USofA where citizens are taxed any income >you get, no matter where on earth you actually earn it. It is not exactly that bad if you are outside the USA. I got ahold of the IRS codes on this before I left the USA (so about 2 years ago). The rule then was that the first $70,000 you earned was tax free if you were outside the USA for 330 days or more of the year. From another x-pat in Anguilla I heard that the $70 K had been increased. If you live outside the USA and have a corporation outside the USA, you might prefer that the corporation buy a company yacht rather than pay you more than $70 K. And at least on this tropical island, $70,000 tax free would go a very long way. It is true that if you are getting dividends and interest on your fortune that moving outside the USA won't help, unless you get rid of your US citizenship. And the USA wants you to pay capital gains on your fortune as if you sold everything for cash right before you got rid of your US citizenship. So it seems best to get rid of it before you are really rich. :-) -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

2 2

Ad Hoc Bay Area Cypherpunks Thing--Sat., 24 Aug, 3 pm, Menlo Park
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:45 AM 8/17/96, aba(a)atlas.ex.ac.uk wrote: >Living in the UK, I really don't have that much idea where the people >on the list I've gotten to know over the years live. > >I will be over in the San Francisco / Redwood City area next Saturday >(24th), if anyone I know would like to meet, exchange keys, have a >chat about crypto/cypherpunks stuff, mail me. > >Also if there is any regular cpunks meeting in this area which >coincides, let me know! (I passed this message by Adam Back, and he can make this schedule. So, here it is. Unless serious objections are raised--e.g., a conflict with another party--I suggest we do this.) There is no Cypherpunks event scheduled for that Saturday, but we can have an ad hoc gathering, informally arranged. I suggest meeting at 3 p.m. at Cody's Bookstore, on El Camino Real in Menlo Park (hard to miss). Or at the coffee shop next to it...either should be sufficient Schelling points to nucleate a group. >From there we can adjourn to someplace for food. This should be close enough (a few miles) from Redwood City...a lot closer for Adam that the 50 miles for me. But I always need good excuses to visit the Valley. --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

distribution Digest - V01 #02
by distribution-request＠sevenlocks.com 17 Dec '03

17 Dec '03

distribution Digest Fri, 16 Aug 1996 00:01:50 Eastern Daylight Time V01 #02 Today's topics: 'new security information available' 'new security information available' ---------------------------------------------------------------------- Date: Thu, 15 Aug 1996 21:19:11 Eastern Daylight Time From: "Dstang" <dstang(a)sevenlocks.com> Subject: new security information available Dear Security Colleague: I would like to invite you to subscribe to SecurityDigest, a new, free bi-monthly electronic newsletter, devoted to security news, issues and trends. Every issue of SecurityDigest is delivered to your desktop (or laptop) with the latest security news and information you need, in a clear and concise e-mail format. Subscribe now by sending an e-mail message to listserver(a)sevenlocks.com containing the string "subscribe securitydigest." Or view the charter issue of SecurityDigest on Safe@Home, Seven Locks Software's Web site (http://www.sevenlocks.com/SecurityDigest.htm) where you can also secure your free subscription. Sincerely, David J. Stang President and CEO Seven Locks Software, Inc. ------------------------------ Date: Thu, 15 Aug 1996 21:19:26 Eastern Daylight Time From: "Dstang" <dstang(a)sevenlocks.com> Subject: new security information available Dear Security Colleague: I would like to invite you to subscribe to SecurityDigest, a new, free bi-monthly electronic newsletter, devoted to security news, issues and trends. Every issue of SecurityDigest is delivered to your desktop (or laptop) with the latest security news and information you need, in a clear and concise e-mail format. Subscribe now by sending an e-mail message to listserver(a)sevenlocks.com containing the string "subscribe securitydigest." Or view the charter issue of SecurityDigest on Safe@Home, Seven Locks Software's Web site (http://www.sevenlocks.com/SecurityDigest.htm) where you can also secure your free subscription. Sincerely, David J. Stang President and CEO Seven Locks Software, Inc. ------------------------------ End of distribution Digest V01 #02 **********************************

1 0

Anguilla
by Vincent Cate 17 Dec '03

17 Dec '03

First I think Tim's summary of my situation is very accurate and fair at this point. One nit of a detail: >I surmise, given the size of Anguilla and the non-constitutional basis of >its government, etc., that it _might_ be a lot easier for a bureaucrat or >the Governor-General, or whomever, to seriously disrupt any business by a >few phone calls. I don't know this for a fact, but I suspect it to be >true. Anguilla does have a constitution. It would be hard for any bureaucrat to seriously disrupt an Anguillian's business. There just are not any regulations that they can arbitrarily invoke to harras people. However, x-pats are here as guests and they have to get a work permit, or visa, or something from time to time. So if x-pats do something that wears out their welcome, they have to leave. Tim: >Contrast this with a small data haven (a new >industry) in a small country, with operating margins that are razor-thin >(given the pricing structure Vince announced, I doubt Taxbomber and other >customers were paying enough to ensure a flow of payoffs to the Ruling >Families of Anguilla and the various officials that need to look the other >way). Nope, no bribes to government. However, in doing business here a lot of people have learned more about the Internet and computers. And I and another x-pat have started a weekly computer club. So there are good reasons that Anguilla should like having me here. For the record, the only bribe I have paid while I was here was (indirectly) to someone at the phone company to try to get a phone installed faster. It did not help, still took a year to get the phone. Cable and Wireless, and their high prices, is the worst thing about Anguilla. The current Anguilla government seems to be very clean. The rumor is that Cable and Wireless bribed the previous government with things like a free loan of a bulldozer worth $500/day for a couple weeks to get their 30 year monopoly contract. Given that CandW is making millions each year, seems they got off cheap, if true. Claim is that the UK does not mind their companies bribing officials, and CandW does it alot all around the world. -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

2 1

signoff cypherpunks
by Greg Nygren 17 Dec '03

17 Dec '03

>Return-Path: <cypherpunks-errors(a)toad.com> >Received: from toad.com by tor-srs2.netcom.ca (8.7.5/SMI-4.1/Netcom) > id TAA12781; Fri, 16 Aug 1996 19:38:39 -0400 (EDT) >Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id KAA07516 for cypherpunks-outgoing; Fri, 16 Aug 1996 10:30:44 -0700 (PDT) >Received: from soleil.mnet.fr (root(a)soleil.mnet.fr [194.51.151.1]) by toad.com (8.7.5/8.7.3) with SMTP id KAA07511 for <cypherpunks(a)toad.com>; Fri, 16 Aug 1996 10:30:35 -0700 (PDT) >Received: from linux (ppp03.mnet.fr [194.51.151.26]) by soleil.mnet.fr (8.6.11/8.6.9) with SMTP id TAA21252 for <cypherpunks(a)toad.com>; Fri, 16 Aug 1996 19:29:49 +0100 >Message-ID: <3214BCA6.6ED8124F(a)mnet.fr> >Date: Fri, 16 Aug 1996 13:23:34 -0500 >From: Arnauld Dravet <scraver(a)mnet.fr> >X-Mailer: Mozilla 3.0b6 (X11; I; Linux 2.0.0 i586) >MIME-Version: 1.0 >To: cypherpunks(a)toad.com >Subject: signoff cypherpunks >Content-Type: text/plain; charset=us-ascii >Content-Transfer-Encoding: 7bit >Sender: owner-cypherpunks(a)toad.com >Precedence: bulk > >signoff cypherpunks > >

1 0

Re: Anguilla - A DataHaven?
by Hallam-Baker 17 Dec '03

17 Dec '03

The problem with the debatre on datahavens is that it is failing to account fo the fact that without the infrastructure of law business is not possible. What taxbomber offers is false identification papers. He does not simply offer fake passports but a whole raft of fake credentials. If I am offering free services to accredited journalists and someone comes along with a taxbomber supplied illegitimate press card and obtains free services that is fraud. Just because a policy for supplying credentials is not fully effective does not make it legitimate for an individual to make a business out of helping people to criminally exploit its flaws. Similarly libertarian wet dreams about oil rigs chock full of commandos armed to the teeth with machine guns will remain dreams. Fact is that under international law an oil rig is regarded as a ship and as such has to be acredited by some recognised nation. Diplomatic recoginition is not a trivial matter. Countries only provide recoginition if it is in their interests and critically it is _governments_ that are recognised. A declaration of independence by the inhabitants of an oil rig would be treated in a similar fashion to the Montana freemen. If the intention was to make international fraud easier then definitely expect the same treatment. Phill

1 0

Re: Greetings from Whore.com
by Charley Sparks 17 Dec '03

17 Dec '03

Well, it was getting a bit "stiff" in here.... but I guess 'ya never can tell.. I haven't checked it out.. has anybody ?

1 0

Credit enforcement
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Steve Omohundro writes on alt-inst: > I'm intrigued by the notion that in a digital economy > contracts might be enforced by design rather than by the good faith of > the participants. I have been intrigued by this possibility as well. See my essay at "http://www.best.com/~szabo/smart.contracts.html". Steve has put his finger on one of the basic outstanding problems in this area, namely the enforcement of credit. Currently there are several partially effective processes: * Reputation (especially credit reports): often effective, but only to a point, as it is often hard for the debtor to accurately judge the future reputational effects of an action (eg failure to pay a bill, taking out too large a loan, etc.) that has clear, local, beneficial effects today. This is more imbalance in knowledge between current and distant consequences among individual consumers, but even among large organizations with high credit ratings it is not an irrelevant factor. * Secured transactions: liens, etc. * Garnishment of future income * Law enforcement, especially to enforce transfer of control over liened assets, garnishment, etc. These processes have a fundamental property in common -- they violate the privity of credit transactions -- they bring in third parties to track reputations or enforce repayment. Credit transactions seem to entail a fundamental imbalance in incentives that can only be redressed by bringing in third parties. Secured credit need not violate privity if the physical control over the securing property can be shared. So that, for example, automobile credit can be secured as long as reposession is possible. The trick is to make repossession by the creditor easy but theft by third parties difficult. I have proposed "smart liens" along these lines, electronic security measures strong against third parties but with a "back door" for creditors. This well-specified, shared control over "smart property" more accurately reflects the agreement involving that property, so that there is less need for third parties. To even more accurately reflect the contract, we need a mechanism to eliminate the creditor control once the auto loan has been payed off. Alas, there is less incentive to provide these kinds of contractual process improvements in a market where government subsidizes the enforcement of contracts. Similar mechanisms might be possible for other kinds of security (houses, escrow accounts, etc.), but many valuable kinds of credit are unsecured, and we run into privity problems when it comes to garnishment of future income. Here, we are invoking third parties, namely the debtor's future contract counterparties. Any mechanism seemingly needs to involve them, but both principals have an incentive to enter a private, ungarnished contract in preference to one involving the creditor. (ie, the amount of garnishment is a surplus to be divided between principals who can route around it). A way to a solution, if it were feasible, would be to give the creditor shared control over the entire scope of of the debtor's income capabilities - or, a bit closer to practicality, over the entire scope of his digital income capabilities. A secondary solution is some combination of wide scope and limited compromise of privity. After all, money itself is a compromise of privity, since the contract parties rely on third parties to clear and maintain the value of the currency. Money's compromise of privity is well-defined, however, not an open-ended release of information and physical control, even over one's own person, as often occurs with credit reports and law enforcement respectively. Our challenge is to find privity compromises with such well-defined limits to enforce credit transactions. One possibility here is a "garnishable currency". All banks have an interest in enforcing credit, so they can make deals with each other to enforce credit via the garnishment of debtor bank account deposits at any participating bank. However, substantial amounts of garnishment (and if it provides a lower cost way of enforcing credit the amounts will be substantial) gives rise to an incentive for banks to fail to participate. Here the need to commonly clear a currency between banks can be used as a barrier to entry for such defectors. The currency is simply declared garnishable, and any banks who wish to deal in the currency must participate in the garnishing process. This currency wins against competitor currencies in a free-banking market because it provides a better means to enforce credit, allowing greater credit expansion at lower isk. On the other hand, traditional coin and currency transfers, and some kinds of digital cash transfers, need not involve deposits to bank accounts linked (usually by True Name, but a "debtor nym" could also work) to one's unsecured debts, and given that there is a market for these kinds of transfers for other reasons, its existence allows banks to defeat auditing of garnishment by other banks participating in that currency. Abuses of financial auditing for the purposes of extortion, inside information, etc. will likely maintain a major market for the non-deposit payment methods. Steve proposes "interval money" that would expire. A similar idea has been proposed by Tim May, a "time release" form of money that becomes good only after a certain date. These can probably be implemented by a digital mint expiring or activating special issues of digital cash, or by a third party issuing escrowed keys at specific times (since these keys are encrypted against the escrow agent, and that agent doesn't know what they will be used for, the escrow agent has no incentive to cheat). A technical issue here is whether the digital signature space is large enough to encompass one unique signature per unique credit transaction deadline into the indefinite future. While these protocols are intriguing, and potential building blocks for a solution, the institutions using them proposed so far seem to still rely on a solution to the deposit garnishment problem as discussed above, that is the problem of sufficiently disincentivizing the debtor from using non-garnishable alternatives while maintaining the privity of payments to those who are not unsecured debtors (the ability for these people to use non-deposit payment methods). Nick Szabo szabo(a)netcom.com http://www.best.com/~szabo/

3 2

Re: Schlafly on crypto
by Hallam-Baker 17 Dec '03

17 Dec '03

If we are having a Schlafy bash then i think it fair to bring up her "Con-Con" paranoia. She has published a series of articles predicting that there will be a "Constitutional Convention" - that is not one of your ordinary constitutional ammendment sessions but a wholesale rewritting of the US constitution by a cabal as happened when it was first written. A typical rant:- >They adopted a plan to plunge America into a Constitutional >Convention. Article V of the U.S. Constitution requires that "on the >Application of the Legislatures of two thirds of the several States, >[Congress] shall call a Convention for proposing Amendments." This >method has never been used; all 27 Amendments now in the Constitution >were adopted in the traditional way (passage by a two-thirds majority in >each House of Congress followed by ratification by three-fourths of the >states). http://www.eagleforum.org/users/eagle/public_html/psr/1996/may96/psrmay96.h… In fact despite Schlafy having predicted such a conference many times over the past years (I have seen more than 10) her claims are entirely false, not to say fraudulent. She uses the usual tricks of citing fraudulent references and making up quotes. In short she is a fraud hoping to get people to join her foundation to stop a Con con that nobody is proposing. I don't think that Schlafy is a usefull aly any more than Bob Dole basically its just opportunist politicians latching onto the rhetoric of debates without engaging in the argument. Dole senses that the mood of the country is pro crypto so he supports that, he senses that it is anti porn so he will support that. Basically Schlafy is playing the same game. She is saying things that she knows will curry favour so she can get people to join her Wacko club. Phill

1 0

Re: MD5 completely broken!
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Sun Aug 18 02:56:44 1996 > > >Atfer much scientific research, I have finally found a way to restore > >any message given only its MD5 checksum. > > uhm, congratulations <g> > > > maybe next time when you break a code and want to make > some $$$, sell your solution in secret > to the people who patented it!! > Not to mention that this is complete nonsense and a troll. No matter how weak the MD5 algorithm may or may not be, there are an infinite number of possible messages for each checksum. And thus the original message could NEVER be restored. Its as secure as a OTP. That's why its called a 'one-way' hash function. Not to mention the fact that he misspelled both 'entropy' and 'after'. P.S. But imagine if it was true! MD5 would become the ultimate compression algorithm. Any message could be reduced to a 128 bit archive. - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMha+reSLhCBkWOspAQFvkQf+PE2+p8gLJ5Fcg64fKogAaad1v0KUAm6N PDWKqOF87hr4GK7Je0TnflQ5640w11CbqnhQeTeuMZ1vypJ+OMod7riY+okd4VQL tLaAA91EuzDLUnSnh3VT16MmN152RTWWS0fufASdJPw2aknhC5NA8kp+0ryQUo+f zICE619/4I0Hjz6qwIzuEYD7tMW1OEz5KGRpyLnZaiOFXObxLHQ4/QwUuJVfLrY0 GrKxNrmtIMiFyHqksbmg22G8f9SsziKa8TjoHDrq2UIL7ForTneC/C20HTOVh9iS 6+C9u2Wij+AFEgPQSZMyxP0Wb8m20DcoeOpnzbBLBVw9BfiqNApvUQ== =Nu+T -----END PGP SIGNATURE-----

3 2

Re: Orbiting Datahavens
by Ross Wright 17 Dec '03

17 Dec '03

On Or About 2 Jul 96, 17:06, Brian Lane wrote: > to have a backup satellite in case of a disaster. Once the Delta > Clipper is functional They did have that big wreck a couple of weeks ago. I am not sure of the salvage status. Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re:NT remailer
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: cypherpunks(a)toad.com Date: Sat Aug 17 20:37:49 1996 > At 21:08 8/16/96, rednax wrote: > >Speaking of NT, I downloaded the full version of msie 3.0 the other day > but > >when I tried installing it, an error message came up saying that it > requires > >a Win95 or WinNT4.0 build of 1381 or higher. I am currently running NT > 4.0b > >that has a build of 1314, does anyone know of where is the upgrade or > >service packs(if available)? I have tried looking around microsoft.com, > but > >they neither provided any detail nor did they provide an e-mail. 1381 is the full release version of NT 4.0 - there probably isn't an upgrade or service pack. You'll have to lay down your cash just like the rest of us poor slobs. dave - ---- David E. Smith POB 324 Cape Girardeau MO USA 63702 dsmith(a)prairienet.org http://www.prairienet.org/~dsmith send mail of 'send pgp-key' subject for my PGP public key "Welcome to the human race." -- Snake, _Escape from L.A._ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Automagically signed with Pronto Secure for Windows. iQEVAwUBMhZz8DVTwUKWHSsJAQEelQf+I7iHCNOwFnYn94uvxuczY0PTYP5nU9dp nQXVbdlVNO+vZH4y+9CLEhoaNbD+BLxSaULk6nAIUmvwyL9dniKJ9wmcUsAoJrk0 ML/najbDHQJ8BsSbV9ivyLJZxwwnCGmLHwcvchJtppLdXzkKFO0EwvY0LGtim4CZ uWjhKlI6rUo9trHeLtPCn/RuQheaT4x4I7TEA4OZkP46DnWRl/4288MPAcL4SxUO ojt/Bw8eAxhNOeBhuj7s2UaFmfCejH6ml1jLI/b7+a9tUvDnq8hPMlRAyVDzkj4I n9kHLvO0spjweXWNgj2NqDHfu2Ygtz+vMlpXJN4FUX++aYOlMOvytQ== =kUCL -----END PGP SIGNATURE-----

1 0

[NOISE] Re: Greetings from Whore.com
by Daniel Miskell 17 Dec '03

17 Dec '03

Nope. No web access. However, when school is back in session, and I get my radio show back and head back to the computer labs... <cackles evilly> Greetings from <property not found>, Daniel.

1 0

Re: Protecting floating datahavens?
by Sean Sutherland 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: stewarts(a)ix.netcom.com, cypherpunks(a)toad.com Date: Sat Aug 17 20:15:22 1996 > The basic risks with such things are: > 1) Getting governments to agree to leave you alone. If you're doing a > 2) Getting governments and other pirates to actually leave you alone. > 3) Making it work financially, for the proprietors and tenants/co-owners. > 4) Convincing investors that you're safe enough on 1) and 2) Auctually, the one real big problem is that the data is all in one place. Rememeber that the whole point of a data haven isn't secure backup -- it's secure storage. And if the place gets blown sky-high (which can easily be done discreetly and possibly made to look like an accident), all the data is going to be lost, and you're basically screwed. The only workable solution to this that I can see has nothing to do with floating countries or anything of the sort. Instead, the use of data-splitting programs could be used. I'm not all up on the security or reliability of these programs, so if I'm making unwarranted assumptions, guess I did a lot of typing for nothing. This has probably been proposed before, too, but what the hey... For example, lets say you set up an office in 100 countries (it would be more effective to have more, but let's say 100). Through the use of anonymous remailers and encryption, he could apply for a customer ID number and password. To avoid any possibility of forgery, such IDs could be prehaps 100kb-1Mb (this is just for confirmation of identy when sending the data into the data havens -- shorter IDs would be used for identifcation). Then, he could split the program into 100 parts, with (say) 70 parts being needed to restore the entire file. He would then encrypt and send each of these files to each remailer through the Internet. To get the data back, he would send in the ID and password, encrypted again, to the nessecary number of offices in order to retrieve the data. Payment, if nessecary, could be made by anonymous bank transfer or something like ecash. Proprietary encryption systems (PGP-like, with IDEA/RSA hybrid in it, but can accept 5000+ bit keys and padding) might be used, as well. This scheme has several pluses. One, it doesn't rely on any fancy legal manuevering with off-shore nationalities and crap. Second, it isn't very vunerable. They would need to get legal jurisdiction in 70 different countries to sieze the data, and then they have the encryption to deal with. Third, if there's any server problems, it wouldn't affect the entire system. Fourth, you don't have to attach missle launchers and hire a private security force to defend it. There are several problems, though. First, it relies on the Internet, something which is inherantly insecure anyway. Second, if someone's being wiretapped in their own country, then the whole effort is in vain. Third, it would be incredibly costly, but probably no more so than any kind of off-shore platforms. In fact, it would probably be cheaper. Any comments? - --- Sean Sutherland | GCS/C d- s+:+ a--- C+++ V--- P L E- W++ N++ K w o O-(++) Key: E43E6489 | M-- V PS+ PE++ Y PGP++ t--- 5+++ X++ R b++ DI+ D+ G e- Vote Browne '96 | h! !r y -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Key: finger or email w/ 'send key' in subj. http://www2.interconnect.net/maverick iQEVAwUBMhZuq1ZoKRrkPmSJAQE9QQf7B+ikk1/dFKyydIzQkGcfX8+srK5GeRlr 5IhEFkXJY34dI4Dqg/yKQ6m/XwRMyqPHxcyV6lR6qU9ngaawBWjd1Q+HBtCOzEs6 Ch8AgTq5CWox8/7FZKz32xGJCVpPJ+etzeJSK2kqKfPnTW+yhz7rch+DIvEJKnM1 ktlxsi/3c1Hn89OLZrCHUeJQqBMoU7rVnmVv6sfGVUQuwJ09yWT457HCN7dZbH1z Nrc+w7ewlxivH1r6KZ1DNk8BJrroQXD7mSHvXmEwyTiyr9DzaPhtlllarz/iPNFF 295F/4Cj9K2HiwJfKH7pDy60OKLBGP72xnc0cjxj8TlIp/KDY7VsPQ== =BNfl -----END PGP SIGNATURE-----

1 0

Re: Orbiting Datahavens
by Ross Wright 17 Dec '03

17 Dec '03

On Or About 17 Aug 96, 5:24, Brian C. Lane wrote: > > How about an orbiting DataHaven. No jurisdiction to bother with, > extremely difficult to get to (except by large governments...). <SNIP> > it would work. Might even be cheaper than outfitting the oil-rig > with the rate that they are tossing satellites into space. > > If the HAM radio community can get a satellite into space, why not > the > Cypherpunks/Linux communities? This is a fascinating concept that needs to be further researched. It would be interesting to do some cost examinations. I have always been behind any private space programs! I am even behind the Govt. Programs. Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906 Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0