December 2003 - cypherpunks-legacy

Re: TIME pathfinder registration
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

Will Kinney <kinney(a)bogart.Colorado.EDU> writes: >> I note someone has used "cypherpunks" as a login for TIME Mag's >> WWW service. ... If so, what's the password? > >This was me. The password is "writecode", since Pathfinder didn't allow >the login and password to be the same. Perhaps in the future people might use "sknuprehpyc" in such cases? And of course, don't put the list's email address in. -- David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 No, his mind is not for rent to any god or government.

2 1

Re: Is it legal for commercial companies to use PGP?
by tim werner 17 Dec '03

17 Dec '03

>Date: Mon, 17 Jul 1995 16:15:10 -0400 >From: tim werner <werner(a)mc.ab.com> >... I was talking to one of the sys admins at >A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >because Viacrypt owned the commercial rights. I should have mentioned that I have no problem with people trying to make money. However, it turns out that ViaCrypt is not selling site-licenses, or even floating licenses, so they actually want to sell a separate copy for every user that will use it. As it happens, the aforementioned sys admin had purchased 5 licenses, to take care of the 2 users he already knew about, and figuring that there would probably be a couple more wanting to jump on the bandwagon. He offered to let me use one of the licenses, but there's no way I can go and tell my users "we have PGP", if I can't tell everyone that they can do it. And, there's no way I can see convincing my boss that we need that many copies of ViaCrypt, just so everyone in my department can encrypt their email traffic. Of course, I realize that none of the above changes the legality. thanks, tw -- Well, Bust My Britches! Eggs Almondine and a Bottle of Beaujolais!

1 0

Re: RC4 crack
by dan＠milliways.org 17 Dec '03

17 Dec '03

On Mon, 17 Jul 95 21:36:45 +0100 you wrote: > >Yep a telnet port is it for both reporting and getting keys, also the >WWW interface to the same. > >> I'd basicly like to be able to start the program, nice it, slam it >> in the background, and forget about it. > >Adam > Is there an easy way to integrate machines who are not on-net 24-7 into this protocol? Not all of us have dedicated lines.:) Dan Bailey ****************************************************************************** Vote Speaker Newt Gingrich for President!! Dan Bailey Worcester Polytechnic Institute, class of 1997. merzbow(a)ibm.net ******************************************************************************

1 0

Cray Computer liquidating...
by Phil Fraering 17 Dec '03

17 Dec '03

According to a flier from an e-mail list I'm currently unwillingly subscribed to, Cray Computer is going out of business. Any comments and/or crypto relevance? Phil

1 0

Re: WSJ on remailers...
by hal9001＠panix.com 17 Dec '03

17 Dec '03

At 14:00 7/17/95, Peter Wayner wrote: >The WSJ has a article on anonymous remailers buried in the B section. It >is pretty straightforward and ends up quoting some Finnish police officer >saying that they're not going to go raiding remailers on any suspicion. >They'll need a real crime. That Finnish comment is probably due to the fall-out/flap from their raid on anon.penet.fi in the CoS case.

1 0

Re: Cray Computer liquidating...
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 3:32 AM 7/18/95, Phil Fraering wrote: >According to a flier from an e-mail list I'm currently >unwillingly subscribed to, Cray Computer is going out >of business. > >Any comments and/or crypto relevance? This is Cray Computer, not the older Cray Research. Cray Computer was developing a GaAs-based computer that used advanced robotic assembly/packaging. Cray Research spun off the project, led by founder Seymour Cray, and the two companies were wholly separate. Cray Research remained in Minnesota, while Cray Computer was located in Colorado Springs. The split was largely arranged because Cray Research was unwilling or unable to fund both the conventional supercomputer lines _and_ the more experimental machines favored by Seymour Cray. So they let Seymour and the technology split off, and a stock distribution was arranged (I was a shareholder of Cray Research at the time, and recall the distribution). Cray Research is continuing to sell "Crays," including successors of the original Cray line and various multiprocessor machines based on the Sparc processor. Cray Computer was trying to find customers for its Cray 3 and (planned) Cray 4. The saga of the collapse of Cray Computer has been going on for the past year or so, with the last several months being the final chance to reorganize the company and keep it going. They failed, apparently, and now the final liquidation of assets is about to happen. Why didn't the Agency bail them out? Not clear, but my guess is that the advanced _process_ technology of Cray Computer was not so exciting to the NSA. The "attack of the killer micros," to use Eugene Miya's phrasing, is wiping out most conventional advanced processor attempts to get supercomputer speed. When a single piece of CMOS silicon gets 200-500 MIPS, and a bunch of them can be put together, it gets pretty hard to justify hyper-expensive GaAs or Josephson Junction or whatever technologies. Sad for Seymour Cray, especially as he'd been pumping some of his own fortune into keeping Cray Computer going, but its the nature of business. And he'll bounce back, or take a well-deserved retirement. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: RC4 crack
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Mon, 17 Jul 1995 aba(a)dcs.exeter.ac.uk wrote: > The problem with nicing is that most unix schedulers don't seem to > know what nice means,.. you still get a noticable slow down on > interactive jobs on SGI boxes even if you've got it npri -h 150, and > even though the bruterc4 (and the bruteSSL too) have tiny resident > core sizes). Nice -19 works great on SunOS, it sits there happily eating up just about all the unused CPU time and doesn't interfere at all with interactive use. I guess it's the SYSV (ack) machines that have problems, 'cause the scheduler's too sophisticated. Mark

1 0

Zimmerman legal fund
by anon-remailer＠utopia.hacktic.nl 17 Dec '03

17 Dec '03

I just received a bit of mail asking about the Zimmermann Legal Defense Fund, which, like many folks out there, I support. The writer implied that he might give money because I suggest it in my sig, but expressed questions about its legitamacy, and questioned if it's "just someone trying to exploit the Zimmerman case" Could someone in the know talk about the relationship between FV and the ZLDF? I don't like to spread misinformation, so I won't answer based on conjectures.

1 0

Re: Anti-Electronic Racketeering Act of 1995
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: danisch(a)ida.uka.de Hadmut Danisch writes: >I am not familiar with american laws and have two questions: >1. If the bill becomes law, how can someone who violates it be >punished? A criminal RICO violation can be punished by up to 20 years' imprisonment, as well as forfeiture of any personal or real property constituting or derived from proceeds of racketeering activity. A convicted RICO defendant can be fined up to twice the gross profits of the racketeering activity. If the defendant disposes of property otherwise subject to forfeiture, other property owned by the defendant (of equivalent value) may be seized and forfeited. 18 USC 1963. RICO also allows private parties injured by a RICO violation to bring a civil suit and recover three times their actual damages, plus attorneys' fees and costs. A criminal conviction will operate to estop a RICO defendant from denying the facts underlying the criminal conviction in a subsequent civil suit. 18 USC 1964. >2. Does someone who publishes software which encodes or encrypts >(ASCII is a code, isn't it?) have to prove that he has provided the >universal decoder to the state or does the state have to prove that he >didn't do? The defendant has to prove that s/he provided the decoder, because providing the decoder is an affirmative defense. That puts the burden of proof on the defendant on that issue. Were the statute worded that not providing the decoder were an element of the crime, then the government would need to prove that the defendant hadn't provided it. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtEm33YhjZY3fMNAQF/DQP/QOT1ZvMG/sCU2QnPpZVhHkAZrZf0R1AU 63QmxQTOZJvqhyvS70zrNmhW6mpXshQRpehQtMuUPDh7vtLS/FMatKaJc3yA+RXC 3vzLz3XNooOfM0fV6yIeVpZC5Nw5iMmyb/IwoVHLvAu7zYoGUi/sLoCW2s9xFa3M BmJkUL+/RaY= =fAVx -----END PGP SIGNATURE-----

1 0

Re: Anti-Electronic Racketeering Act of 1995
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: Andrew.Spring(a)ping.be Andrew Spring writes: >So I'm wondering who this RICO stuff applies to. The guy who wrote it and >uploaded it to an FTP site? He's not profiting. The guy who uses it? He >didn't commit the predicate act. Who? RICO does not require that either the enterprise or the predicate acts were motivated by (hope of) economic gain. _National Organization for Women v. Scheidler_, 114 S.Ct. 798, 127 L.Ed.2d 99 (1994) or ftp://ftp.cwru.edu/hermes/ascii/92-780.ZO.filt Looks like Bob Dornan wants to change that, though (probably because RICO was used to sue anti-abortion terrorists). He introduced HR 230 which would amend 18 USC 1961(5) to require "profit-seeking purpose" to establish a RICO "enterprise". THOMAS says that HR 230 is in the House Judiciary Committee. RICO is at http://www.law.cornell.edu:80/uscode/18/ch96.html et seq :) for the curious. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtASn3YhjZY3fMNAQFZ+AP/VLcDCikMkzT8iA/AmdpKvWpSc/nOybma /6KCnVgOms7+g+MNnJZHQFzjxV2oMjtXSZD1/0ZQeeuZcJGZDqR1tbwj93JNfRjW LsNHB9d5xXk9xxbvJwY+TJgCGeZtp7Yb38yVt2MRGioyl5TDPFNOYTbSPr2t0TCr 0k4aeV81Mq0= =m5jT -----END PGP SIGNATURE-----

1 0

Re: Here it is; bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Context: Bidirectional DCnets, Alice and Bob simultaneously transmitting to each other. Interesting approach, though you do have to schedule it somehow. It's a different take on the uses of DCnets - the original was for an anonymous-1 to many rather than a 1 to 1 with only the two participants knowing, though in the first case the recipient can be known only to the sender if they want to arrange things that way through shared secrets or whatever. At 01:31 PM 7/17/95 +0100, Rev. Mark Grant wrote: >Yes, but presumably it's expected that they would be using secure >encryption on the messages that they're sending. That might still provide >some information about the message for traffic analysis, e.g. if you send >a PGP message you have your key-id at the beginning, and if you knew the >keys of all members of the DC-net you could XOR them and see who's >talking to who. Presumably people will use multiple key-ids on the net as well - Alice may have a general-use "Alice" key, and maybe also a general-use "Medusa" key, but Alice or Medusa may have also arranged with Bob to use a different key for traffic where he doesn't mind if she knows he sent it and he doesn't want anyone else knowing it's being sent to her. Also, he can do this anonymously, so she doesn't know either: Alice posts Plaintext("Hi, I'm Alice, key AAAA") Bob posts Encrypt(AAAA, "Hi, Alice, I'm Dr. X, Key XXXX, please post a key I can use to talk to you") Alice posts Encrypt(XXXX, Signed(AAAA, "Hi, Dr. X, use key AXAX")) Bob's message lets him send stuff to Alice without anyone, including her, knowing it's from him, since the name X and key XXXX are new randoms. Alice signs her response so Dr. X knows that key AXAX will really go to Alice and not to Mallet who's impersonating Alice; she doesn't really care who X is. If traffic analysis is a concern (Alice noticing, for instance, that she's getting a _lot_ of requests from key AXAX for her remailer to send stuff to destination ZZZZ), Bob can keep sending her new requests for keys and ids, and not reuse them more than he thinks is safe. >I'd have thought the most significant problem would be reserving the >blocks in an anonymous fashion while not allowing denial-of-service >attacks. Since anybody can send bits at any time, and nobody can tell who without lots of collusion, you can't prevent denial-of-service (well, I assume not, unless there's something rather non-obvious in the literature.) The Bad Guy can decide if it's more fun to jam the reservations or the messages. What reservation does for you is gives a short inefficient period (with possible collisions, backoff-and-retry, etc., depending on algorithm) that you can use to reserve a longer one-user period for message traffic, so you can spend most of your time talking instead of haggling over interruptions. One way to do reservations is to use some variant on Slotted Aloha for the reservation period - for example, everybody picks a random id number for the session, (with odd parity or odd high-bit to make collision detection easier), waits a random number of slots, and then sends their id number. If there's a collision, wait and retry, maybe with exponential backoff. After the first slot that's got data and looks like it doesn't have a collision, anybody who thinks that it was their number picks a different number, waits a short random number of slots and posts; first one wins. (If you're using 32-bit randoms and have fewer than a million players, the chances of two undetected collisions in a row are really small, even if people cheat a bit on their backoffs.) Winner announces how many slots he's going to use up for his message, so you know when to start again. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

Re: Anti-Electronic Racketeering Act of 1995
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 06:06 PM 7/17/95 +0200, Hadmut Danisch wrote: >1. If the bill becomes law, how can someone who violates it be >punished? Only by violating the Constitution and basic common sense, but that doesn't usually bother the Government very much... >2. Does someone who publishes software which encodes or encrypts >(ASCII is a code, isn't it?) have to prove that he has provided the >universal decoder to the state or does the state have to prove that he >didn't do? It's not defined in the law, and if the good Senator writes stupid offensive laws which are so stupid that they have big holes in them like this, I don't intend to correct him :-) >In the former case, does he get any receipt from the department of >justice and what does the receipt say (1.3MByte of software >received...)? Nobody knows. >In the latter case, how do they want to prove he didn't? If he gave >just a big > for(i=0;;i++) try_key(i); >how do they want to prove this doesn't work? [... halting problem...] The proposed law doesn't say that the mechanism has to decrypt the message in a short period of time. If the law passes, I'll be happy to help write the PGP Universal Decoder program for anybody who needs it to take to court. Some kinds of program are affected by the Halting Problem; other kinds are easy to show that they halt. For the PGP Universal Decoder, trial division can find the factors for an N-bit key in much less than 2**N tries, if you program it well, and you know it will halt by then, if the Universe hasn't decayed first. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Root Causes Roots
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 02:08 PM 7/17/95 -0400, Jim Ray wrote: [ Crypto timeline and discussion omitted ] >Careful thought reveals a atrong suspicion that the "3/5ths people" >[slaves] had more use for crypto at the time than free white males >did, but I doubt much, if any, evidence of that activity was >preserved, and I'm sure it was _forcefully_ discouraged if ever >discovered...My point is, slaves, or those who live in fear of >eventual slavery, for whatever reason, have a strong affinity for >cryptography. Note, for example, early use [mentioned in the timeline >above] by the Jewish people. Or, more precisely, they have a strong affinity for private in-group communications. Cryptography's a bit tough in an environment where it was often illegal to teach slaves to read. On the other hand, oral cultures are often good at using metaphor and in-jokes and shared knowledge to express things that the speaker doesn't want the oppressive group to understand. I've seen commentaries talking about that in North American black culture, and there are other examples like Cockney rhyming slang. And then, of course, there are totally incomprehensible communication systems like Gaelic :-), which the Brits tried hard to stamp out. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 09:07 PM 7/17/95 -0400, tim werner wrote: >>... I was talking to one of the sys admins at >>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>because Viacrypt owned the commercial rights. Actually, it's less clear than that. It's pretty clear what you can do with ViaCrypt code; just read the license to see who can use it, and you can send any kind of messages you want over it, even for money. On the other hand, the definitions of "non-commercial use" for RSAREF and IDEA are far less clear (and they're clearer for RSAREF than for IDEA, and I got the impression from what I read somewhere on the net or in the PGP docs that the initial permission from Ascom-Tech for use of IDEA with PGP was pretty informal, and that they've been trying to tighten up what's covered.) (Also RSAREF licenses have changed from version to version, and the license PKP uses to distribute versions of RSAREF may also have changed?) Selling software containing the code is pretty clearly commercial. Non-commercial messages from your personal non-business machine are clearly non-commercial. Providing a service of encrypting and decrypting messages for people for money sounds like it's _very_ probably commercial. Encrypting and decrypting messages to/from your business that deal with money are a very gray area. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 12:24 PM 7/17/95 -0500, Phil Fraering wrote: >I'd also like to point out that this system indicates that during >an attack/disruption on a traditional dc-net, the disruptor can >tell what the original person was trying to send, even though noone >else can. > >And then perhaps XOR the data with something offensive, and if the >original sender tries to re-send, broadcast the result of the XOR, >resulting in a total net output of the offensive material. That's difficult - you have to identify that the sender is sending the same message while the message is being sent, rather than one or two bit-times later, and you can't fake encryption with an unknown keyid or digital signatures. (Digital signatures aren't something everybody would use very often on a DC-net, since the purpose of the net is to be anonymous, but since you can do anonymous broadcasts, you can anonymously post a signature key for your nym if you want to.) Also, there's no need to combine jamming and posting an offensive message; they both work well separately. I suppose you could do that if you only want to harass the net a bit (e.g. replace all trafic to remailer X with new remail to whitehouse.gov, or replace all postings from Cancelmoose with complaints about censorship), but basically DCnets degrade rapidly if the social structure of the net members does. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

SurfWatch for employees (ugh)
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Consistent with the trend towards treating employees like children, Webster Network Strategies has announced (but apparently has not shipped) a product similar to SurfWatch but aimed at an employment environment. The product is called "WebTrack" and supposedly supports access lists of URLs, where access can be allowed to "all but these sites" or "only to these sites". The product also can be configured to log all Web usage by users subjected to its reign of terror. :) WebTrack is priced at $7,500 with an annual subscription to its list of interesting (err, forbidden) sites priced at $1,500. The article in the 7/10/95 Infoworld doesn't list contact information for Webster Network Strategies. What is it, two months between deployment of software designed to restrict net access to one segment of the population perceived as especially vulnerable and the subsequent application of that technology to other target groups? My bet is the next target group will be university students, followed by "affinity marketing" with various repressive organizations (whose names I elide in the interests of greater Cypherpunk harmony, pick your own and imagine them here.) Of course, the next step is to use restrictive licensing/distribution terms (a la Netscape/Mozilla) and a nifty freeware/software package available only from a site which also carries porn (or other forbidden fruit) to make the customers/purveyors of this crap twist in the wind a bit. Break the terms of the license and get the software somewhere else? Avoid using the coolest new thing because you're hooked up via we'll-think-for-you.net? Doh. (Pedants need not point out that personal choice (and personal filtering) are always appropriate, and indeed empowering. Neither WebTrack nor NetSurf are marketed to help people subject themselves to a regime of repression - they are intended and sold to allow the purchaser to control what others (perceived as having fewer or no rights) will read and view. ". . inasmuch as you have done it unto one of the least of these my brethren, ye have done it unto me." Matthew 25:45) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtWUn3YhjZY3fMNAQH8EAP/aFXe7uI1EuIB31L8h7H+5l3Mg1aQE7e9 i86FnqwGMDg5JlDvJD05dXOBXeInvKtc6ZD0Us+qwDmg2ISo/Yu0QCfedTBgZ7fq s/3WFwtOcpiBG7YTkxGJrvB+r4KIgodb9QSGEQ8yofKaRLT33IkgO3ijxrnyoNkX vm/tZ8EnoV0= =hrOo -----END PGP SIGNATURE-----

3 2

Re: "Judgement Proof" and Putting Up or Shutting Up
by an250888＠anon.penet.fi 17 Dec '03

17 Dec '03

>> >and, conspiracy theories non-withstanding, we the people do not govern >> >America --we are only given a short list of politicians who have sold >> >their soul to CFR's satanist inner circle. >> >> What's CFR? >> > >Council on Foreign Relations. or Code of Federal Regulations. ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

WebTrack URL/Contact Info
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

The WWW site for Webster Network Strategies and its WebTrack software is http://www.webster.com/ According to that page: How to reach us: E-mail info(a)webster.com Call (941) 261-5503 Fax (941) 261-6549 Write to WNS, 1100 5th Avenue South, Suite 308, Naples, FL 33940

1 0

SurfWatch for employees (ugh)
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles <greg(a)ideath.goldenbear.com> writes: > Consistent with the trend towards treating employees like children, > Webster Network Strategies has announced (but apparently has not > shipped) a product similar to SurfWatch but aimed at an employment > environment. The product is called "WebTrack" and supposedly supports Forcing workers to keep their minds on their work? Shameful... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu7mN74r4kaz3mVAQEWhgP9FDkAtsbPMVk5/FTCGaImFu7Iqllw0Y55 Rv2gXxVdiYKmK449i1+PQhJvpnLJE5qVRqMeCjhcysrbI/WK9RUDP+6FVenfDjWZ Kxh385qzNWE1sJTv92ii3g4dbIp7yziePJc9ZH6HqZ9i1MAyQfjEPutNcE5xgLSH hBUYN0Q1cPE= =l0BB -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jgrubs(a)voxbox.norden1.com (Jim Grubs, W8GRT) writes: > As I recall, the following is a correct scenario: a customer can use PGP to > send credit card numbers to a vendor he's making a personal purchase from, > but the vendor must use Viacrypt. If the customer is buying something to use > for business, BOTH must use Viacrypt. In practice, I'd probably buy Viacrypt for legal reasons but use PGP anyway. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu5iN74r4kaz3mVAQF11QQAiNccy69sb5OA1jmOpErqqZNJ4sNx3smW tAJQ3lD1op4qlPIO48vxwkvr+IaQyyOkf797+9Ca1z9WtxgwSamo32BQnPQZ6Pbm Vipmpwrabrxq67TOrGgxNp3UN7oBZl3eyad0hIj6ENzs8u1wi3wkHUV/3z341XB7 u953orkOZSk= =UYrt -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

4 3

Mondex (forward)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Thought this might be of interest... forwarded with permission.. >From Andy Meredith (meredith(a)bcs.org.uk) on the ecm list : On Jul 18, 9:21am, Marcel van der Peijl wrote: > Subject: Re: e$, c$$$, Cyberbucks & ECash - terminology. > > > electronic cash (also digital cash) is a general term for > > > the concept of encrypted messages that have inherent value > > > - as opposed to credit notes or electronic checks. I guess > > > that the Mondex smart cards have ecash in them, but that > > > seems different. > > I am such a bad reader! You are right. This is a good definition > of electronic cash or digital cash. Mondex is questionable. The > card has an account, and uses crypto to proof it is a real Mondex > card, so you'd better believe it when it says it took the money > of it's internal balance. I would vote this is not digital cash. I am participating in the Mondex pilot scheme in Swindon. It took me a great deal of pushing to get _any_ details at all. The details I did get didn't go into the encryption schemes used or any such fun stuff. It did in fact take quite a while for me to realise the significant differences between ecash and Mondex. As they didn't, in the end, make me sign an NDA, I guess I can share. 1 - The Value is not encrypted on the card, that is held as plain text, it is the front door on the card that is heavily guarded. If therefore you can inject value into the card from the back door, it is then taken as real money. The logic being; Hey it managed to get through all that security which is imposible for anything except another mondex card to do, it must therefore be Mondex money ... that's Ok then. There can never be a software only version of Mondex as it stands. The trust is in the front door, not the cash values themselves. 2 - Some of their transaction monitoring is very "Big Brother"esque. As you can imagine, if a card is seen to be creating money but not consuming it, there IS a problem. Therefore whenever you get some money from a "hole in the wall", the bank sucks over your transaction log & error log. It will of course only ever use this for security monitoring. It will never follow the likes of AMEX and start stock pilling these transactions, using it's knowledge of the which physical entity own what card ID, and using the cross reference for market research/direct mail/consumer profiling. No of course not. That would be TOTALLY unethical ... 3 - Mondex is billed as "Electronic Cash", but you won't find the concept of anonymity in there anywhere. They talk about it, but I haven't seen them write it down explicitly. One could suggest however that that "Cash == Anonymous", so the scheme would have to be anonymous for them to have a right to the "Electronic Cash" title. > So what is the name for schemes like this? How about "Stored Value Card" >-- End of excerpt from Marcel van der Peijl One interesting thing that I noted. When I read through the technical blerb on ecash a while back, I had to sit back and think very clearly, and read very slowly. However, it was relatively easy to understand the bits, and then even easier to put the bits together into a system. The reason, I suggest, is that if you understood all the encryption technology behind ecash, and had the requirements that it has for anonymity and security (hand in hand). You would reinvent ecash. Maybe the layering would be subtly different, the real one ond your independant derivative wouldn't interact, but ... If however you were to have asked me to explain ecash a week later, I would have been totally stumped. It is a very elegant system. Mondex, on the other hand, worried from the word go. It just didn't seem to add up. Apart from everything else, why were they being so damned secretive. I read and thought, and read and thought. Then it finally dawned on me. Mondex just simply doesn't have the same requirements list as ecash. I was prejudging the requirements from my previous exposure to ecash. Ask me to explain Mondex to you now ... what do you want to know :) Andy M (this is my opinion of information gained outside of company time. It is not the opinion my employer.) And : On Jul 18, 12:29pm, Marcel van der Peijl wrote: > Subject: Re: Mondex > > I am participating in the Mondex pilot scheme in Swindon. It > > took me a great deal of pushing to get _any_ details at all. > > Of course! Security through obscurity has always been a good way of > protecting your systems... ;) Absolutely. That's why VISA have lost so little money :) > > 3 - Mondex is billed as "Electronic Cash", but you won't find the > > concept of anonymity in there anywhere. They talk about it, > > but I haven't seen them write it down explicitly. > > Hahahaha. Let me explain. You can buy the card anonymously. This > gives anonimity.... > NOT! Actually, you can't. You need to supply bank details in order to get one. At least you do for the Swindon trial. The cards in use here are in fact combined ATM and Stored Value ;) cards. They have all your bank details in a mag. stripe on the back of the card. The current batch of EPOS terminals don't use this stripe, but I wait with interest. > They are forgetting that tracebility plus one link of a person to an > 'anonymous' account is the same as identification. Sainsbury's (et al) sussed that one a while back. Hence the introduction of "Customer Loyalty Cards" (yuch!!). Thereby allowing them to bind purchases/times/locations => Credit card numbers => Physical customer addresses & therefore demographic data. Only in this situation for Credit card number read Mondex card ID. > Do you realise any ATM, and a lot of stores, have security camera's > embedded? No, they wouldn't use that to link a person to a card, > would they? That would be unethical... No need. They have not only formed the link, but they are getting you to fill in the damned form :) > > How about "Stored Value Card" > For Mondex, perfect. What about FV? And NetChex? Don't know about these ones. > About your perception of ecash: I admit that the blurp on our server > does not fully cover the system in such a way it is easy to remember > and explain. Not at all. If you had asked me to explain the system while it was still fresh in my mind, I would have had no trouble. It is very neat and logical, but it is also pretty intricate. Apart from anything else, I didn't feel it was necessary to hold on to the mental model of how it works. I liked it. However, Mondex ... >-- End of excerpt from Marcel van der Peijl Cheers Andy M

1 0

AYN_ran
by John Young 17 Dec '03

17 Dec '03

The New Yorker, July 24, 1995: "Twilight of the Goddess." A critical look at Ayn Rand and her work. Thirteen years after Rand's death, her books still sell more than three hundred thousand copies a year. Not since the popular novels of almost a century before, bent on refutations of Darwin or God, and offering what George Eliot called "a complete theory of life and manual of divinity, in a love story," had there appeared so vividly accessible and reassuring a guide for the cosmically perplexed. As late as 1991, the Library of Congress found that a majority of Americans surveyed named "Atlas Shrugged" as the book that had most influenced their lives, after the Bible. AYN_ran [About 57K, in three parts]

1 0

Re: S. 982 Kyl-Leahy(-Grassley) NII Protection Act
by Carl Ellison 17 Dec '03

17 Dec '03

I read it and it looks OK -- except, as I said in e-mail to Senators Kyl and Leahy, we can't let ourselves believe that legislation can keep computers safe from hackers. Many of these threats are outside the reach of US law. Instead, we need good firewalls, encrypting file systems, etc. - Carl

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Peter Trei 17 Dec '03

17 Dec '03

> I remember one of the sponsors of the CDA ranting about pornographers > "profiteering" from pornographic images on the Internet, blissfully unaware > that stuff downloaded from alt.sex.binaries.insert.your.fetish.here doesn't > profit anyone but the phone company (for the hours you stay online to get > it). I called up Exon's press secretary and asked him about this. He claimed that BBS's were uploading advertisments to the Net, and this was the 'profiteering' referred to. He was immune to reason on this, and felt that the CMU 'study' was rigorous. It's true that a some of the pics in those groups include stamped-in BBS names and phone numbers, but my impression was always that this was the BBS operators trying to do a little damage control - so that when random users post their pix (on which they claim copyright, ignoring the fact that most of their scans rip off magazine publishers), they can recognize the 'piracy', and also earn a little publicity. For a good backgrounder on the story, check http://www.cybernothing.org/cno/reports/cyberporn.html Peter Trei ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: Zimmerman legal fund
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

> >I just received a bit of mail asking about the Zimmermann Legal >Defense Fund, which, like many folks out there, I support. The writer >implied that he might give money because I suggest it in my sig, but >expressed questions about its legitamacy, and questioned if it's "just >someone trying to exploit the Zimmerman case" > >Could someone in the know talk about the relationship between FV and >the ZLDF? I don't like to spread misinformation, so I won't answer >based on conjectures. > I had similar concerns last month, so I emailed the following to csn.net!dubois ("Philip L. Dubois") > > Could you please inform me of the financial status of the fund > raising for the Phil Zimmerman case? How much money has been > collected, and how much has been spent, and what are the future > anticipated expenses? I might like to contribute, but "a normally > unreliable source" has claimed to me that something on the order of > $50,000 has been spent, and there is not even an indictment yet. > Is this true and is this reasonable? Is it true that some/all of > his legal services are being done "pro bono" (I hope I got that phrase > correct, maybe I should just say "for free") > > If you choose to reply, may I have permission to make your reply public? > > Rick F. Hoselton (who doesn't claim to present opinions for others) > I got back the following reply: > >Mr. Hoselton-- > >Since the government has not yet decided whether to indict Mr. Zimmermann, or at least hasn't >told us its decision if it has made one, we continue to accept donations to the Zimmermann >Legal Defense Fund. I've never added up the total amount of all donations to date, but I >doubt that it would be in the neighborhood of $50,000. I can tell you that several lawyers >have been working on the case and that all of them but me have done so pro bono, which means >that they have not been paid. Since I have been lead counsel and have therefore had primary >responsibility for the defense, I have not been pro bono, at least not entirely; I have not >billed for much of my time. We have no way of knowing how long this case will go on. The >government could tell us today that it won't indict, in which case it will be all over, or it >could indict very soon, or it could do nothing until June of 1996 when the statute of >limitations expires. > >You have my permission to make my reply public. > >Philip L. Dubois >Counsel for Philip Zimmermann > Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0