December 2003 - cypherpunks-legacy

The Anti-Racketeering fiasco meets Mozilla
by roy＠cybrspc.mn.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I was just talking with a friend, and had the most vile thought. Mallet works part time for the Justice Department. His job is entrapment of random individuals. He has a Web server running the Netscape Commerce Server. When a potential victim is lured into looking at Mallet's home page with Mozilla, the poor sap is rewarded by a server-side push of some small piece of contraband software. Many victims will simply move off the page, forgetting that the document is now in their Netscape cache. They're toast. Others might clear their cache, but the server still shows that the file was sent. They're now guilty of both receiving and concealing contraband. And maybe destruction of evidence and/or interfering with law enforcement. I'm only raving like this because the whole Anti-Racketeering bill has me both scared and really pissed off. - -- Roy M. Silvernail [ ] roy(a)cybrspc.mn.org PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)cybrspc.mn.org -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAWbGBvikii9febJAQExKgP9HApgUEHkIaABuiQ/Lx4jfcfG6WUT7r6U TgiQ83+yvYBt2EeWIlF3uqUN4PEO8cLYsDjthpesI8nDV2HpjTCbiZ0g+zGJlOmi ps8vfRRK0A8elyCkTy2b4NlwR4Kre6iqYJfr9+ZA1rW019ZfvullZw9TAPDrhfLj cP780NHfhn4= =sRJY -----END PGP SIGNATURE-----

1 0

Re: HR361
by Rich Salz 17 Dec '03

17 Dec '03

Has anyone previously noted that HR361, the omnibus export administration act, would require the administration to assess the impact of the current crypto export controls on the software industry? I don't recall seeing mention of it, but this has been planned for awhile. There were a couple of crypto surveys, one by private industry (software publisher's association) and one by TIS for the gov't. I think. Both were mentioned in this list. /r$

1 0

Re: Anti-Electronic Racketeering Act of 1995
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Weld Pond <weld(a)l0pht.com> responding to Duncan Frissell <frissell(a)panix.com> <good discussion snipped> wrote: >That raises an interesting issue. <good discussion snipped> >Will they have to invent a huge new bureaucracy >to manage all these devices and programs? Talk about a self-answering question...How else could it be done? >There are many problems with this idea of >Government Access to Devices or Programs (GADOP). I can think of only one problem with the idea, it's called the Bill of Rights. [If there is anything left of it after this session of Congress.] >A toolset that could build many different encryption >and decryption variations based on psuedo-random input >may be a good tool to fight this nonsense. Agreed. As well as steganographic software of many kinds to hide this terrible "crime" we all love to commit, for the peace loving among us... BUT [and I hope this doesn't happen.] I fear that the anarchy resulting from this kind of statist idiocy will lead many (otherwise peaceful) folks to think that the only good tool to fight this nonsense is a good shotgun. Of course, then we can simply outlaw those, too. <good discussion snipped> Regards, Jim Ray - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh iQCVAwUBMAVlCG1lp8bpvW01AQEkAgP/doDZKY1TKgBJPy7ame16kbqU0F+BOfl/ wuIkpnsnsoyyV6Fi7KzHPLGsZU+uuMjdxLyOhtmvswKAfq6XU68GTfHuCCImiE8D 6RuaPWkn+eAQmVhXrbmf2ykZwWrnLZ4sT12eyNQjKoavuxTgFPGFqbvIASnIwe/E OLBNyviUOSA= =M7wP - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAV0pSoZzwIn1bdtAQFPDgGAu5kR4N1OlOm++LZZX4AAraYFbcgwhRiq qN7x31Enfv4Gaocg0m4TmB4YYdJxyzht =WV8f -----END PGP SIGNATURE-----

2 1

Re: Fight, or Roll Over?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 10:41 AM 7/13/95, Douglas Barnes wrote: >Since the Anti-Electronic Racketeering Act of 1995 might as well >be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see >Tim throw in the towel already, when the bill hasn't even made it >through committee yet. I'd hardly call my view "throwing in the towel." What I said clearly enough was that the Washingtonians can throw out repressive legislation much faster than we can--and I speak in terms of "we" as being the EFF, EPIC, NRA, ACLU, etc., and _not_ the Cyherpunks, who have no lobbying activities to speak of. >Go underground? Well, as I read it, this bill basically makes >cypherpunks a "corrupt organization", subject to the full >impact of the RICO statutes. With the passage of this bill, we Indeed, this law makes the Cypherpunks group a co-conspirator. (In the same way that the recent Omnibus Anti-Terrorism (or whatever it's callled) criminalizes groups which support This Year's Enemies. (Like the War with Oceania--or was it Eurasia?--the friend of today was yesterday's criminal organization. For example, the Omnibus bill makes support of anti-PLO groups a crime, for foreigners, as the PLO is now, this year, our "Partner for Peace.") >will have the same status in the US as the neo-Nazis have in >Germany, and will have to adopt similar communications and >organization techniques. Who knows, maybe this is the best thing >that could happen, although I'm real curious about who will >back off to protect their ass-ets and who will actually keep >on chugging towards crypto anarchy. > >In the short term, I've renewed or started memberships in the >organizations that are likely to fight this -- but I'm also >fired up to get more easy-to-use software out there, and >do what I can to help build infrastructure that can resist this >sort of nonsense. This is all I'm suggesting, that yet another round of trying to persuade Congress people is a waste, and that the _traditional_ focus on technology is a better use of our time and effort. Others are welcome to do as they wish. I'm just expressing my view that Washington can spin out legislation faster than we can respond....they are, after all, using our tax dollars to generate new laws, and have intelligence agencies and law enforcement agencies on their side with armies of lawyers and lobbyists to help. Multi-billion dollar budgets are also at stake. The lobbyists for preserving liberty are few and far between. Some would say this means Cypherpunks should step into the fray and become a lobbying group. I don't see us as having the structure or organization to become such a group. Those who wish to should probably form a real group to do this, with bylaws and elected officials. Anarchies are great, but there's no way an anarchy can have a "spokesman," or a budget for travel and lobbying, or a hundred other things that a lobbying group needs. Cypherpunks--this list--is just not in a position to be this group. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Re: SSL RC4 challenge
by Hal 17 Dec '03

17 Dec '03

From: Hal <hfinney(a)shell.portal.com> > Here is a challenge to try breaking SSL using the default exportable > encryption mode, 40-bit RC4. > [...] It has been pointed out to me that I made a mistake in my analysis of the SSL packets. The MAC at the beginning of the encrypted packets is itself RC4 encrypted. That means that the 17 bytes of known plaintext start 16 bytes into the stream, not at the beginning as I thought. This just means that after key setup, RC4 has to be cycled 16 times before we start comparing its output with the XOR of the known plaintext and ciphertext. I'll produce a revision of my "challenge". If no other mistakes are found I'll post it to sci.crypt. Hal

1 0

Re: Crisis Overload (re Electronic Racketeering)
by Connie Sadler 17 Dec '03

17 Dec '03

Subject: Re: Crisis Overload (re Electronic Racketeering) Date: Thu, 13 Jul 1995 12:27:18 PDT A1-type: DOCUMENT Importance: normal >On July 13, 1995, Robert Hayden said: >Unfortunately, a system of social engineering needs to be adopted to get >massive use of cryptography started. This means, and I advocated this >from the day I entered this forum, that programs such as PGP need to be >redesigned so that the a user friendly . . . so user friendly that any >Joe Moron can figure out not only how to use them, but also how it helps >them and how it is "good" for them. This means that we need simplified >key management easy enough for the point-and-click masses to utilize. >... >Unfortuately, all I can do is stand on the sidelines and cheer, because I >am not a programmer; I'm a user and a teacher. Well put! I agree wholeheartedly! I have friends who are mostly teachers and writers who are interested in encryption from what I've told them, but their computer knowledge is pretty much limited to their word processors. A good user interface would do wonders for spreading the use of PGP. Unfortunately I am not a programmer either, but I am being motivated to become one. If only there was more time... Connie

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <199507132116.VAA149322(a)smtp-gw01.ny.us.ibm.net>, jfmesq(a)ibm.net (James F. Marshall) wrote: > I haven't read the whole >bill, but I read the "regardless" phrase with a different emphasis. >In short, that language appears to mean that one could be pounded with >RICO for uploading crypto software even if the crypto is EXPORTABLE. The government doesn't want us to use any crypto that takes them an appreciable ammount of time to crack. It seems inevitable to me that such crypto will soon be outlawed. The same goes for anonymous remailers. It is only a matter of (very little) time. Yes, Black Unicorn is right. We need stealth encryption. Unfortunately even that won't help as much as one might think, because it can only be used by tight conspirators who are willing the to take the risk to be locked up in a concentration camp, I mean jail, for the rest of their lives. Crypto for the masses is about to fade away into history, before it ever really caught on. - -- - -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMAWlEyoZzwIn1bdtAQFIYwF+JKboVVw7qm+Ejyj0ecTp1EbqWL2YCAlb tL3RLDWA5VLcKakMh2nI3oZns0SLknGw =+fvE -----END PGP SIGNATURE-----

1 0

Re: Ssh security hole?
by Tatu Ylonen 17 Dec '03

17 Dec '03

(I'll forward your message to a couple of lists where it might be of interest; the original message is at end.) I think you are right in your analysis. There is indeed a problem with RSA authentication. Basically what this means is that if you log into a corrupt host, that host can at the same time log into another host with your account (by fooling you to answer to the request) provided that you use the same RSA identity for both hosts. A workaround is to use a different identity for each host you use. The default identity can be specified on a per-host basis in the configuration file, or by -i options. And, yes, I think the same problem might occur with client host authentication. Though, there you would still have to do IP-spoofing, DNS spoofing or similar to get through (breaking RSA based host client effectively reduces RhostsRSAAuthentication to conventional .rhosts authentication). The protocol will need to be changed somewhat because of this. I'll think about it tomorrow and let you say you opinion about it. Thanks! Tatu Ylonen <ylo(a)cs.hut.fi> Date: Thu, 13 Jul 1995 13:08:15 -0700 From: David Mazieres <mazieres(a)pa.dec.com> To: ssh-bugs(a)cs.hut.fi Cc: rtm(a)eecs.harvard.edu, dm(a)eecs.harvard.edu, tbl(a)eecs.harvard.edu Subject: Ssh security hole? I believe there is a serious problem with the RSA authentication scheeme used in ssh, but then again I could be misreading the proposed RFC. Is the following really the case? As I understand the protocol, here is what happens during SSH_AUTH_RSA authentication. Suppose the holder of SKu, is allowed access to account U on machine B (which holds SKb). Both PKu and PKb are widely known. In addition, machine B has a session key, PKs, which changes every hour. When U on machine A wants to log into machine B, here's what I think happens based on my reading of the RFC: A -> B: A B -> A: (PKb, PKs, COOKIE) [A flags an error if PKb is not the stored value.] A -> B: (COOKIE, {{Kab}_PKs}_PKb) A -> B: {U}_Kab A -> B: {PKu}_Kab [B aborts if SKu is not allowed access to account U.] B -> A: {{N}_PKu}_Kab A -> B: {{N}_MD5}_Kab (*) [B aborts if the MD5 hash is invalid.] B -> A: access to acount U with all data encrypted by Kab. The problem is, suppose U actually wanted to log into machine C, which was maintained by an untrusted person. The person maintaining C could initiate a connection to B the minute U tried to log into C. When given a challenge {{N}_PKu}_Kbc, C could simply give this to A as the challenge to respond to, and then forward the response to B. To fix the problem, A must at the very least include B in the response line marked (*). I have reason to believe (after having just seen a lecture on authentication), that you might even need to include more. A safe bet might be (but then again I am no expert): A -> B: {(N, A, B, Kab)}_MD5 I think similar problems arise for the other authentication methods. Other than that, though, I am really impressed by by ssh. It's easy to install and easy to use. In fact, it is even more convenient to use than standard rsh, because the X forwarding happens automatically. Thanks for such a great package! David

3 2

co-sponsors
by perry＠imsi.com 17 Dec '03

17 Dec '03

I searched Thomas and couldn't find any evidence of co-sponsors to the Senate bill. Am I wrong here? .pm

1 0

No Subject
by Kevin Stumborg 17 Dec '03

17 Dec '03

send me mail

1 0

speeding detected by civilians
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

hate to start another endless thread on speeding limits, but this is an interesting privacy anecdote... hope this hasn't been posted here. === From: "Steven M. Horvath" <horvath(a)comm.mot.com> Subject: Speeder's Beware of Vernon Hills, IL. To: snet-l <snet-l(a)world.std.com> - - -------- FYI------------------FYI--------------------FYI----------------- Vernon Hills, IL. Vernon Hills, Illinois, a Chicago suburb, has passed legislation allowing citizens to check out radar guns from the local police department to catch speeders in their community. The radar guns are combined with cameras in order to instantaneously capture the car, license number, and the rate of speed. The citizens can check out the units for a week at a time. The police have stated that they, at this time, will use the data to issue warning letters to the violaters. - ------- End of Forwarded Message ------- End of Forwarded Message

5 4

HR361
by perry＠imsi.com 17 Dec '03

17 Dec '03

Has anyone previously noted that HR361, the omnibus export administration act, would require the administration to assess the impact of the current crypto export controls on the software industry? .pm

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by jfmesq＠ibm.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >In the subsection that explicitly mentions crypto, it says that it's >unlawful to put (non-GAK) crypto on an open net, "regardless of >whether such software has been designated non-exportable". If the >phrase "nonexportable" means the same thing in the context of this >subsection, then provision (b) would only seem to apply RICO to stuff >that already falls under ITAR. Pardon me if I misunderstood your point. I haven't read the whole bill, but I read the "regardless" phrase with a different emphasis. In short, that language appears to mean that one could be pounded with RICO for uploading crypto software even if the crypto is EXPORTABLE. The part about subsequent instances of actual access to non-exportable crypto by foreigners, etc. appears to address a different situation -- the situation where the crypto is non-exportable. In this different and much more "defiant" situation, the language would allow the feds to count predicate acts, not merely according to the actual instances of uploading activity, but also according to the number of times the crypto is downloaded by foreigners, etc. Perhaps a 10,000 to 1 ratio? It is unclear, not having read the entire bill, whether the onerous provision in the case of non-exportable crypto would apply in the case of exportable crypto. Perhaps our resident federal prosecutor might volunteer some insights into how the government might prove thousands of predicate acts, and thus a huge pattern of racketeering activity, as a result of a defendant uploading non-exportable crypto once to one site, and how the government might argue that uploading exportable crypto once to one known mirrored site (e.g., hobbes) would constitute uploads to all the mirrors -- i.e., multiple predicate acts. This email is academic speculation. This email is not legal advice, is not a consultation with counsel, and does not create an attorney- client relationship. (As a condition of entering into an attorney- client relationship, I require a formal, ink-signed fee agreement.) - --Jim -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAVmsEK9bzU1tDCZAQGOcAP/StGc/+/sbRCZLRJTwnhMGtda3Z7tYQ6G QhllCCwGZ0gddwtCmH98hQaQLAbGaFyaUd4SroM3bj3/NXX2xFucnY9ogPN2LHS9 9MZ/RzBO33iVjl/F0fHAIJiCnGCkHM58Gftgtg7gyOKCs+wBkJNQgOxsuuxw2rSs /nlYAv+ukN8= =wCJA -----END PGP SIGNATURE-----

2 1

Encryption and ITAR
by It's supposed to crash like that. 17 Dec '03

17 Dec '03

Anyone know how far ITAR reaches? Is there a list of programs that are illegal to take from america anywhere else? My company does a LOT of buisness (80%) outside the US, and I wonder if they are maybe pissing off the NSA or somthing with some software they take with them. (a DES encrypter, and some other encryption stuff)

1 0

Fight, or Roll Over?
by cman＠communities.com 17 Dec '03

17 Dec '03

Since the Anti-Electronic Racketeering Act of 1995 might as well be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see Tim throw in the towel already, when the bill hasn't even made it through committee yet. Not that I place a lot of faith in our elected officials, but this bill seems to step on so many toes, and to be so plainly idiotic, that we are bound to get some support from unexpected quarters. Nothing surprised me more, in fact, than all the mainstream IS magazines (like Information Week) denouncing the Exon ammendment. This, though, is a much more subtle and insidious bill, and takes away something that most people don't even know they want yet. (The Exon ammendment, on the other hand, could have been dubbed, "The Cypherpunk Market-Creation Act of 1995.") Nevertheless, it is certainly possible to fight this bill and win, while at the same time, preparing to go underground if it passes. Go underground? Well, as I read it, this bill basically makes cypherpunks a "corrupt organization", subject to the full impact of the RICO statutes. With the passage of this bill, we will have the same status in the US as the neo-Nazis have in Germany, and will have to adopt similar communications and organization techniques. Who knows, maybe this is the best thing that could happen, although I'm real curious about who will back off to protect their ass-ets and who will actually keep on chugging towards crypto anarchy. In the short term, I've renewed or started memberships in the organizations that are likely to fight this -- but I'm also fired up to get more easy-to-use software out there, and do what I can to help build infrastructure that can resist this sort of nonsense.

4 5

Re: SSL RC4 challenge
by Jonathan Shekter 17 Dec '03

17 Dec '03

Quoth tedwards(a)src.umd.edu: >On Wed, 12 Jul 1995, alex wrote: >> Can't we hold off a few weeks on this, so that we can all short the stock >> once it's been offered? <g> > >Hmm...well, considering we have yet to break the first 40-bit RC4 key >(with 87.1 of the keyspace searched), I think it might be a bit early to >make financial decisions based on our cracking abilities. Yes, but it is highly unlikely we have a valid plaintext/cyphertext pair. Since the format of SSL is known precisely, we won't have this problem. But, yes, let's break the example SSL transaction first. - Jonathan -- ____________________________________________________ / Jonathan Shekter / / / Graphics Hack / "Probability alone / / Alias/Wavefront / dictates that I exist" / /______________________/____________________________/

1 0

private idaho
by steven ryan 17 Dec '03

17 Dec '03

I am trying to run Private Idaho. I tried the 2.1 version as well as the new beta version. I have all the files in the same directory as PGP. When I create a message and select clear sign it spawns a dos box that is all black with the cursor in the top left corner. If I hit return it closes the box and gives the following message: File not found in the sign routine, couldn't create output file. Any ideas on what might cause this or pointers to additional information would be welcome. Steven Ryan sryan(a)reading.com

1 0

Re: Fight, or Roll Over?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 10:10 PM 7/13/95, Robert A. Hayden wrote: >On Thu, 13 Jul 1995, Douglas Barnes wrote: > >> Since the Anti-Electronic Racketeering Act of 1995 might as well >> be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see >> Tim throw in the towel already, when the bill hasn't even made it >> through committee yet. > >I don't think Tim threw in the towell on this bill, but has come to >realize that the overall war on privacy cannot be won by concentrating on >the individual battles. We've ALL got to take a deep breath and come up >with a different plan of attack; a plan that the TLAs and spooks will be >unable to defend against. Right now, as long as we're kept busy with >individual bills and initiatives, they have us just where they want us. Exactly! By causing us to go into paroxysms of activity every time they throw a new piece of legislation over the transom, we dissipate our efforts in more promising areas. There's a place for lobbying--and I'm even a member of the EFF. But lobbying is best done by those with lobbying backgrounds, legal backgrounds, and a penchant for fund-raising. There was once talk, in April of '93, about the Washington, D.C. Cypherpunks group adopting "lobbying" as their own special focus area, with educational visits to Congressional aides and attendance at crypto-related hearings. Nothing came of this, for whatever reasons. Why do I mention this? Most Cypherpunks live far from Washington, and our influence is minimal. Few can travel to D.C. on even an occasional basis, etc. (Ironically, EFF is evacuating D.C. I won't get into what their reasons might be, but certainly they will now have even less effect. I'll say one thing: the leaders of EFF may have realized what a trap lobbying can become, and have chosen to instead focus on other areas.) Anyway, Cypherpunks is a worldwide, technological-oriented group. We can do more by spreading technology and undermining repressive legislation than we can by being just another ineffectual lobbying group. As I said in another message, if folks want to do it, fine. Organizationally and financially, we are not equipped for lobbying. No budget, no leadership, no bylaws, no tax filings, no report writings, nothing. (Some of these things are important for lobbying, some are less so. The "leadership" part is pretty important: who could claim to "speak" on behalf of Cypherpunks? Nobody.) I suggest a different organization, a different mailing list, for this effort. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

2 1

Checkfree/Cybercash Press release
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Date: Fri, 14 Jul 1995 03:42:07 -0700 >From: Davidwfox(a)eworld.com >To: www-buyinfo(a)allegra.att.com, e-payment(a)bellcore.com >Subject: Checkfree/Cybercash Press release > >CHECKFREE AND CYBERCASH JOIN FORCES TO DELIVER COMPREHENSIVE ELECTRONIC COM > > Consumers can conduct Internet transactions using checks, > credit cards or cash > > BOSTON, July 13 /PRNewswire/ -- Checkfree Corporation and CyberCash, >Inc. announced today at the Interactive Services Association conference >that they will cooperatively develop and market products and services >that will allow consumers to safely conduct payment transactions, in >real time, over the Internet using credit cards, debit cards, checks or >cash. > Checkfree, the nation's leading provider of electronic commerce >services, will license technology from CyberCash, a leader in secure, >end-to-end Internet payment systems. Checkfree will integrate >CyberCash's high level security features and ability to conduct cash >transactions into the Checkfree Wallet(TM), creating a single solution >for electronic payment transactions that offers checks, credit cards, >cash, coin or micropayments. > "Partnering with CyberCash was the logical choice for Checkfree," >says Pete Kight, founder and CEO of Checkfree. "Checkfree is committed >to leading the way for electronic commerce, and providing plug and play >Internet transaction solutions. The Checkfree Wallet(TM) is now an even >more attractive transaction platform for both consumers and merchants." > The Checkfree Wallet(TM) was introduced in April to allow consumers >to purchases goods and services from on-line merchants in a safe, >convenient and familiar manner. The Checkfree Wallet(TM) does not >require prior registration with merchants, and on-line shoppers pay no >fees or transaction service charges. With the addition of CyberCash's >technology consumers will be able to utilize cash securely over the >Internet and merchants will receive authorization in real time. In >addition, merchants will be able to accept payments from any on-line >consumers, regardless of the server or browser they are using. > "Checkfree's long, successful record of developing applications for >home banking and electronic bill payment is a perfect complement to >CyberCash's secure Internet transaction and electronic cash expertise," >said Magdalena Yesil, vice president of marketing for CyberCash. >"Together we can offer a complete array of payment tools that allow >consumers to conduct spontaneous transactions and pay bills via the >Internet." > Checkfree and CyberCash will focus on developing products that can >be easily integrated into any browser system and merchant server. The >new Internet transaction product offering, which will be co-branded by >Checkfree and CyberCash, is scheduled for release this fall. The >product will initially be available free-of-charge via NetCom's >NetCruiser Internet browser as well as other leading Internet browsers. >Merchant interest to date also includes ID Software, the developers of >Doom(TM). > > About CyberCash > CyberCash, Inc. of Reston, Virginia, was founded in August 1994 to >partner with financial institutions and providers of goods and services >to deliver secure Internet payment systems. The CyberCash approach is >based on establishing a trusted link between the seeming unpredictable >world of cyberspace and the traditional banking world. CyberCash serves >as a conduit through which payments can be transported easily, safely >and instantaneously between buyers, sellers and their banks. > The CyberCash system operates on top of any general security system >such as SSL or Secure HTTP. CyberCash beta software is currently >available free-of-charge and can be downloaded from the company's WWW >server at http://www.cybercash.com. The company's initial service that >accepts payments using any major credit card is scheduled for full >commercial deployment this summer. Electronic cash services are >expected by the end of 1995. > CyberCash's principal founders, Bill Melton and Dan Lynch, have >brought together a team with unparalleled experience in credit card and >debit card automation, internet telecommunications and security. In >April, CyberCash was chosen by Interactive Age as one of the 100 Best >Business Web Sites. For further information about CyberCash, access its >WWW server or call 800-9CYBER1. > > About Checkfree > Checkfree Corporation, the nation's leading electronic commerce >company, last year processed more than $6 billion in payments for >consumers and corporate clients, with more than six million consumers >and one million businesses benefiting from its services. Checkfree >serves consumers, business and financial institutions with a wide array >of product and service offerings, each finely tuned to the specific >needs of its users. All leverage Checkfree's extensive technology >infrastructure which includes its patented and proven electronic bill >payment system. Founded in 1981, Checkfree Corporation is headquartered >in Columbus, Ohio, where it employs 370 full-time associates. Checkfree >is privately held. > For additional information about Checkfree, access its worldwide web >server at: http://www.checkfree.com > -0- 7/13/95 >/CONTACT: Jennifer Sims, 415-904-7070, ext. 275 or ><jsims(a)accesspr.com>, or Nicol Davis, 415-904 7070, ext 281, or ><ndavis(a)accesspr.com>, both of Access Public Relations, for Checkfree; >or Susan Ice of Thomas Associates, 415-325-6236, or susani(a)thomaspr.com >for CyberCash, Inc./ > ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: co-sponsors
by cman＠communities.com 17 Dec '03

17 Dec '03

>I searched Thomas and couldn't find any evidence of co-sponsors to the >Senate bill. Am I wrong here? > >.pm According to Shari Steele: > Fortunately, the bill does not have a very promising future. The bill has > no co-sponsors. It was immediately referred to the Committee on the > Judiciary, where it currently sits. LEXIS's bill tracking report only > gives it a 10% chance of passing out of the committee.

2 1

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by bigdaddy＠ccnet.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- >On Thu, 13 Jul 1995, Ray Arachelian wrote: >How about "not respecting international copyright law, and not having >extradition treaties with the US" ... set up a data haven, we now know >why we need it soon... charge by the Kbyte, automate the billing, and relax. How about one of the Middle Eastern countries? Saudi Arabia would have been good until recently, but they've just signed the Berne Convention on copyrights...so there's one down. On the plus side, the authorities haven't banned crypto yet. Why? One only wonders. Kuwait has ready-made Internet access, but is, if I'm not mistaken, also a signatory to the international copyright convention. Both Kuwait and the KSA are also very friendly with the U.S., though I cannot name any specific case of extradition between the two countries. Given the choice between a Saudi court and a U.S. one, however, I'd pick the U.S. :-) Why not Yemen, Oman, or Lebanon? We'd have to start an ISP by ourselves, but the countries are small enough...or just recovering from civil war...such that nothing would be noticed(fingers crossed). Oman has CISnet access...maybe something could be built on that. For Yemen or Lebanon, we'd have to get a satellite hookup(which presents its own problems). Besides, Oman has simply _beautiful_ scenery. :-) >Anybody seriously interested? In theory. To actually set up a data haven takes more resources than I have. IMHO, however, one of the smaller Middle Eastern countries would be good, as they generally don't(unless I'm mistaken) have reciprocal copyright treaties with the U.S., are not generally signatories of the Berne Convention (except KSA and the UAE and maybe Kuwait), and do not look likely to outlaw crypto. Thoughts? David Molnar -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMAVbweFDHpuTkgoVAQHt8Af/VkW5FIqpd46ydnchTpSfKZUS+c4Aviu6 ZQA2UYY5GbCQhyKNJ6Tk2OKJI82vfOpo+n+uSZfvAWnLlxrzQ1mDJxJ9wWaaAa4u WIG4XWbGCFetRYAVYF+h/I6zG7+zCE8N3bn2kAcAz7SoDgqGP1CXiXsXmEiqBJNS O8U8nM1ZFZ4KZBwShf5SsprKgKP98TCmWJc7L5li9Pco7HyLzBdsHUz2pJgCd4Eh rp/8jfzu2so/tF5EHkjGIcPUnp0rEfZ5gKc/gimDloHfyzVxA3ITraXe8xOZF3iX sICCpBb+qoDLzvt5lM+Vpm7+pUa/fF+OJB0+eX4gNw/a082gH6LeOg== =rmDi -----END PGP SIGNATURE----- lo...look to the sig, for there will be no sign

1 0

Re: Fight, or Roll Over?
by cman＠communities.com 17 Dec '03

17 Dec '03

>At 10:41 AM 7/13/95, Douglas Barnes wrote: > >>Since the Anti-Electronic Racketeering Act of 1995 might as well >>be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see >>Tim throw in the towel already, when the bill hasn't even made it >>through committee yet. > >I'd hardly call my view "throwing in the towel." What I said clearly enough >was that the Washingtonians can throw out repressive legislation much >faster than we can--and I speak in terms of "we" as being the EFF, EPIC, >NRA, ACLU, etc., and _not_ the Cyherpunks, who have no lobbying activities >to speak of. > I'm not advocating that cypherpunks lobby -- we clearly don't have the organization or the right image to be doing that. I _do_ think that it's important to support the EFF, EPIC and ACLU who will almost certainly be fighting this very important rearguard action while we try to get _our_ act together. I'm not sure the NRA bears on this exact matter, but I think it's high time one of the other three started doing "jack booted thug"-type fundraising letters. This means, for those not reading between the lines, doing something more than online ranting and petition-signing, such as getting out the checkbook and supporting those who are organized to fight these things, and actually getting off the dime and doing things like writing letters, sending telegrams, and otherwise harassing our elected beings through media that they understand (since, clearly, they _don't_ understand the Internet -- if they did, they wouldn't propose legislation like this.) Yes, the "bad guys" can crank out unfriendly legislation faster than the "good guys" can fight it, but since we are clearly not ready to offer technological solutions this month, the "good guys" act as a valuable brake on this current swing of the pendulum.

1 0

On a lighter note...
by Robert A. Hayden 17 Dec '03

17 Dec '03

Well, for all those that are looking for something a little lighter after todays activity, the new version of the Geek Code (version 3.0) was released this morning. You can find it via your favorite web browser at: http://krypton.mankato.msus.edu/~hayden/geek.html Or finger me for info on how to get it in ASCII version. Comments appreciated. I know the revamped political sections aren't perfect, but they are a little better. ____ Robert A. Hayden <=> Cthulhu Matata \ /__ -=-=-=-=- <=> -=-=-=-=- \/ / Finger for Geek Code Info <=> hayden(a)krypton.mankato.msus.edu \/ Finger for PGP Public Key <=> http://att2.cs.mankato.msus.edu/~hayden

1 0

Re: Fight, or Roll Over?
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

At 10:56 PM 7/13/95, Timothy C. May wrote: >At 10:41 AM 7/13/95, Douglas Barnes wrote: > >>Since the Anti-Electronic Racketeering Act of 1995 might as well >>be called the "Anti-Cypherpunk Act of 1995", I'm surprised to see >>Tim throw in the towel already, when the bill hasn't even made it >>through committee yet. > >I'd hardly call my view "throwing in the towel." What I said clearly enough >was that the Washingtonians can throw out repressive legislation much >faster than we can--and I speak in terms of "we" as being the EFF, EPIC, ^ I meant to say, "...than we can respond to" --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)sensemedia.net | anonymous networks, digital pseudonyms, zero 408-728-0152 | knowledge, reputations, information markets, Corralitos, CA | black markets, collapse of governments. Higher Power: 2^756839 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Re: def'n of "computer network"
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

imsi.com!perry ("Perry E. Metzger") writes: >My opinion is that stegonography "standards" are useless. > Anyone can >try unpeeling the GIFs and see if something interesting shows up >inside. That means that the only useful stego suffers from the defect >that symmetric key cryptography suffers from -- you have to have made >serious pre-arrangements with the counterparty. Perry, I don't understand. If the least significant bits in my gif file follow all the "known statistical distributions", how can anyone know whether they are "just noise" or are an encrypted message, (asymmetric or symmetric, either one) unless they have the key? Why can't there be public key steganography? Perhaps existing tools are inadequate, but are they impossible? Rick F. Hoselton (who doesn't claim to present opinions for others)

3 2