December 2003 - cypherpunks-legacy

Re: R.I.P. John Brunner
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:03 PM 8/28/95, Alan Bostick wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >Science fiction writer John Brunner died last Friday, August 25, from >a massive stroke, while attending the World Science Fiction Convention >in Glasgow, Scotland. > >Among several other notable works, Brunner was the author of THE SHOCKWAVE >RIDER, a groundbreaking vision of the information age that inspired and >forsaw much that was pertinent to the Internet in general and the >Cypherpunks in particular. > >Let us pause a moment to note his passing and honor his life and >contributions. I am saddened to learn this. And, yes, this has a lot to do with Cypherpunks. I read "Stand on Zanzibar" with rapt attention in 1969 or so, and it had a big influence on me. Ditto for "The Shockwave Rider," one of the very first explications of how identities would be changed, how the State would insist on computerized identities. (Indeed, "1984" came first, and is an even more important work, by any standards, but Brunner still nailed the effects of computers in a way that Orwell could not possibly have.) Christ, what an imagination he had! --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Searchnet
by The Gate 17 Dec '03

17 Dec '03

Some time ago, I posted a reply to an allegation that the Spotlight was a Klan paper. Of course, it is more Liberty Lobby/CIA, with Bo Gritz on the Board. The point of this post is that those who want to know what is up with the Spotlight need to subscribe to Searchnet, which covers all the information of like sort. There was also a wonderful post recently hailing hackers as the ones who are most likely to prevent government sponsored crypto-terror censorship. Those who would like the post, speak up. Those who want to subscribe to Searchnet, likewise. Hope this does not get in the way of PGP implementation. Onwards, Lee ____________________________|||||||||||||||||||||______________________________ R. Leland Lehrman@The Gate, New Haven, CT. http://id.wing.net/~gate/gate.html God, Art, Technology and Ecology Research and Development >>>>>>>>>>>>>>>>>>>>>>>>>>>>>>Do you love the Mother?>>>>>>>>>>>>>>>>>>>>>>>>

2 1

Correction: List of crypto-related courses
by Avi Rubin 17 Dec '03

17 Dec '03

Oops, I got the URL a bit wrong in my last posting. Here it is again with the corrected URL. For the last year or so, I have built and maintained a list of graduate level courses on cryptography and security. The current list can be found at http://www.cs.nyu.edu/~rubin/courses.html I would like to keep this list as current as possible, so if you have any additions/corrections, etc, please let me know. I am only interested in full-semester courses at universities. Thank you, Avi ********************************************************************* Aviel D. Rubin rubin(a)research.att.com Secure Systems Research Dept. Adjunct Professor at NYU AT&T Labs - Research 180 Park Avenue http://www.research.att.com/~rubin/ Florham Park, NJ 07932-0971 Voice: +1 973 360-8356 USA FAX: +1 973 360-8809 --> Check out http://www.clark.net/pub/mjr/websec/ for a new book on web security (The Web Security Sourcebook). *********************************************************************

1 0

Re: Florida Drivers Permits and a Hello
by Alan Olsen 17 Dec '03

17 Dec '03

At 01:47 PM 8/29/95 -0500, you wrote: >Alan Olsen writes >>They would not have to include an entire thumbprint. The actual code used >>to verify fingerprints is not very large. All that would be needed is >>enough information to ID into the "official" records and enough checksum >>type information to prevent alteration/counterfitting. Using magnetic media >>for this is a bit foolish as it can be changed/destroyed with the stroke of >>a magnet. I will not say by what means I would think should suit as a >>better encoding scheme because: 1) They are not using it and 2) I do not >>want to give them any ideas. > >What possible value could the LEAs get by having your thumbprint digitally >encoded on your driver's license? It's not like the average cop-on-the-beat >is qualified to lift a fingerprint and compare it. Even if he was, how >does it benefit that the fingerprint is on the license? > >This seems silly. I was pointing out that it was possible. I was not trying to make the point that there was any *USE* for such a thing. (Evidently some ID cards now carry such prints. California does, if memory serves me correctly.) Just because something is silly does not mean it will not be tried by someone in law enforcement. In fact, there seems to be a corelation between silly acts and law enforcement... (Or at least those making the rules about law enforcement.) And if you think it cannot get any worse, Pete "I want to seal the borders" Wilson has announced he is running for president. We will be getting a large number of silly laws and pronouncements if the American people are stupid enough to elect him to high office. > > | Visualize whirled keys! | alano(a)teleport.com | |"The moral PGP Diffie taught Zimmerman unites | Disclaimer: | |all mankind free in one-key-stenography-privacy!"| Ignore the man | | -- PGP 2.6.2 key available on request -- | behind the keyboard.| | http://www.teleport.com/~alano | <fnord> |

2 1

Re: Florida Drivers Permits and a Hello
by d-jones＠ix.netcom.com 17 Dec '03

17 Dec '03

>What possible value could the LEAs get by having your thumbprint digitally >encoded on your driver's license? It's not like the average cop-on-the-beat >is qualified to lift a fingerprint and compare it. Even if he was, how >does it benefit that the fingerprint is on the license? > >This seems silly. There are device that will electronicly read fingerprints available now. So with such a device, the LEO would know instantly if you were who you said that you were.

4 3

Why the government should protect our privacy
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Tue, 12 Aug 1997 20:15:33 -0400 From: Marc Rotenberg <rotenberg(a)epic.org> To: declan(a)well.com, Michael Sims <jellicle(a)inch.com> Cc: fight-censorship(a)vorlon.mit.edu Subject: Re: trustee, shmustee At 7:46 PM -0400 8/12/97, Declan McCullagh wrote: >On Tue, 12 Aug 1997, Michael Sims wrote: >> >> What groups want for privacy of individuals: >> >> Government: Lots > >Michael, thank you for reminding us of the Clinton administration's >valiant efforts to protect individual privacy. > >I agree that we should blissfully ignore that we're talking about the >Clipper Chip president, the Digital Telephony guy, the same fellow who >will veto any pro-privacy crypto bill. We should try to forget last >year's anti-terrorism bill, push for roving and multipoint wiretaps, and >FBI desires to ban nonescrowed domestic crypto. No longer should I be >concerned about the administration's quest for enormous voracious >databanks that will be tied together -- airport security, travel records, >national id cards. And of course ACLU legislative counsel Don Haines is a >fool when he speaks of "the Clinton-Gore effort to hardwire Big Brother >into the information age. > >Silly me. > Declan is absolutely right. Good thing there are no real privacy officials in the federal government and no privacy laws for the Internet to get in the way of these efforts. Has anyone else noticed that the most sweeping proposals for surveillance are coming from the administration that has backed the fewest privacy laws of any administration in 30 years? Mere coincidence? I don't think so. Marc. ================================================================== Marc Rotenberg, director * +1 202 544 9240 (tel) Electronic Privacy Information Center * +1 202 547 5482 (fax) 666 Pennsylvania Ave., SE Suite 301 * rotenberg(a)epic.org Washington, DC 20003 USA + http://www.epic.org ==================================================================

2 1

SSL keyspace etc.
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

regarding SSL challenge, I am not following this close enough to understand completely, but I thought I would offer a few suggestions for tweaking the code: -- the issue of grabbing keyspace has been raised. what if someone malicious just yanked huge areas of keyspace and didn't search them? it seems that the clients need to return to the server some evidence that they have searched their keyspace in question. the server could verify this evidence. for those that don't return the "evidence", that keyspace could be reallocated to other comers. the simple approach to all this, if you don't have "evidence", is to just have the server keep reallocating the same space over and over to different crackers. hopefully eventually every part of the keyspace would be allocated to a "legitimate" worker. -- the issue of efficiency is very fascinating for this project. essentially the server has no idea what the block size of key blocks it should dole out. obviously the server would want to try to dole out equal *processing chunks* such that the remote machine reports back in a certain amount of time, no matter what architecture. the problem of course is that remote machines all have different efficiency. two possibilities: a sort of "bogomip" calculation is done in the client, and its processor speed is reported to the server. the server uses this in a calculation to determine how much to dole out. it could try to derive a best fit linear relationship between space covered and processor spead, or build up a table of results and interpolate for new requests. note that the efficiency issue also ties into "what if people take keys they don't solve". if the server knows roughly how long a client should take to report back, and it never reports back, it could then reallocate that key space. -- another problem of efficiency is that the server is clearly a bottleneck for servicing requests. the question arises: suppose that the server could determine the precise interval between which machines would go back to it for new keys. what is the optimum interval over the whole project? in other words, give the number of machines participating, and their processor speeds, what size of key space should be parceled out to the next request so that the bottleneck at the server is minimized? this optimum interval must be very hard to derive, because it depends on the contention based on many incoming connections. it would involve some probabilistic approximations of the likelihood of collisions. to model it, you might consider a request as taking [n] seconds of time, and consider that if any two requests are in contention, a retry happens after [m] seconds. you could build up models that would try to minimize the time based on empirical simulations. however I would be exceedingly impressed if someone could derive a formula for this, or give it from some textbook. -- adaptive algorithms for all these situations are possible. the server could use a "hypothesis" in the sense of partitioning out a starting size of keyspace, and then watch how long it took the client machine to respond, and then assume a linear relationship or something to compute the size of the next keyspace to hand out to the machine. the server could continually watch how closely its "hypothesis" (i.e. its estimations of how long a given machine will take) match the actual returns. -- more on the idea of evidence: we are working with a hashing algorithm, right? as evidence the client machines could return checksums of all the hashes of all the keyspace it searched. it could break up its own search space into blocks and return the checksums on the hashes for each block. the server, if it wanted to, could verify these blocks running its own computations. if it ever found a client was "unreliable", it could then diminish the keys sent to the unreliable client, or even send it areas of search space it didn't care about anymore (i.e. areas that have already been confirmed searched by a more "reliable" client). -- in fact all this reminds me of the process of intelligence gathering by an agency, which could be formalized as follows: suppose that the agency wishes to identify "quality information". it has a set of sources, A,B,C,D.... now, it can send questions out to these sources and get information from them. some of them however would be "unreliable". the agency must devise some means by which it can weed out the unreliable sources. note that this may even involve sending them bogus instructions to keep them busy so they do not themselves suspect they have been "discovered" and then change their defective plans. obviously, one of the most important intelligence tools in this matter is that of *correlation*. you have to determine "truth" (or "quality information") via the correlation between answers that the different sources give you. also important to correlation is *redundancy*. you sometimes have to ask more than one source the same question, and test the answer. in this model, if A and B give different answers, you know that one of A or B is "unreliable". what is very interesting in our case of cracking keys is that the server can verify the information on its own. in other words, it has a *control* that it knows is correct that it can judge against the answers "out there". unfortunately, in contrast, real intelligence agencies are not always privy to this kind of certain "control" and in fact have to determine "truth" entirely from a set of sources, any of which might be unreliable. in this case one has to have a hypothesis about what is the "truth" and test it to see if it holds up consistently with all information. the approaches of attackers are obvious. the most obvious is that of collusion and infiltration. but I will save the rest for some NSA spook to elaborate. there are certainly enough colluding and infiltrating on this list <g> -- one of the reasons all this interests me is that it really reminds me of some projects I have worked on in the past. in high school I wrote a network mandelbrot set program (client/host). the issue of contention arose and it appeared to me to look like an upside-down parabola after I plotted some points (curving up, that is). i.e. the optimum was at the pit of the parabola, and when too few or too many requests happened, the speed over the overall simulation was increased above the optimum. some very ingenious readers may actually be able to locate this code, which I put in the public domain over 5 years ago. -- another thing I worked on was trying to find the optimal block size of communications protocols such as Zmodem, which generally instead just pick arbitrary block sizes 2^n. I actually was able to attack this problem analytically through the observations of the properties of infinite series and calculus techniques. it is a similar problem but the idea of contention really complicates this issue. (for what I studied, there was only one client and one server, so to speak). I still have this paper in Latex format and if anyone is interested I would be happy to send it to you. it's a really nice example, IMHO, of how if you use your brain and some mathematics, you can really get a far more elegant approach than brute force, and know with much greater certainty that what you are doing makes sense mathematically. an awful lot of programmer just tend to bang on the keyboard with out thinking of the theoretical implications of their work. this is understandable given that the theoretical implications of even trivial programs (such as the SSL client/server interactions) can be mathematically extremely daunting, requiring even differential equations to model fairly simple pieces of code. -- well, that is my contribution of the moment into the cypherpunk annals. one never knows what a little combination of boredom and inspiration can lead to. --V.Z.Nuri

1 0

Re: Guy Polis (fwd)
by Rabid Wombat 17 Dec '03

17 Dec '03

Lame forgery. -r.w. ---------- Forwarded message ---------- Received: from sirius.infonex.com (sirius.infonex.com [206.170.114.2]) by mcfeely.bsfs.org (8.6.12/8.6.12) with ESMTP id AAA19634 for <wombat(a)mcfeely.bsfs.org>; Tue, 12 Aug 1997 00:48:20 -0400 Received: (from majordom@localhost) by sirius.infonex.com (8.8.5/8.7.3) id SAA11251 for cypherpunks-outgoing; Mon, 11 Aug 1997 18:52:35 -0700 (PDT) Received: (from cpunks@localhost) by sirius.infonex.com (8.8.5/8.7.3) id SAA11069 for cypherpunks(a)infonex.com; Mon, 11 Aug 1997 18:51:57 -0700 (PDT) Received: from rigel.cyberpass.net (root(a)rigel.infonex.com [206.170.114.3]) by sirius.infonex.com (8.8.5/8.7.3) with ESMTP id SAA11040 for <cpunks(a)sirius.infonex.com>; Mon, 11 Aug 1997 18:51:47 -0700 (PDT) Received: from toad.com (toad.com [140.174.2.1]) by rigel.cyberpass.net (8.8.5/8.7.3) with ESMTP id SAA16287 for <cypherpunks(a)cyberpass.net>; Mon, 11 Aug 1997 18:49:20 -0700 (PDT) Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id SAA24951 for cypherpunks-unedited-outgoing; Mon, 11 Aug 1997 18:31:39 -0700 (PDT) Received: from wombat.sk.sympatico.ca (wombat.sk.sympatico.ca [142.165.5.136]) by toad.com (8.7.5/8.7.3) with ESMTP id SAA24939 for <cypherpunks(a)toad.com>; Mon, 11 Aug 1997 18:31:33 -0700 (PDT) Received: from default (lohner24.sk.sympatico.ca [142.165.98.24]) by wombat.sk.sympatico.ca with SMTP (8.7.1/8.7.1) id TAA03761 for <cypherpunks(a)toad.com>; Mon, 11 Aug 1997 19:27:46 -0600 (CST) Message-ID: <33EFBCAD.5D8(a)mcfeely.bsfs.org> Date: Mon, 11 Aug 1997 19:30:21 -0600 From: Rabid Wombat <wombat(a)mcfeely.bsfs.org> Organization: Electronic Forgery Foundation X-Mailer: Mozilla 3.01C-SYMPA (Win95; U) MIME-Version: 1.0 To: cypherpunks(a)toad.com Subject: Re: Guy Polis References: <g6maBe1w165w(a)bwalk.dm.com> Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit Sender: owner-cypherpunks(a)cyberpass.net Precedence: bulk Reply-To: Rabid Wombat <wombat(a)mcfeely.bsfs.org> X-List: cypherpunks(a)cyberpass.net X-Loop: cypherpunks(a)cyberpass.net Dr.Dimitri Vulis KOTM wrote: > There's a crackpot by the name of Guy Polis (guy(a)panix.com, polis_guy@ > jpmorgan.com) who posts a crackpot "cryptographic manifesto" and sounds > like a bad troll intended to make the folks who promote the use of crypto > look like, well, crackpots. Be warned. Tim May wrote: > Yeah, and like we're gun-nuts, too! The mammalian jackass is also claiming that all crypto promoters are marsupials. -rw

1 0

Poisson numbers for random keyspace assignment
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 12:03 PM 8/29/95, Damien Doligez wrote: ... >But you fail to take into account the probability that the search will >have to go that far. > > >This is how I compute the expected cost of the random search. > >The probability of finding the key upon searching the k-th segment is: > > k-1 > p(k) = (1 - 1/n) . 1/n > >The expected cost is the sum of all possible costs, weighted by their >probability: > ___ ___ > \ \ i-1 >e = > i p(i) = 1/n > i (1 - 1/n) > /__ /__ > i = 1..oo i = 1..oo ... I haven't checked Damien's notation and confirmed the results, but I have another way of looking at it, which I think produces the same results. Last night (but it didn't arrive at my site until moments ago, for some reason) I wrote: >On the positive side, let everyone simply attack the keyspace as they see >fit, picking random parts to attack. This should not be "worse" than a >factor of several from a "perfectly coordinated" attack. (I haven't spent >time calculating this, but my intuition is that a random attack, with >overlapping keyspace, is not a lot less efficiently attacked than >attempting to arrange for no overlaps...just based on my mental picture of >dropping line segments randomly on some interval and figuring coverage of >the line segment.) Here's what I meant, in more detail: Imagine the overall keyspace to be searched as a line segment of some length: [------------------------------------------------] Now imagine various people randomly picking starting points and doing some segment, depending on their compute power: [---] [--] [--------] [------] [-] [--------] ...and so on, with the various line segments scattered randomly. Some will overlap, meaning the same keyspace segment is being searched by two or more people. If the total length (summation) of these line segments is the same as the "brute force exhaustion" of the keyspace, we can do some interesting calculations. For example, the "expected" number of hits per point is "1". But some points will be hit 0 times, others will be once, twice, three times, etc. (This is in the nature of random processes, as each line segment is random and "independent" of what other people may have independently picked.) The Poisson distribution fits this situation exactly, with the _actual_ number of hits computed by: P(s;m) = (e ^ -m) (m ^ s) / s! where s is the actual number of hits and m is the expected number. P(s;m) is the probability of seeing s hits when m are expected. s m P(s;m) 0 1 1/e, or .368 1 1 1/e, or .368 2 1 .184 etc. That is, with the "total exhaustion" amount of computation there will be 36.8% of the keyspace left unsearched, simply because nobody's random segments landed on this fraction of the overall segment. If twice, three times, four times, etc. as much effort is put into it (enough to brute force the search space twice, using nonrandom assignment), then s m P(s;m) 0 2 .135 0 3 .0498 0 4 .0183 For s = 0, P(s;m) = e ^ -m Several conclusions can be drawn. Here's what I conclude: * For opportunistic attacks on keys in challenges, the odds are 95% that a key will be found with only twice the total effort (or time) using a totally random method of picking up keyspace to search. * This is probably good enough. (And if one only wants to be 90% sure of finding the key, even less effort is needed.) * And this affects several of the "denial of service" attacks mentioned here by others, including finding the key but not reporting it (for whatever reasons), claiming too much keyspace, etc. This is because some of the same regions are actually being searched two or more times. * This of course gets rid of the assignment problems. * If the intent is to show that keys can opportunistically be found, the random assignment method works pretty well and is "good enough." If, for some reason, a key _had_ to found, then a more careful, nonrandom assignment method would be best. As assignment methods get better, a crossover will occur, and the random assignment method will lose its advantages. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: A glance at the future of missing child identification
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 21:56 8/28/95, Timothy C. May wrote: >Seriously, I'm awfully skeptical that any kind of remote sensing device is >to be placed in the breasts of women seeking enhancement. The technology >just does not currently support small devices, though I suppose some of the >55GG strippers could support an active transmitter (or, "transtitter"). The homepage of the horse tracking devices that I recently posted states that the devices are 11 mm long and can be injected with a 12 gauge needle. Even has an acctual size picture of the device. Small enough to fit into a breast implant. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Fuck the usenet cabal
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I came up with yet another brilliant idea. Stanford Wallace's Cyberpromo site has been hacked by some criminals, but it's coming back. In particular, he's giving away free autoresponders again. (An autoresponder is an address(a)cyberpromo.com to which you can send an e-mail and get back a pre-recorded response, if your site accepts e-mail from cyberpromo. Supposedly anyone can set one of them up for free and provide their own automatic response. Stanford is running a promotion.) Now, suppose some non-US person sets up an auto-responder that sends out strong crypto software, and another non-US person requests it and gets it. Is anyone going to be guilty of ITAR violations? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

9 14

Re: Florida Drivers Permits and a Hello
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 22:57 8/28/95, Alan Olsen wrote: >They would not have to include an entire thumbprint. The actual code used >to verify fingerprints is not very large. This is true. While waiting for the local US Post Office clerk to process a passport application, I browsed through their book of FBI's Most Wanted (available at every Post Office, just ask for it). Each person's fingerprints were specified with an alphanumeric code that took up less than half a line. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: Florida Drivers Permits and a Hello
by tcmay＠got.net 17 Dec '03

17 Dec '03

This thread has more crypto relevance than some might think.... At 7:39 PM 8/29/95, Dave wrote: >>What possible value could the LEAs get by having your thumbprint digitally >>encoded on your driver's license? It's not like the average cop-on-the-beat >>is qualified to lift a fingerprint and compare it. Even if he was, how >>does it benefit that the fingerprint is on the license? >> >>This seems silly. > >There are device that will electronicly read fingerprints available now. So >with such a device, the LEO would know instantly if you were who you said >that you were. And it is possible with today's technology to do the following: -- take a fingerprint -- scan it, either linearly across some reference line (marked on the license), or in a full 2D scan -- have the issuing agency encrypt the resulting waveform (scan), using its private key -- print the resulting number on the license Then, the validity of the license could be verified by: -- the local checking agent (cop) takes the number printed on the license -- runs it through the _public key_ of the issuing agency -- gets back an analog waveform (scan) -- can compare it directly to the actual fingerprint This is the same scheme used by the once-extant company "Light Signatures" as a means of foiling counterfeiters. (A diagram makes all this much clearer...) The scan can be done for digitized photos as easily as for fingerprints. The point is simple: an analog signal of some sort can be "signed" by the credential-issuing authority such that the signature can be easily checked in the field, but not easily duplicated or forged. Note that lottery tickets use a similar scheme. The winning number is hashed or otherwise encrypted with a private key known only (so the theory goes...) to the ticket-issuing agencies. This hash is also printed (at least in some jurisdictions) on the ticket (usually in very small letters). The winning number, which is announced and posted, cannot be used to print up a "winning ticket" because the hash/encryption function is not known to the counterfeiters. A major player in this market, Scientific Games, has a printing facility nearby my home. I don't know if any driver's licenses have anything like this, but the technology certainly exists, and should be coming pretty soon to all sorts of documents. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: A peculiar notion
by Anonymous 17 Dec '03

17 Dec '03

"Central government spending had soared from less than 2 percent of the economy's total output to well over 20 percent in 1865, approximately what the central government spends today. "It is hard to decide from which angle that statistic is more astonishing: that government spending rose from such infinitesimal lows to today's heights in four years, or that today federal authorities regularly spend during peacetime as much as they did during the country's most devastating war." -- Jeffrey Rogers Hummel

1 0

Reputation currency
by Rishab Aiyer Ghosh 17 Dec '03

17 Dec '03

>From my column... -Rishab --====(C) Copyright 1995 Rishab Aiyer Ghosh. ALL RIGHTS RESERVED====-- Electric Dreams Weekly column for The Asian Age by Rishab Aiyer Ghosh #70, 21/August/1995: Implicit transactions need money you can give away Information is often given away at no loss to its owners, while recipients gain, because it can be duplicated. For some purposes, it could be paid for in money that behaved in the same way - adding to the recipient's wealth, while not reducing that of the donor. This money would have to be quite unusual; but so is the commodity being traded. Buying and selling knowledge is full of implicit transactions. One doesn't stop to write a cheque every time one hears industry gossip, however useful, in the corridor. More importantly, one doesn't even need to think about doing so. So much of the knowledge traded in the 'real world' could only be done so informally. Trade is no less valuable for this - the world runs on the chats with senior colleagues, the friendly advice over lunch, the learning and experience gained from working with a client. Formalizing it all would kill it. That's as far as we can get with knowledge outside the distance-eliminating domain of cyberspace. The most promising aspects of a world with fewer geographical impediments in the flow of information include the translation of the gossip in a corridor to an electronic mailing-list, the ability to be advised by friends never seen over a virtual lunch, or to chat with a senior colleague across continents. But the limitations of geography had advantages. People now begin to wonder whether they're not being cheated, when the corridor-mailing-list can have thousands of people. The narrow confines of office buildings provide a sense of community, and an assurance that the consumers of the knowledge traded there are worthy of it, being likely producers too. But restricting access to electronic corridors will negate their advantages, of connecting more minds across space. The main option being considered these days is not just overtly tied to economics - it must be, as that's what the knowledge trade is about - but also tangled with hard cash, with dollars. This is not only unnecessary, much of the time, but also harmful. With the safe assumption of secure international digital cash transactions in the near future, the hard-currency solution to the electronic corridor problem would be to charge every consumer a small amount for everything - a cent a word, say. This may work with traders in diversity, the indexers of the world to whom you pay for anything you need to find. It works rather less well for the traders in consistency, to whom you would pay much more than a cent a word for continuous, reliable content. But for those who lurk in the electronic corridors of the infosphere - and all the implicit cooperatives that form between individual contributors to cyberspace's live, people resources - the hard cash model is useless. Among others, there is the question of who takes the money. The Department of Corridors? The Treasurer of Electronic Mailing Lists? It certainly wouldn't be fair to pay just the individual author of the particular piece you read and found useful, as it built upon the unpaid work of others. After all, the informal nature of these gatherings of minds is for a reason. They, or at least the active participants, contribute not for cash but in return for the contributions of others. They only take exception to the one-way consumption by stray, if numerous, visitors. The alternative to hard cash in these implicit transactions in cyberspace is the equally implicit currency of the real world. The currency that is used almost solely in the trading of knowledge and which, like knowledge, extracts no direct cost to the buyer at the seller's gain. A currency that can be paid equally to corridors full of industry gossip as to colleagues who throng there. Indeed, a currency that is, and is traded like, information itself: reputation. Reputation may not, at first glance, resemble money. But it is the implicit reward of good products, and their producers. It certainly adds to - or subtracts from - the worth of those who receive it. And it is the ultimate free market currency. Traded as a commodity like other data, reputation is based on, and influences in turn, the average of 'prices' set by individual consumers - what individuals think of a producer. Reputation encourages improved production as much as, or more than, cash does - at least in the informal knowledge trade. And reputation will be a very important aspect of the knowledge economy, with the increasing anomie of cyberspace as e-mail replaces firm handshakes. There are, of course, problems with transporting the informal reputations outside cyberspace to reputation systems within it. But work does continue on the necessary technologies. This progresses at a slower pace than that on automatic cent-a-word payment systems, because developers don't realize the importance of informality in the information age. This will have to change - the knowledge economy is actually a people economy, and its most common currency should reflect that. Rishab Aiyer Ghosh (rishab(a)dxm.org) is the editor and publisher of The Indian Techonomist. --====(C) Copyright 1995 Rishab Aiyer Ghosh. ALL RIGHTS RESERVED====-- This article may be redistributed in electronic form only, PROVIDED THAT THE ARTICLE AND THIS NOTICE REMAIN INTACT. This article MAY NOT UNDER ANY CIRCUMSTANCES be redistributed in any non-electronic form, or redistributed in any form for compensation of any kind, WITHOUT PRIOR WRITTEN PERMISSION from Rishab Aiyer Ghosh (rishab(a)arbornet.org) --==================================================================-- ---------------------------------------------------------------------- The Indian Techonomist - newsletter on India's information industry http://dxm.org/techonomist/ rishab(a)dxm.org Editor and publisher: Rishab Aiyer Ghosh rishab(a)arbornet.org Vox +91 11 6853410; 3760335; H 34 C Saket, New Delhi 110017, INDIA

1 0

I am not a cracker
by Zooko Journeyman 17 Dec '03

17 Dec '03

Several journalists have approached me at HIP and afterwards for quotes about cracking. It is interesting that merely by showing up at HIP and by having a suspiciously pseudonym-like name (hey, my parents were inspired by New Age psychology or something, okay?) I have apparently gained the instant reputation of being into cracking. So in case any journalists out there were considering asking me how to crack Tamagotchis (I kid you not-- that was the topic): I work in computer security. I devise systems. I write code. I examine systems for weaknesses. I test systems. But I don't crack. The last time I wrote a Trojan log-in screen was in 9th grade. When I made a phone call at HIP I used my pre-paid phone card instead of using the cracked phone booth for free. I pay for most of my software, other than Microsoft operating systems. So look elsewhere for your cracker quotes. Sincerely, Zooko, Journeyman Hacker

1 0

Re: A glance at the future of missing child identification
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:48 PM 8/28/95, Jason L Tibbitts III wrote: >>>>>> "TCM" == Timothy C May <tcmay(a)got.net> writes: > >TCM> At 8:52 PM 8/20/95, Hadmut Danisch wrote: >>> These transponders are already used for many year. They inject them in >>> pigs and cows to identify them. And some car manufacturers put the into >>> the ignition keys as theft protections. > >TCM> There has so far been no known uses of this on humans, at least as a >TCM> matter of routine. Possibly some developers have tried injecting >TCM> themselves, for the usual reasons. > >Believe it or not, something like this is being used (or is being prepared >for use) in breast implants. An article in the Houston (silicone city) >Chronicle about a month ago (sorry, I can't produce a more exact reference) >stated that new soybean oil breast implants are being manufactured to >accept an identification device to track information on the patient and the >implanting doctor. > >It's not exactly big brother (bigger sister?) but it's the first >human-implanted ID device that I've heard of. I don't know if any have >actually been implanted. Big Brother? Big Sister? Naw, it's "Big Tits." It's a way for we males to scan the females at the bar to see if they're naturally well-endowed or silicone-enhanced. Part of the "truth in advertising" laws recently passed. ... Seriously, I'm awfully skeptical that any kind of remote sensing device is to be placed in the breasts of women seeking enhancement. The technology just does not currently support small devices, though I suppose some of the 55GG strippers could support an active transmitter (or, "transtitter"). Conceivably, when the women go down to their local doctors to have their tits inflated there can be some kind of "taggants" added, a la the taggants added to some explosives, but this is a far cry from an electronic identificaton device. Some boob must've come up with this one. --Tim ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Sendmail Bugs
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This has nothing to do with crypto, and is only remotely related to remailers. However, I thought I'd send it along to demonstrate to our conspiracypunks friends how to shorten the length of an off-topic post. There is a document on alt.security which describes exploitable sendmail bugs. The reference is <809544856snz(a)hacknet.demon.co.uk> I saved a copy in case anyone would like one. SEE! Now wasn't that easy! Don -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQB1AwUBMELCW8La+QKZS485AQGWMQL8DycUwDwZ9ACaLo27o6fUrqoz3KAXJB4C fz6FHp6LLBbTDpPQoSgYfhcYtpySs7IuXvr5ja+/qNFi6Jq6M98WBvFMuLug8HsR 8IFvu+KVF1VSJ8EOAcdQ9MEAs3m+Zbk0 =YZjS -----END PGP SIGNATURE----- <don(a)cs.byu.edu> fRee cRyPTo! jOin the hUnt or BE tHe PrEY PGP key - http://bert.cs.byu.edu/~don or PubKey servers (0x994b8f39) June 7&14, 1995: 1st amendment repealed. Death threats ALWAYS pgp signed * This user insured by the Smith, Wesson, & Zimmermann insurance company *

2 1

Decoder ring
by dmandl＠panix.com 17 Dec '03

17 Dec '03

High-Tech Company Goes Back to the Future with Decoder Rings The Stuff of Cereal Box-Tops Becomes Real Repository of Data and Computer ID By Carlos Tejeda Staff Reporter of the Wall Street Journal Once, the only way to get a decoder ring was to carve up cereal box-tops or comic-book covers. Now Dallas Semiconductor Corp. is creating its own high-tech version of the "decoder" ring. Although this one doesn't break any codes, it can unlock some doors of information. It consists of a 64000-bit microchip, embedded in a silver ring made by class-rings titan Jostens Inc., of Minneapolis. The rings can be implanted with a replica of a driver's license, credit-card numbers and even a digitized photograph. Company officials say they hope the ring's data-carrying capability will help bring personal information literally to one's fingertips. "My wallet's stuffed with a dozen different plastic cards," said Hal Kurkowski, Dallas Semiconductor's group manager for auto-identification products. "It's an awful mess. You could put all that and more into the ring and not have a four-inch-thick wallet." The ring is triggered when the metal piece at the head of the ring comes in contact with a data reader. To prevent theft, the ring can be formated so that it only can be used in conjunc tion with a password, Mr. Kurkowski said. The technology already is being used at Dallas Semiconductor's headquarters, as something of a company ID card, said Syd Coppersmith, director of public relations. "I use it to get into my office, and it records who I am and when I went in," she said. "There's a reader on my PC, and I use it to get into my files." The rings cost about $60 each, while readers that can be plugged into a computer can be purchased for about $80. Ms. Coppersmith said several security companies already have the technology to install such readers for their clients. She said the system also has been tested commercially at a warehoiuse, where employees used the ring to record inventory changes. -- Dave Mandl dmandl(a)panix.com http://wfmu.org/~davem

2 1

Re: HIP hip hooray
by Zooko Journeyman 17 Dec '03

17 Dec '03

A million monkeys operating under the pseudonym "Mark Grant <mark(a)unicorn.com>" typed: > > Hey, Zooko! You were the only Cypherpunk who made the article in the > 'Independent' (by that blonde reporter who was wandering around), though > Lucky Green was mentioned by name. Wow. Oh how the mighty have fallen, from an adulatory spread in Wired to a mention in The Independent. And to think that Lucky was the fellow who was supposed to get the most benefit from the situation in the first place! > '"[hacking] can be a wonderful thing", explained Zooco, a member of the > CypherPunks. "Pretty much every useful aspect of modern computing was > devised by hackers -- like the Internet and email."' > > So did she spell your name wrong, or were you using a pseudonym ;-) ? I sound like an idiot, so I'm glad she mispelled my name. Also that's a pretty darn loose quote. The "--" there, for example, spans several sentences of conversation... Did the article print her e-mail address? Thanks, Z

5 4

Re: Pre-allocating key segments
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

This was supposed to go out yesterday, but I mistyped the address. -----BEGIN PGP SIGNED MESSAGE----- Piete Brooks <Piete.Brooks(a)cl.cam.ac.uk> writes: >I wrote: >> ... but I still think the >> prefetching of some more segments would be useful. > >I'm seeing calls from calpoly.edu and albany.net taking less than a second. >Are you **REALLY** worried about wasting that sort of time, when even a single >segment usually takes a quarter of an hour even on the faster machines ? Wow, I knew it had been sped up, but I didn't realize... You've convinced me. :-) >[ Getting down to the implementation details > 1) it would be hard for brloop to know that brutessl is 3/4s done. > 2) I can't think how to do prefetching in a safe way, and without disc use >] Good points. Never mind the pre-allocation. Abashed, -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEKVMREcrOJethBVAQENBQP5AeM1crT8+fqAkWKtFPQHi+ljbP2cwnIy 36jcC4WCQVdKtor5hZZu+0yfyENAirGI6SKFesJFrRi9avMHmOYTo2QTvnhZQYy/ patw2wRXDwrfWY6ndklmssROM59pLhZmngkMlIzEd1QVrmy2YGbKnJOvzIrUwaYL rGzztIzvLVo= =UAte -----END PGP SIGNATURE----- -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

Re: Florida Drivers Permits and a Hello
by ab411＠detroit.freenet.org 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Scott Brickner <sjb(a)austin.ibm.com> writes: >What possible value could the LEAs get by having your thumbprint digitally >encoded on your driver's license? It's not like the average cop-on-the-beat >is qualified to lift a fingerprint and compare it. Even if he was, how >does it benefit that the fingerprint is on the license? One benefit to law enforcement, quite apart from the ability to verify a license, would be the accumulation of a database of thumbprints of all citizens, or at least all those who drive. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMEOxbBEcrOJethBVAQGnjAP/dPUwWKt+c5+wbg4O4aqoOSQrVjyXiM1j Vh/devoIQmLuVnTD8AAoUFahLtUmEByyKa/uz2hnJgIu1+y0OJevbALrjFdex6Wm xqGr70d6ShN65DMOcMVeRvg9MtbhHAt1ktk4+92vUt7AttgqQ5DKsFoAyBVs0SRL gAQ12b71Hfs= =AMKA -----END PGP SIGNATURE----- -- David R. Conrad, ab411(a)detroit.freenet.org, http://www.grfn.org/~conrad Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 Jerry Garcia, August 1, 1942 - August 9, 1995. Requiescat in pace.

1 0

Autoresponder Crypto Export / Re: Fuck the usenet cabal
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM wrote: > Now, suppose some non-US person sets up an auto-responder that sends out > strong crypto software, and another non-US person requests it and gets it. How about hacking spammer's systems and setting them up so that their autoresponders send out copies of strong crypto? Everyone in the world would have a copy within days. Make the enemy your best friend. Sun Tzu

1 0

Re: Florida Drivers Permits and a Hello
by Jonathan Zamick 17 Dec '03

17 Dec '03

At 4:15 PM 8/29/95, Mark wrote: >>What possible value could the LEAs get by having your thumbprint digitally >>encoded on your driver's license? It's not like the average cop-on-the-beat >>is qualified to lift a fingerprint and compare it. Even if he was, how >>does it benefit that the fingerprint is on the license? > >Here it is possible to walk into a suitably equipped police station, put your >fingertips on a sensor pad and a few seconds, if records exist, have the appear >on the computer screen. Extrapolating this it isnt a big step for a patrol >car, already equipped with a packet radio link to HQ and a data terminal, >scan in your fingerprint and check it. If the system was offline they could >easily take your rpint and compare it to that on your license. It's just a >little more proof that the license is linked to you. > My only question though is why help them create more records about the average citizen? Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

Announcing SecureDrive 2.4 (fwd)
by Patrick Lear 17 Dec '03

17 Dec '03

Does anyone have any experience with the SecureDrive program and if so can you make any comments about it? I've been looking for something like this for a while and I'd also like to know which other programs compare / are better / are worse if any. Thanks for any input ... Patrick Lear, Sui Juris

1 0