December 2003 - cypherpunks-legacy

RE: self-ratings vs. market ratings
by Blanc Weber 17 Dec '03

17 Dec '03

>From: Vladimir Z. Nuri (in response to Tim May) > >hmmmmmmmm, I seem to recall earlier letters in which you advocated >a market-type rating system in which services could rate things, >in the way that stocks are now rated, doctors/lawyers >could be rated, etc.-- let a thousand ratings services bloom. >(or maybe we were talking about reputations. in my mind, they are >mostly interchangeable--hence my interest in "rating" systems). ..................................................................... In consideration of the difference between "ratings" and "reputation": I think of a rating as something which is attached to something "pre-knowledge", whereas a reputation is something which develops over time & based upon informed knowledge ("after-knowledge"). A rating is applied to something (a service or whatever) by only those few individuals who are acquainted with what they are rating. A reputation is accumulated by the impressions made upon larger numbers of individuals - a general population not necessarily employed to collect these impressions - but who have nevertheless sufficient exposure to and acquaintanceship with the person/service/etc. to make an informed conclusion about it. A rating can make a statement on what something "is" or is expected to be (eg, general in content vs explicitly sexual), where a reputation reflects on past behavior. .. Blanc

3 2

HAVE YOU HAD YOUR (TAX) BREAK TODAY?
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, As of 1 May, there is yet another reason to do your offshore business in Liechtenstein. On that date the country's first McDonald's opened in the town of Treisen. Liechtenstein is the 95th country to have a McDonald's. It was not reported whether or not the Princely family was at the VIP party that marked the gala opening, or if mutual recognition would be exchanged with McDonaldland. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

No Subject
by Gary Howland 17 Dec '03

17 Dec '03

CRYPTOGRAPHIC EXTENSIONS FOR JAVA _________________________________________________________________ DESCRIPTION This library contains a suite of cryptographic classes for Java. All of the classes have been implemented in native code for performance reasons, and have been tested on Windows 95, Windows NT and Solaris. Download in source or binary form at http://www.systemics.com/software/ FEATURES All of the following have been implemented using native methods: * BigInteger class (based on code from Eric Young). This class implements arbitrary length integers and some associated mathematical functions. * DES class (based on code from Eric Young) * IDEA class * MD5 class (based on code from RSA Data Security, Inc.) * SHA class (based on code from NIST and Peter C. Gutmann) COPYRIGHT This library includes (or is derived from) software developed by (and owned by) the following: * Peter C. Gutmann * NIST * RSA Data Security, Inc. * Systemics Ltd <http://www.systemics.com/> * Eric Young <eay(a)mincom.oz.au> Also planned for release: * Cryptographic library for Java * PGP library for Java * Cryptographic library for Perl * PGP library for Perl

1 0

remailer@utopia.hacktic.nl down
by Alex de Joode 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Release date: Wednesdag, May 8, 1996 Amsterdam, The Netherlands General announcement, Due to recent events the Hacktic Foundation has decided to discontinue its remailing operations, the remailer that is operated by the Hacktic Foundation will cease to exist May 20th. Please update your reply blocks if you use the above mentioned remailer <remailer(a)utopia.hacktic.nl> for your nym reply block. bEST Regards, -AJ- -----BEGIN PGP SIGNATURE----- Version: 2.6.2i iQCVAwUBMZCdsVnfdBSNVpE9AQF85wQAuDfE3icuDCzA99biqd9qk6VK8zUEFvEp OgZvqfGD8OxG8ElnFMQk2VMHskUK8QxidO+zKPUZrJNd4eBSiFSNIK7BAox1xMQm hUGTzLEBBGc3Hxg4pYc3Y2A7PDhU7GJusCZmk89zPUI4ouN+CHYQnZ4PMggB1Hmo coambU0vmD4= =ZdIS -----END PGP SIGNATURE-----

5 7

Re: remailer-in-a-box
by Bill Stewart 17 Dec '03

17 Dec '03

>At 3:51 PM 5/7/96, anonymous-remailer(a)shell.portal.com wrote: >>No one answered me. >>What's the best remailer-in-a-box. >>I'd like to run one. I would think people would be falling >>over eachother to tell me. I was running a modified ghio2-based remailer until I shut it down because of spammers. You should be able to get the code off my web page, or send me email and I'll forward it. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

MD5 weaknesses
by Bill Stewart 17 Dec '03

17 Dec '03

Perry Metzger posted a note to coderpunks about >A paper by Hans Dobbertin dated May 2 in private circulation has found >an easy method for generating collisions (not pseudocollisions as was >done in previous work) in the MD5 compression function. I was told >that this was public information. And somebody provided a URL to http://www.cs.ucsd.edu/users/bsy/dobbertin.ps The coderpunks discussion has been titled Re: Favorate flavor of hash? for which I suppose there are alternative interpretations :-) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

COMMUNITY CONNEXION ANNOUNCES UNCENSORED USENET ACCESS TO THE FRENCH INTERNET COMMUNITY
by sameer＠c2.org 17 Dec '03

17 Dec '03

For Immediate Release - May 9, 1996 Contact: Sameer Parekh 510-601-9777x3 COMMUNITY CONNEXION ANNOUNCES UNCENSORED USENET ACCESS TO THE FRENCH INTERNET COMMUNITY Berkeley, CA - Community ConneXion, Inc., today announced that it will for a limited time offer free Usenet access to anyone in France. The announcement comes in the wake of the arrest of two managers for French Internet service providers. The two managers at WorldNet and FranceNet are being held responsible for the pornographic material distributed on the "alt.binaries" newsgroups. They face up to three years in jail. In response to these arrests, the Association of French Internet Professionals (AFPI) has called for a complete blackout of French newsgroups and many providers in France have cut off news service entirely. Community ConneXion, Inc., has announced free Usenet access to the French in response to the resulting blackout. "'The Internet views censorship as damage, and routes around it,'" said Community ConneXion President Sameer Parekh, quoting a famous saying on the net, "The Internet transcends national boundaries. This promotion makes that fact obvious." Community ConneXion offers full Internet access to its customers, with no content-based restrictions on materials its customers may read or make available on the Internet. During this limited time promotion, people connected to the Internet in France may access a full uncensored Usenet feed merely by pointing their newsreaders at news.c2.net. People in other countries may also get access to a full uncensored Usenet feed by purchasing service from Community ConneXion. Information on how to sign up for service with C2.NET is available at http://www.c2.net/. Community ConneXion, Inc. is the leading provider of privacy on the Internet. Dedicated to uncompromising security, they provide anonymous and pseudonymous Internet services, including secure web services. Information is available at their web site at http://www.c2.net/, or contact Sameer Parekh at 510-601-9777x3.

1 0

hacktic.nl is down!!
by Jim Byrd 17 Dec '03

17 Dec '03

I just heard on IRC channel #scientology from Karen Spaink that hacktic.nl will be down as of 5/20 because of pressure from Scientology. I don't have any more details yet.

3 2

Leahy bill dead?
by jim bell 17 Dec '03

17 Dec '03

Maybe this seems a bit redundant, but is it generally agreed "out there" that the Leahy bill is dead? When originally proposed, the conventional wisdom around here was that the Clinton Maladministration was going to be dead-set against it. (Not a bad guess...) It was also claimed that it couldn't be changed to fix it. (although one of the nyms that claimed this hasn't been seen around here since then...) Since then, most if not all of the people and groups who might otherwise have been in favor of it have, likewise, turned against it. And while the Burns bill isn't totally out of the woods, I assume "we" (the people on the right side of the cryto argument) can all agree that it is at least better than Leahy's booby-trap. So does that spell the end of the Leahy bill? The reason I mention this is because it was my suspicion that, contrary to conventional wisdom, the "anti-crypto" faction designed the Leahy bill to be as anti-crypto as they felt they could pass, including just enough bait to get us to take the hook. Obviously, that tactic failed. However, if I'm right we'll seem some life in the carcass yet. Obviously, this is a highly longshot prediction. "Nobody" is supposed to be for the Leahy bill now. But I'm reminded of the last 20 minutes of the movie, "Terminator"... Jim Bell jimbell(a)pacifier.com

1 0

IP network #s in france
by sameer 17 Dec '03

17 Dec '03

Anyone have a list of all the ip network #s in France? It would be most appreciated. -- Sameer Parekh Voice: 510-601-9777x3 Community ConneXion, Inc. FAX: 510-601-9734 The Internet Privacy Provider Dialin: 510-658-6376 http://www.c2.net/ (or login as "guest") sameer(a)c2.net

2 1

ENIGMA
by Carl Ellison 17 Dec '03

17 Dec '03

>From: danmec(a)inet.uni-c.dk >Date: Wed, 08 May 1996 13:05:24 +0200 >Subject: ENIGMA >To: cme(a)ACM.ORG > >X-Personal_name: Rag > >You may be interested in knowing that a 4 rotor U-boot ENIGMA is up for sale >at Sotheby's in London 30th May. > +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Re: Transitive trust
by Steve Reid 17 Dec '03

17 Dec '03

Submitted for your (dis)approval... -----BEGIN PGP SIGNED MESSAGE----- > And beliefs are in some sense what we are really talking about. There is no > simple scalar quantity called "trust" (at least not one I can imagine), but > different agents will have different beliefs about different things. One > set of beliefs about signatures on keys has a lot of similarities to the > "web of trust." In fact, imagine this "diminishing wavefront of belief" [butchered for brevity] > Can this be more mechanized? Can numbers be attached, and perhaps > propagated? (I mentioned "diminishing wavefront of belief," because > implicit in this viewpoint, inevitably (and rightly, I think), is the > notion that "distant relations" have low probabilities of belief, all other > things being equal. I think we need to make a distinction between belief in identity and trust in competence. Currently, signing a key *only* means that you believe that the person is who they say they are. It should also be possible to state that you believe a person is competent enough to use proper care when signing other keys. Obviously, you wouldn't competence-sign someone's key unless you've known them for quite some time. The "competence web-of-trust" would grow very slowly. This competence-web-of-trust would have to remain tightly-knit, as you wouldn't want to trust anyone more than a couple links down the chain. While the web-of-competence would grow slowly, this small group of people could identity-sign a lot of keys. I know this might sound a bit like a hierarchical structure of trusted people (which it *could* be) it's really more like a web, and anyone could create their own web-of-competence, and the webs could eventually be linked together. Creating a web-of-competence would take a long time, and a lot of effort. But, signing could actually become a paid service, which would give people incentive to gain trust (by being paranoid when it comes to key signing). The most widely trusted people could charge significant amounts of money for the time needed to verify a person's credentials. Of course, there aren't currently many people out there worth paying an arm and a leg to get them to sign your key, but I could see people paying $5-$500 to have their key identity-signed by someone like PRZ. Having a key competence-signed by someone like PRZ would obviously cost a lot more than identity-signing, since it would take a lot more time to gain that much trust. It would not be unlike paying for an education, and with identity-signings being worth $5-$500 or more, it could be a worthwhile investment. Having a key competence-signed by more than one person would increase the value of your key, and once there are a couple good signatures on your key, other people would be more willing to competence-sign it, because there would be less risk involved (risk to their reputation). There would probably have to be more than one level of competence signing. It should be possible to say "I trust this person to use care when identity-signing other keys", and it should also be possible to say "I trust this person to use care when competence-signing other keys". That second type of signature would be *very* valuable, and it would be necessary to have that and possibly even higher levels of trust in order to make the web-of-competance a reasonably large size. When you sign a key, you are placing your reputation on the line, so you must be certain that the level of trust you're placing is appropriate. But what happens when someone goes rogue and ignores credentials, and signs keys of anyone who is willing to pay the price? You would regret signing the rogue person's key. So, IT SHOULD BE POSSIBLE TO REVOKE TRUST, in order to protect your own reputation. PGP currently only allows a person to revoke their own key. Most people would revoke their key if it were stolen, to protect their own reputation. However, some people may be unwilling or unable to revoke their own key, and if you signed that key, your reputation may be affected. Clearly, it should be possible to remove your signature from someone's key. Revoking trust has it's own little problem: Some people might accept cash and sign a key, then revoke the trust in the key, keeping the cash. Easily fixed: the people who have signed the con man's key could revoke the trust in that key, bringing an abrupt end to the con man's key-signing days. What it all comes down to is reputation. Protect your reputation, and you could make a living on your reputation alone. ====================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E6 8C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, IANAL. -- | ====================================================================:) -----BEGIN PGP SIGNATURE----- Version: 2.6.3ia Charset: noconv iQEVAwUBMZEckdtVWdufMXJpAQFSwAgAnhCALlQdfyYJ+Cp3WSXqMiOLG8ubtFJB jUWyXyd3T0u8RxwraIq4emxW4HZZNMBNKet4rZzkA9VqAZ3+p9337jUS6XBuE56V IRLhQy80TyrqwQVpSKXXOmPlZdmhzAF/OJE4LZF4gMh5RIANFTUXzBkVSJ8FsB1C KXjgzk1E+5hdQ0FrwaAc9LIrq6UokhO7pIKb5tlmntXHhtDm+yLpm5QvrCxwnBad 3KlxAtWvQYVQTb5a9bhgnFXVRDjh/lQ1bxncJ1ap1oJP0E6nMfHq282G8UxnrUuY qyksNGJDgWElExzXKntdyqP+bOiIn4jwVyjBcrBZS9V3GxWOPZz4ew== =Z66X -----END PGP SIGNATURE-----

2 2

California AB3320 Regulating Internet Sales - Speier
by Bill Stewart 17 Dec '03

17 Dec '03

ftp://www.leginfo.ca.gov/pub/bill/asm/ab_3301-3350/ab_3320_bill_960502_amend ed_asm Jackie Speier's at it again! Now she's proposing AB3320, a bill to regulate sales of goods and services to protect consumers on the Internet. It's in its third revision, and much improved, but still obviously doesn't get it - the bill talks a lot about physical delivery of services or tangible goods (use or copying of information appears to fall through the rather wide cracks here) and providing written notices and toll-free telephone numbers, not quite realizing that an electronic mail address would do fine. The original bill was a proposal to require computer BBSs that charge for their services to register with the State at a cost of $50. It was marked up into a hybrid bill, and then into current form. I'm not sure what Assemblymember Speier is trying to accomplish, but she's clearly thrashing around trying to define it and do _something_ helpful to consumers. Those of you in her district may wish to get in touch with her and help her understand the Net and electronic commerce and international connectivity and such. Alternatively, if your Senator or Assemblymember is on the committee, you may want to talk to him/her. Here's the current bill status, according to leginfo. MEASURE : A.B. No. 3320 AUTHOR(S) : Speier. TOPIC : Telephone, mail order, and catalog sales: Internet. HOUSE LOCATION : ASM +LAST AMENDED DATE : 05/02/96 LAST HIST. ACT. DATE: 05/06/96 LAST HIST. ACTION : Re-referred to Com. on C.P.,G.E. & E.D. COMM. LOCATION : ASM CONSUMER PRO., GOVT. EFFICIENCY, ECON. DEVELOPMENT COMM. ACTION DATE : 05/07/96 COMM. ACTION : Do pass as amended. COMM. VOTE SUMMARY : Ayes: 09 Noes: 00 PASS 31 DAYS IN PRINT : 03/26/96 TITLE : An act to amend Section 17538 of the Business and Professions Code, relating to sales. ======= Here's a quote some of you privacy supporters may enjoy.... (The {- -} and {+ +} are some kind of addition/deletion markup.) =============== (d) Any {- person -} {+ vendor +} subject to this section who uses the Internet to conduct sales or leases of goods or services shall provide {- an -} {+ a conspicuous +} on-screen notice that discloses the procedures for resolving billing, sales, and service disputes, including the {- person's -} {+ vendor's +} return policy, {- and -} the address where the {- person -} {+ vendor +} may be contacted {+ , and a toll-free telephone number or other cost-free method to communicate the buyer's request for a full refund. Any vendor conducting business from an electronic e-mail or other electronic address shall disclose the legal name and address of that business in writing on any transaction form provided to the buyer +}

1 0

Penet-style web remailer?
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

As a result of scanning through the Nando Times' (http://www.nando.net/nt/) Infotech section, I came across a piece on email with the following address: http://noah.pair.com/anon.html. It appears to be sort of a penet-style anonymous remailer, only without return messages. Anyone know anything else about it? Of course, given the number of web interfaces to fully anonymous remailers, I wouldn't encourage anyone to use it. -Allen

1 0

Internet/Obscenity Legal Gathering in NYC
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I haven't seen this announcement reposted to this mailing list, and I think it's of sufficient interest to warrant reposting: Newsgroups: misc.legal,alt.censorship,misc.legal.moderated,talk.politics,alt.privacy From: ra(a)panix.com (Ron Abramson) Subject: Free program on net censorship in NYC Message-ID: <Dr1vDJ.Cr8(a)world.std.com> Date: Mon, 6 May 1996 17:49:08 GMT Announcement: Free Program On Net Censorship in New York City, May 22 at 7:30 P.M. -------------------------------------------- THE FIRST AMENDMENT IN CYBERSPACE: Regulating the On-Line Dissemination of "Indecent Material" This program will address the issue of the First Amendment as applied to the Internet and On-line services. Special focus will be given to the new federal law which is intended to regulate the dissemination of "Indecent Material" via these mediums. The Association of the Bar of the City of New York 42 W 44TH Street, New York, New York (Bet. 5th and 6th Avenues) (212) 382-6600 Wednesday, May 22, 1996, 7:30 till 9 P.M. Moderator: CHARLES R. NESSON Weld Professor of Law, Harvard law School Panelists: ROBERT FLORES Senior Trial Attorney, Child Exploitation and Obscenity Section, U.S. Department of Justice MICHAEL GODWIN General Counsel, Electronic Frontier Foundation STEPHEN M. HEATON General Counsel, Compuserve, Inc. NORMAN REDLICH Wachtell, Lipton Rosen & Katz, former Dean, New York University School of Law BRUCE TAYLOR President and Chief Counsel, National Center for Children and Families Co-sponsored by: Committee on Computer Law, Joseph P. Zammit, Chair Committee on Lectures and Continuing Education, Normal L. Green, Chair Members of the Association, their guests and all other interested persons are invited to attend. No fees or reservations are required. --- Dr. Dimitri Vulis Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

FBI, DoJ deny invesitgation of CompuServe
by rodger＠interramp.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- on 5-8, Joseph Reagle posted: > COLUMBUS, Ohio, May 8 (UPI) -- The FBI, acting on a complaint from a >Christian morals watchdog group, Wednesday sought to determine whether >CompuServe Inc. has violated a new law against indecency. > FBI agents said they were attempting to determine whether >CompuServe's Entertainment Drive, which contains some adult material, >violates the Communications Decency Act. The law prohibits offering >pornography to on-line users, especially minors. > Reuters, however, just moved a story saying the FBI and Dept. of Justice denied there was *any* investigation ongoing. The agencies were responding to the original stroy which ran in the Columbus Dispatch, Such denials are *extremely* rare; agenices almost always refuse to confirm or deny investigations. Those of you with access to AOL can check the story out in technology news. Will Rodger -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZEUDEcByjT5n+LZAQFt0gf+MnIkM51VD9wlVwNG6KFTZGeYsJMFVViZ 5uRA6na7R9jNSL9u4zxJjYJxPkEDUO64z87ZV2tODXTOJdFfencOycCsy+oDR0da 1fObsFCqZN1Rh2ZNspgG4TpTLZVUn/naiZoA4jyFlRyXV8qa19Zwro5S0a9JfHj9 xofxhBwCb/Sdw4kKDRgqfnehrKVlIRaQw3kR9TetF+Olm2czF2iIoeQTlwUR7y10 SY+vqxApyACLTkwfPP/Y/H/uwMFTQbcMPCbI7yoK/AnPRywC0pV//b6JkSaMvcm3 ZhdyiUkpY6gRr0MAB4fwe2ho/zRLXj7bEQ2pSQJcRSpm2Tl+Zq4U9w== =ffRy -----END PGP SIGNATURE-----

1 0

Re: Remailer in a box
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Questions. How much memory does the Mixmaster remailer take up? What accesses/permissions/etcetera on a machine do I need to have in order to have it running on an account? Has anyone set up one such that it will only remail from & to a set of addresses (e.g., other remailers)? I, for instance, wouldn't be willing to deal with the hassles involved with running a remailer that was either what the end user would see (thus getting potentially deluged with help questions) or the end mailer (thus getting potentially in problems if someone abuses the remailer)... but I (and others) might if it was set up just for chaining. (Yes, I know I'd need a UNIX account... I'm looking into that.) Speaking of UNIX, does anyone have any existing programs to automatically mail out at random intervals a looping or /dev/null directed message through the remailers, in order to increase security against traffic analysis? Thanks, -Allen

1 0

"Architectural considerations for cryptanalytic hardware" paper on the web
by Ian Goldberg 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- For anyone who was interested in Dave's and my hardware project (Architectural considerations for cryptanalytic hardware), it's done (thank goodness). You're free to check it out at http://www.cs.berkeley.edu/~iang/isaac/hardware/ in either HTML or PostScript. Thanks to cypherpunks Eric Hughes and Bruce Koball, and to Altera people Clive McCarthy and Stephen Smith. - Ian "...pray for an 'A' for us..." -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZE64UZRiTErSPb1AQHczwP+IF47Zg4VpecVFj+ei0AAr2h9ZVTV01nb lsUXAwWpKla2LJ+sJGrSQmpu0Sd/wkIIGeTWnbCLiR+d4pdbKN2nwfHp6evjzEnw luWWeuCFq51L0AViBGyu2r11IiAPGGIXWclb8dqqjL1YLtnJ/CCXXRbSGbJ7YdqO 6GBAMv13IgA= =5IGV -----END PGP SIGNATURE-----

1 0

[off-topic] *.alias.net disappeared?
by David E. Smith 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I'm sorry for posting this to the list, but I've no other apparent way of getting in touch with these parties. The alias.alias.net and nym.alias.net servers have disappeared; in fact, nothing in *.alias.net is still in any DNS that I can find. Have these sites disappeared, or am I just in a very bad corner of the 'net? dave -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== =kZSL -----END PGP SIGNATURE----- --- David Smith, Box 324, Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith des(a)juno.com Reality is only for those lacking in true imagination

1 0

DigiCash agreement with Deutsche Bank
by minow＠apple.com 17 Dec '03

17 Dec '03

According to an article in a Swedish newspaper, Svenska Dagbladet (http://www.svd.se/svd/ettan/ettan.html) DigiCash has closed an agreement with Germany's largest bank, Deutsche Bank, that will permit commerce on the Internet using digital cash. The system will be tested first internally within Deutsche Bank to check the security of the system, followed by a limited rollout this autumn, with major distribution expected early next year. A customer of the bank can "click on the DigiCash icon and confirm the amount of German Marks required. The digital money is automatically downloaded to the customer's computer and stored on disk in various amounts." To purchase something from a homepage, the customer's computer sends "digital cash" to the seller. The seller confirms via the bank within two seconds that payment was made. Translated (quickly) and summarized by Martin Minow minow(a)apple.com

1 0

Java Hole: Web Graffiti & Covert Channels
by Chad Owen Yoshikawa 17 Dec '03

17 Dec '03

-------------------------------------------------------- Web Graffiti & High Bandwidth Covert Channels Using Java -------------------------------------------------------- While developing a chat server using Java as a frontend, we've been exploiting what we think is a new Java security hole in Java-enabled browsers such as Netscape. The hole allows for opening sockets to arbitrary ports on web servers that serve Trojan-horse applets. We've also used a known security hole (covert channels) first mentioned in work by the SIP group at Princeton to create what we call 'Web Graffiti' - the dynamic insertion of text, graphics, applets, into HTML pages. Both of these attacks are three-party attacks and require Trojan- horse applets. For a draft of a paper that is work in progress, point your browser to: http://whenever.CS.Berkeley.EDU/graffiti/ Chad Yoshikawa Brent Chun chad(a)cs.berkeley.edu bnc(a)cs.berkeley.edu

1 0

re: Dempster-Shafer...(re: Transitive
by watson＠tds.com 17 Dec '03

17 Dec '03

tcmay's approach is elegant, and it's refreshing to find a practical use for AI approaches. I think it needs one more step, though. If we learn to quantify our trust in a key, we still need to know what the threshold should be for a given application. Maybe I can get by with a 0.05 Bel for posting to cypherpunks, but maybe I want a 0.95 for a monetary transaction. Seems to need a comprehensive risk management approach,

1 0

Re: Senator Leahy's Public Key
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 1:16 AM 5/9/96, Eric Eden wrote: >What if you needed to set up a key server for a mass base of customers... >Obviously, authenticating them via e-mail would be difficult, verifying >them in person would be harder. Would there be any reasonable way to "Verifying them in person" would, in fact, be essentially impossible. Few sources of documentation mean much, in fact. Consider that I joined Intel in 1974 and was never once asked for any form of identification...I just showed up for work under my assumed name, Tim May, and no one was the wiser. Ask yourself this: Have you _ever_ really "verified" the identity of your girlfriend, your friends, your co-workers? (I mean this not to pose an existential riddle of no real significance, but to remind people how seldom we ever actually try to verify that people are "really" who they say they are.) ... >pretend that the labor is not the deciding factor. What would be the >best way to verify the customers keys if you couldn't visit each >customer in person? Representatives from my ISP, got.net, have attended some of my parties...and they _still_ don't know that I am _actually_ Irving J. Schlublutz, temporarily masquerading as "Tim May."\ >For example, would a photo copy of a drivers license be enough? For which purposes? DLs are notoriously easy to forge. I think $25 is the going price. (And DLs which would fool people like us are probably doable on any H-P color inkjet printer.) My point in all this being that "proofs of identity" aren't all they're cracked up to be. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: [off-topic] *.alias.net disappeared?
by loki＠infonex.com 17 Dec '03

17 Dec '03

John Perry (perry(a)jpunix.com) was running the alias.net services. Because of work commitments, he was not able to continue to run alias.net -Lance At 6:53 PM 5/8/96, David E. Smith wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >I'm sorry for posting this to the list, but I've >no other apparent way of getting in touch with >these parties. > >The alias.alias.net and nym.alias.net servers >have disappeared; in fact, nothing in *.alias.net >is still in any DNS that I can find. > >Have these sites disappeared, or am I just in >a very bad corner of the 'net? > >dave > >-----BEGIN PGP SIGNATURE----- >Version: 2.6.2 > >iQEVAwUBMZFB9TVTwUKWHSsJAQHfigf9F52pD+b+bUzK9GYVh4LgP988wG1e7VIp >rF9ouG2AOw+ipLQliv/cbgS9DiOg3/8IIvIZnfhZo8M1oFJ0LaaOh3BH0rsMh0RP >elkFtoAaGojcP04x/LvRm/S+NaZRfK+iIoFRxiI50rCYgXcQR9OmqwdtQ9I92k7L >jlASFwAWAJqdE6uhGxgMOAoPcLP5R+qBB83BsJguAnMBGmrPco8zfMtaRFhdjn74 >xS8DXSjfqktPGZRnyqH/mddV1P2dLpPFEMS+V79ZrcARQ9IEQzb0zWSx5ET+wza+ >x8cnRhBUhkybmLM+H54YSEDlv0asWWJNBUev1sb64PV3VMMhyJAwjg== >=kZSL >-----END PGP SIGNATURE----- >--- David Smith, Box 324, Cape Girardeau MO USA 63702 >http://www.prairienet.org/~dsmith des(a)juno.com >Reality is only for those lacking in true imagination ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

2 1

Re: Transitive trust and MLM
by loki＠infonex.com 17 Dec '03

17 Dec '03

At 11:32 AM 5/8/96, Raph Levien wrote: <SNIP> > One encouraging consequence of this model is that densely connected >subgraphs can result in highly trusted keys even if p itself is quite >small. In a clique of size k, the trust is (very) roughly 1-(1-p)^k. For >example, if p is a mere 50%, then in a clique of size 10, each key in >the clique is trusted with a probability of 99.9%. > This computation is (I think) known as the network reachability >problem, and is probably quite hard to evaluate. In practice, you'd >probably want to compute upper and lower bounds instead, > > Let's see if we can come up with a model that preserves this property >of giving high trust values to densely connected keys, yet is also >highly resistant to (some plausible model) of attacks against the Web of >trust. > >Raph I like this. The most obvious attack on key signatures is to cross sign a huge number of bogus keys, is of no benefit. As the density of this bugus-clique increases, it comes closer and closer to acting as a single entity for trust calculations. Then your trust calculation for any key in the clique is simply your trust of the real key which signed all the bogus ones. It should be no time at all before most reputable key signers cut all links to that key. Another nice property of this calculation of probability is that it automatically drops off exponentially with the number of links (at least along any one chain). We need to think about how much we want multiplicity of paths to bolster our trust. Here is the scenario I want to avoid: Mallet creates a large number of keys: A, B, C[...]. C is a large set of keys. A is the Key Mallet uses publicly. It has a few signatures. B is the key Mallet uses to sign keys who's trust he wants to boost. In addition to signing B with A, Mallet also signes all the C[i] with A, and signs B with all the C[i]. This multiplicity of paths should not boost the trust in any key which is reached through this complex. In general it may be difficult to decipher which paths you want to follow in multiply (and cyclically) connected paths. I suppose one approach to this would be to pick various ways of calculating trust, and see if anyone can come up examples to attacks to exploit them. -Lance ---------------------------------------------------------- Lance Cottrell loki(a)obscura.com PGP 2.6 key available by finger or server. Mixmaster, the next generation remailer, is now available! http://www.obscura.com/~loki/Welcome.html or FTP to obscura.com "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche ----------------------------------------------------------

1 0