December 2003 - cypherpunks-legacy

INFO: Transcript of Sen. Leahy's RealAudio chat now available! (5/22/96)
by Voters Telecommunications Watch 17 Dec '03

17 Dec '03

============================================================================= ____ _ _ _ / ___|_ __ _ _ _ __ | |_ ___ | \ | | _____ _____ | | | '__| | | | '_ \| __/ _ \ _____| \| |/ _ \ \ /\ / / __| | |___| | | |_| | |_) | || (_) |_____| |\ | __/\ V V /\__ \ \____|_| \__, | .__/ \__\___/ |_| \_|\___| \_/\_/ |___/ |___/|_| REALAUDIO TRANSCRIPTS OF LEAHY'S WIREDSIDE CHAT AVAILABLE CLIPPER III RESOURCES AVAILABLE REP. RICK WHITE (R-WA) SCHEDULED FOR HOTWIRED CHAT 6/5/96 9-10PM EST Date: May 22, 1996 URL:http://www.crypto.com/ crypto-news(a)panix.com If you redistribute this, please do so in its entirety, with the banner intact. ----------------------------------------------------------------------------- Table of Contents News How to receive crypto-news ----------------------------------------------------------------------------- NEWS Rave reviews of Senator Leahy's appearance on HotWired's WiredSide chat are coming already. With this appearance, the gentleman from Vermont proves once again that he knows net.politics on a personal level, and can understands the subtleties that we assume many in Congress are just learning. If you missed Sen. Leahy's appearance, arranged by HotWired, the Center for Democracy and Technology (CDT), and the Voters Telecommunications Watch (VTW), you can still hear the Realaudio transcript from the front page at http://www.crypto.com/ A new Clipper III section has been added to www.crypto.com, with pointers to the online version of the White House proposal and the initial analyses from EPIC, CDT, and John Gilmore of the EFF. DON'T FORGET! Representative Rick White (R-WA) will be on HotWired Wednesday June 5th at 9pm EST at http://www.hotwired.com/wiredside/ You can tune in and listen to the chat with the RealAudio software (http://www.realaudio.com) You can ask questions of the Representative through a moderator and get real, immediate responses. Rep. White is part of the new breed of legislators leading Congress to make better net policy through his leadership in the Internet Caucus, a vanguard group of legislators who have vowed to provide sound leadership and advice to other members of Congress in the area of net.policy. ----------------------------------------------------------------------------- HOW TO RECEIVE CRYPTO-NEWS To subscribe to crypto-news, sign up from our WWW page (http://www.crypto.com) or send mail to majordomo(a)panix.com with "subscribe crypto-news" in the body of the message. ----------------------------------------------------------------------------- End crypto-news =============================================================================

1 0

PROTOCOL: Encrypted open books
by tcmay＠got.net 17 Dec '03

17 Dec '03

>Date: Thu, 26 Aug 93 11:28:14 -0700 >From: Eric Hughes <hughes(a)soda.berkeley.edu> >To: cypherpunks(a)toad.com >Subject: PROTOCOL: Encrypted open books >Status: OR > >Note: I started this reply last week; I've decided to post what I >know, since I don't have a solution and I've run out of simple ideas >for now. > >Hal' criticism that (real) money could leak out of the system is >correct. The problem is that while the books would still balance, >i.e. sum to zero, some fake depositor would have a negative balance, >the net result of taking out more money than you put in. Negative >numbers just aren't allowed in double-entry bookkeeping, but they were >allowed in the first protocol set. > >The first part of the solution is to allow no private accounts on the >left hand (asset) side of the ledger, in other words, no anonymous >loans. A protocol for doing anonymous loans could be invented, but >since the first problem is merely to run a money exchange and not more >complicated financial services, this is acceptable. Most of the money >that left the S&L's was by corrupt loan practices, so I don't consider >this omission a particularly glaring one right now. > >Therefore all the private accounts must be on the right hand side, >that is, they are all liabilities. In layman's terms, the bank owes >you; should you ask for your money, they have to give it to you. If >we can verify that each of these accounts never goes negative, then we >can be certain that if the books balance, that the amounts of money in >each account are accurate. > >Consider this. If money was transferred from your account to another >one, that transaction shows up in the public encrypted transaction >record. If you have due diligence over this record, you can assertain >that no transaction was performed against your will. This case >corresponds to a debit and credit against two customer accounts, >decreasing one and increasing the other. > >Another way that money might end up in a fake account if it were >credited with assets. A debit to an asset increase its value and the >credit to the account increases that value. This is the case of a >deposit; the bank gets cash (+asset) and credits someone's account >(+account). Now if they want to give someone money this way, they >have to do so by increasing the assets somehow; in other words, they >money has to come from somewhere. It didn't come from any of the >customers because they've already verified that. It didn't magically >appear from one of the other asset accounts because these are all >publically audited. > >In summary, we need to ensure that all accounts have positive balance. >Public accounts can be revealed and seen to be positive. Private >accounts need a cryptographic assurance. > >A private account starts off at zero. This can be publically >revealed. Then to the encrypted transaction log and the public cyclic >balances we add publication of the private balances in encrypted form >that allows us to verify to the blinded balance is positive. This >balance is verifiably linked to previous cyclic balances via the >transaction log. It is therefore linked all the way back to the >beginning balance which was zero. > >Consider all the transaction triples for which the first element is >equal to the private account in question, since the account was >opened. Take a product of all of the second elements and a product of >all the third elements. It is clear that these products can be >calculated inductively from the previous cyclic products and the >activity in this cycle. > >The products on second and third elements are equal to > > g^( Sum x_i,j,t + Sum r_i,j,t ), h^( Sum r_i,j,t ) > >where I've added a time index by cycle which was implicit before. The >notation for the inductive calculation is different, of course, and >also obscures the underlying invariant. > >What we want is a certificate that Sum x_i,j,t is positive. Here it >gets a bit hairy. There are likely other solutions to this technical >requirement; here is the one I thought up yesterday and today. > >I thought I had an idea with promise on how to create such >certificates using quadratic residuosity, but it doesn't work. I'm >still thinking about it; this certificate doesn't seem impossible to >create, but the standard ideas that I know about in algebraic protocol >design don't seem to work. > >If anybody wants to work on this technical point off-line with me, >send me mail. The math involved is advanced enough that I'd prefer to >post summaries of work rather than all the detailed discussion. > >Another non-technical attack on the problem is to require periodic >bank holidays, where all private balances will be revealed to be zero >(preferably), or whatever is actually in the account. This doesn't >prevent owner fraud, but does put an upper bound on the time in which >to perpetrate it. > >Eric

1 0

re: "Very Famous Reporter"
by Deranged Mutant 17 Dec '03

17 Dec '03

On 21 May 96 at 10:06, Robert Hettinga wrote: > In the meantime, it appears that I have egg on my face, as no story has > emerged... > > By the way, did I say it was a rumor? ;-). Likely the Very Famous Reporter (tm) misheard something about MD5, confused it with DSS (and possibly even something to do with PGP), though (s)he had a hot story, spoke to some folx, and it fizzled. Nah. Just a rumor. Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

No Subject
by unknown＠example.com 17 Dec '03

17 Dec '03

The answer to information is more information.

2 1

Re: PROTOCOL: Encrypted Open Books
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 05:45 PM 5/22/96 -0700, David Wagner wrote: > a fake account, without a real >customer, and fakes a transfer into that account, pocketing the >money that should have gone into that account? Then the total indebtedness of the bank will go up, but its total assets will not. If the bank does this, then there is no point. If an employee does this, then the loss will show up on the books. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Long-Lived Remailers
by David E. Smith 17 Dec '03

17 Dec '03

At 20:40 22 May 96 NSA operative Loren James Rittle <rittle(a)comm.mot.com> wrote... (This was originally me. Wow.) > >:: > >Remailers-To-Chain: 7 > >Remailers-To-Avoid: remailer(a)nsa.gov > >Final-Destination: tcmay(a)got.net > > This will not work. The original sender must pick the path himself, > if maximum encryption to hide the final destination is to be used. > The properly used cypherpunks-style remailer network provides that as > long as even one remailer in the chain is trustworthy, your secret is > safe. Under your scheme, if the first remailer is untrustworthy, > everything is blown. This is because unless the original sender > pick's the path (or at least the last hop explicitly), the final > destination and message must be available to each hop. Well, I freely admit that it was just a notion that sort of came to me whilst at the terminal, with a beer on the desk. The sort of thing that often impairs my already-limited judgment :) Although... is this a possible way to lessen remailer-operator liability? If it is known that every remailer along the way chooses another remailer at random, it might become less likely to hold any given last-hop remailer liable for the CO$ documents spewed forth from it. It would become necessary to keep track of the final destination and to decrypt at every stage, unless there's a set Last-Hop: header; but that would defeat the whole purpose. Having traffic going all over the place randomly might be useful to defeat traffic analysis, though. I think I've just argued myself out of the whole idea. Never mind :) dave ObCPList: Have I been killfiled yet? If you don't see this message, send me a note :) ---- David Smith Box 324 Cape Girardeau MO USA 63702 http://www.prairienet.org/~dsmith dsmith(a)prairienet.org Reality is only for those lacking in true imagination... Send mail w/'send pgp-key' in subject for PGP public key

1 0

Re: FTC online workshop on privacy
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"declan+(a)CMU.EDU" "Declan B. McCullagh" 22-MAY-1996 19:58:03.69 >Excerpts from cypherpunks: 22-May-96 Re: FTC online workshop on .. by "E. ALLEN SMITH"@ocelot. >> It's unsurprising that some of the same groups backing the CDA are >> backing this, since they used danger to children as an excuse for it. (A >> rather transparent one, given the actions vs Compuserve). I am >> disappointed in EPIC for cooperating with them. >You shouldn't be, and I should have been more clear. There is a broad >coalition of groups supporting this legislation, including (from memory) >the Kids off Lists! project, Center for Media Education, and Consumer >Federation of America. This appears to be another liberal (e.g., EPIC) vs libertarian difference. Liberals say we've got to have laws to protect the children, such as via keeping them from _email_ lists. Libertarians say it's the job of the parents (and the police, for non-anarchists) to protect the children. Yes, such lists can be misused (although I see no more reason to say the email ones can be truly misused than to say the CDA was justified). So can, say, cryptography. -Allen

1 0

NOISE.SYS and Win95?
by wlkngowl＠unix.asb.com 17 Dec '03

17 Dec '03

I've just got a Pentium and Win95 so I can try to get NOISE.SYS working for both. It seems to crash in Win'95 though... not sure why yet: has anybody used it or had problems with it on Win95/DOS7? (I've gotten it loaded using a device driver loading util from the command line, but the RANDOM$ device produces only one byte and a string of zeros... not good at all. Very bad, actually. URANDOM$ seems to work fine though.)

1 0

Re: An alternative to remailer shutdowns
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"minow(a)apple.com" 23-MAY-1996 01:57:15.69 >-- The remailer operator is legally enjoined from reading messages > transversing his system. (For example, the remailer is subject to > data privacy laws.) I suspect that it is rather unlikely that the court would find a remailer operator covered by those laws. >-- The message was encrypted using the intended recipient's public key. > (This means that, without access to the private key, the operator > has no mechanism to examine the e-mail.) This is related to the old ISP liability question, although amplified by being not only a practical impossibility to filter but close to a physical impossibility also. (Please note the "close" part.) I am not sure if a judge could find any grounds to slap a remailer operator with contempt of court in such a case, but if it were so, Uni has pointed out that it's rather difficult to override a judge in such a matter, even based on plain facts. -Allen

1 0

Re: FTC online workshop on privacy
by Deranged Mutant 17 Dec '03

17 Dec '03

On 22 May 96 at 11:16, Rich Graves wrote: > I'd have to see the bill, but I think it's a good general idea, provided > there's the caveats KNOWINGLY and WITHOUT THEIR [parent/guardian's] > KNOWLEDGE. As much as I hate direct marketers, I don't want them subject > to malicious and arbitrary prosecution because one address out of > thousands happens to belong to a kid. When I was on the FTC privacy list a while back there were more details about that. Companies would set of very commercial web sites oriented towards kids, for the main purpose of getting the kids to give information about themselves. So imagine if somebody set up a Barney fan page with all sorts of links and goodies but with the encouragement (if not requirement for access) to fill out personal information, even personal info about family members. Ok... maybe that's within one's right. But while (most) adults would be suspicious, it's not necessarily so with some children... (who'd give out parent's CC#'s if they knew them). Teaching kids basic privacy issues is a whole lot better than legislation. (Caveat emptor aside, fraud and cons are still illegal...). I haven't seen the legislation so I won't rant for or against it (at least not on the list) for now. Rob. --- No-frills sig. Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

[SCARE]: "If you only knew what we know..."
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:53 PM 5/23/96, jim bell wrote: >Well, he must have learned it all in the last few months, because his bill >was the closest thing to DOA that we've seen in a long time, exceeded only >by GAK 3. I'd like to hear from him what the source of the text of the >Leahy bill on encryption really was: Who pressured him to make it so bad? "If you only knew what we know..." ("...you wouldn't support encryption, you wouldn't push for privacy legislation, you would order all citizen-units to have tatooed ID numbers on their arms...") Though I normally avoid "Wired," I did pick up the latest issue to skim through. A couple of good things, actually, including a nice summary of the state of crypto laws, etc. (I don't recall the author, as I didn't buy the issue.) A great discussion of the Deepest and Darket Secret in Washington, the special "If you only knew what we know..." briefing given to legislators, staffers, etc. to convince them of the Evils of Cryptography. Paraphrasing the "Wired" item, "No person who has ever received "The Briefing" has ever again argued forcefully for the rights of citizens to use strong cryptography." I surmise that either Sen. Burns has not yet been given The Briefing, or he is for some reason more resistant than most other burrowcrats to the scare tactics used in The Briefing. I sure would like to know what's in this briefing. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

8 9

Re: (Another) alternative to
by Jay Haines 17 Dec '03

17 Dec '03

Reply to: RE>(Another) alternative to remailer shutdowns Where would these message parts be put back together/decrypted? Wouldn't this require the receivers mail program to re-generate the original message? -------------------------------------- Instead of having the last remailer in the chain store the plaintext of an encrypted anonymous message, it might be more convenient to have the sender split the message into two messages and send these. The first message would contain random characters, and the second would contain the xor of these random characters with the anonymous message. By themselves, each piece would, of course, be harmless random text, so remailer operators greatest crime would be spamming. If the two pieces were sent through chains with different last remailers, no one operator could be held accountable, and, of course, it would be ridiculous to suggest that one operator could be held responsible for that fact that another sent some random text which happened to be the xor of the random text another had sent with a harassing message. (For instance, the other operator could be trying to frame the first, with the help of the receiver.) It seems to me that the only way to deal with a remailing scheme of this kind would be outlaw anonymous remalining in general. Leonard

2 2

subpoenas coming against 2 anon remailers?
by Jim Byrd 17 Dec '03

17 Dec '03

This was posted by henri(a)netcom.com to alt.religion.scientology: ---------- -----BEGIN PGP SIGNED MESSAGE----- I have just received urgent email from Grady Ward regarding the case against him by the cult of $cientology. Apparently, the depraved and insane cult of degenerates and reprobates has decided that Grady Ward is responsible for the recent posting of the NUTS scriptures, the final secret of the crime cult. Many of these 'scriptures' are simply recipes for crime, including how to practice medicine without a license and get away with it, in defiance of Judge Gessell's order demanding that they cease that fraud immediately. Nevertheless, this demented nut-cult has demanded a third-party expedited subpoena to obtain the records from the University of Maryland which they claim will prove their preposterous allegations. Two unnamed anonymous remailers will also be harassed in this bizarre fashion, though news on that is sketchy. The deranged and idiotic cult cites as 'evidence' of their ludicrous allegation that Grady filed a Motion to Dissolve the injunction against him after the NUTS pack was posted, on the grounds that it was then moot. This is the sole 'proof' they have. Bullshit and lies. So the nut-cult intends to rape remailers with no evidence at all. - From the criminal cult's filing: ". . .strong inference that defendant (1)is or is acting in concert with SCAMIZDAT; (2) has made postings of Plaintiff's Advanced Technology works; (3) may have made or been acting in concert with those who made the May 6 postings of the NOTs works for the express purpose of undermining the injunction entered herein. Defendant certainly let no grass grow under his feet in attempting to take advantage to [sic] those postings by asserting the invalidity of the injunction four days later. "As the collusion become more and more apparent with the latest blatant attempt to destroy RTC's trade secrets, the need for complete and expedited discovery of defendant becomes even greater." Not a scrap of evidence is offered that Grady Ward had anything to do with SCAMIZDAT, is SCAMIZDAT, or even knows who SCAMIZDAT is. Just brazen lies, bizarre accusations, and increasingly shrill and hysterical court filings, now even including sloppy grammar, as the cult lawyers are obviously working without sleep, and possibly under the influence of mind-altering drugs. In further proof of Grady Ward's guilt, the clam-cult offers the fact that Grady Ward has exchanged email with Alex de Joode, who operated the now-defunct remailer at utopia.hacktic.nl. Obviously, anyone who would associate with such a nefarious remailer operator must also continually post NUTS packs. In more absurd claims of the cult, they actually have the gall to accuse him of "taking advantage" of not having a lawyer while facing a worldwide criminal organization which has retained dozens of lawfirms simultaneously in order to fight its frivolous lawsuits against everything in existence. They are claiming that Grady Ward is somehow at an advantage over them because he doesn't even have a lawyer. They are also claiming, this cult which filed hundreds of lawsuits against the IRS alone, to dodge their taxes, that somehow the net "tricked" them into suing everything in sight. They also claim that Grady Ward (and everyone on the net) obviously keeps huge archives of mail and news, because "it is inherently unbelievable that defendant retypes several paragraphs of identical wording in message after message." In short, what the cult is claiming is that quotes ">" in USEnet followups prove that you keep huge archives. Apparently, these invidious cretins have never heard of the "F" key on a keyboard. One wonders how they manage to type a single word. "uck you you motherucking uckhead" just doesn't have the same "zip" without an "f" in there now and again, does it? They also accuse him of keeping huge archives, despite the fact that he doesn't keep any, because he had a list of cancelled messages that were feloniously cancelled with forged control messages, despite the fact that Ron Newman's web page at http://www.cybercom.net/~rnewman/scientology/home.html keeps a complete tally of all the forgeries. The cult then tries to impugn all of Grady Ward's exhibits as "unauthenticated and hearsay," because they're USEnet posts, while submitting as exhibits all of Grady Ward's posts, which by their own claims are ALSO "unauthenticated and hearsay." In other words, they've blown their own case out of the water! Well, their case is doomed, but it's still entirely possible that this imbecilic cult of droolers could cause some damage to remailers in their last dying thrashings. h - -- fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck f f u "When you can't say 'fuck,' you can't say u c 'FUCK THE CDA!' -- Lenny Bruce rephrased c k k fuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuckfuck ObURL: http://www.cybercom.net/~rnewman/scientology/erlich/defense-fund [ For Public Key: finger henri(a)netcom.com ] -----BEGIN PGP SIGNATURE----- Version: 2.6.i Comment: PGP signed with SigEd v1.3.1 - http://www.nyx.net/~pgregg/siged/ iQCVAgUBMaKFP2130hVrA/MJAQFaDgQAmWYgLr78HTeH7uNF9pcWnu862IokSt1d sIR9jjlKRApSSjiOPkNInDf4XwTHUsx6VxpAV16f4d2lEJrNcoRH1sizEKnNeEi3 +V5tqsdaawzYWi6kncHfONTqElshmWnRvXh5Zs1cjW11xjoXlWn2GEViKKO8UHtm vsK3PXuJEsg= =+ybQ -----END PGP SIGNATURE-----

1 0

Re: The Crisis with Remailers
by Matts Kallioniemi 17 Dec '03

17 Dec '03

At 15:04 1996-05-22 -0400, Perry E. Metzger wrote: >However, accounting systems DO NOT use 32 bit fixed point arithmetic. > >One client of mine had around $10Billion under management. Do you >think they were doing their accounting on a system that could only >deal with fixed point numbers of 45Million or so? Hell, individual >trades are larger. Sure, but we were really discussing Ecash(tm), not accounting. To quote from the FAPI: /* An EC_Amount is a signed 32-bit integer. It represents an amount * of money in units of the coinage's base value. */ >Accounting systems require exact math -- down to the cent. Come on, we're not talking cents here. Question is, how do you represent a one ITL coin in Ecash(tm) with a USD mint? We are way below the cent level, where no accountant has ever gone before... Regards, Matts

2 1

Re: PROPOSAL
by Jay Haines 17 Dec '03

17 Dec '03

Reply to: RE>>PROPOSAL Thirded, with bilateral agreement. -------------------------------------- >Motion: To create the alt.politics.assassination.politics newsgroup and >the "AP" mailing list so as to clear the meaningless traffic (for which I >am significantly responsible) out of this forum. >Any seconds? So long as the AP list is specifically for debates about the ethics of such, seconded. If it would remove from cypherpunks discussion of implementation or of social consequences, that wouldn't be good, since the implementation of this is definitely cypherpunks material. -Allen

1 0

TILT! Counterfeit pachinko cards send $588 million down the chute.
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

The WSJ of Wednesday, May 22nd, 1996 (A18) reports that two Japanese firms lost about 55 billion yen when criminals counterfeited the stored money cards that they manufactured. These cards are used to pay for pachinko games, but you can get refunds wired to an account if you cash in a card. If my memory serves me correctly, there is a certain amount of skill involved. If you play well or are lucky, you might even add money to the cards. But I'm not sure about this detail. In any case, the people with the counterfeit cards could get refunds when they didn't pay for the original card. The Journal mentions three interesting details. First, the cards were pushed by the police as a means to track the flow of cash and stop money laundering. Obviously, there wouldn't be these losses if they could really track the flow. Second, the convenience of the new cards initially boosted profits because it was so much easier to play with the cards that automatically kept track of your money. Finally, the Journal reported that there are 18,244 pachinko parlors in Japan.

1 0

SURVEY: Trading on the Internet
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: Ian Grigg <iang(a)systemics.com> (by way of Rachel Willmer) Mime-Version: 1.0 Precedence: Bulk Date: Thu, 23 May 1996 12:37:41 +0100 (BST) From: Ian Grigg <iang(a)systemics.com> (by way of Rachel Willmer) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: SURVEY: Trading on the Internet Following on from The Spring Street Brewery's successful IPO, I am researching the nature of Internet issues of debt and equity. This envisages the use of electronic token value systems such as Digicash and the digital bearer bonds that Bob talks about. The topic is for a management report that I am writing as the final deliverable in my MBA, and has a lot of bearing on what we are trying to do within the embryonic Internet Financial System. So, making whatever assumptions you like (but please mention them), here goes with some questions: ----8<----8<----8<----8<----8<----8<----8<----8<----8<----8<---- Would your company be interested in the idea of issuing on the Internet? What specifically would attract you to issuing on the Internet? What specifically would worry you? Would you prefer Debt (bonds) or Equity (shares) (or something more exotic)? What sort of products/services does your company sell? Do you think Internet users would be attracted enough to your company to give you money (e.g. are you the Netscape of '97)? If not the general Internet community, who would buy your shares or bonds (local community, funds, family+friends, business contacts...)? ---->8---->8---->8---->8---->8---->8---->8---->8---->8---->8---- That's it, thanks in advance for your patience. Please forward to me directly, rather than posting (but post any deeper questions as they will, no doubt, be welcome). I am not interested in direct marketing anything (and please don't ask for a list of respondents), but any interesting answers I would like to follow up by email to develop them. Indicate if you want some summarised feedback (won't be for a few weeks). -- Ian Grigg iang(a)systemics.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: MixMaster fair use
by Bill Stewart 17 Dec '03

17 Dec '03

At 12:14 AM 5/22/96 EDT, you wrote: >From: IN%"loki(a)infonex.com" 21-MAY-1996 17:19:02.59 > >>The problem is RSAREF. I can't chose license terms for that. > > Oof... I see the problem. No, it's not you, it's them. The Agreement, as written, covers all of Mixmaster; it would be easier for people to adapt Mixmaster code if you either release a bones version or a license that clarifies that you can't use the RSAREF portions commercially but can do whatever you want with the rest of Mixmaster (if that's what you want) or however much freedom you want to grant (e.g. you may want to say some disclaimerish words about obeying ITAR etc.) Consensus.com is doing commercial licensing for RSAREF now; there may be some reasonably-priced approach to the problem. RSAREF has at least three kinds of legal protection: - contract (if you're using a licensed version) - patent (on doing RSA-method encryption, not on the code itself) - copyright (on the RSAREF code itself.) # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

1 0

Re: An alternative to remailer shutdowns
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:05 PM 5/21/96 -0500, you wrote: >To make it easy, how about a two part MIME message with the key and the >PGP-encrypted message. The message text would be directions on opening >it up, and breaking the "seal", which constitutes acceptance of the >remailer terms... Is that really any different than delivering the message rot-13? One of the reasons people object to getting anonymous email is spam; sending "You have mail; pick up message-id #2718281828 by midnight tonight!" encourages you to go to some effort to pick up the message, so you'll be even more annoyed if it's spam. Similarly, for hate-mail. PROPOSAL -------- On the other hand, a pickup system could reduce directed spam, if people generally don't pick up remailer pickups unless they recognize the messageid, leaving the remailer system to people who actually want to communicate with each other anonymously, which _had_ been one of the original goals of remailer systems. Protocol support requirements:? We could build in a fancy header, or we could just use the Subject: line, which many remailers know how to paste in anyway, and let the remailer do a messageid. Response mechanisms should probably be an email message to the remailer :: Deliver-Message: 2718281828 A secondary concern is handling multi-casts - should the remailer create one copy for each recipient (secure, easy, space-wasteful), or should it try to get fancy and keep the message for N recipients or D days? Two ways to implement the fancy version are to keep a flag that says not to delete the article upon receipt, while the normal behavior deletes it, or to use different keywords for picking up delete-after-pickup and shared messages. NEGATIVES --------- The big negatives with this approach are that it doesn't support PGP-encrypted messages, since they don't easily fit into one line, while they also encourage people to forget that the header of their message will be delivered insecurely. But it's probably close enough for non-anti-government work. Of course, it also doesn't do chaining; that either needs to be implemented by recognizing well-known remailers and forwarding directly instead of pickup, or by using a standard message format, so other remailers could do pickup. It's probably worth doing both, to support other remailer types transparently and to allow remailers to use pickups without having to be well-known. Adding automatic remailer registration is easy, but requires care to avoid spammers falsely registering victim(a)wherever.com as a remailer and then spamming. SPAM POSSIBILITIES ------------------ That still allows 1-line spams like Subject: <Expletive Deleted>! You <perjorative deleted><ethnic slur deleted>! or Subject: Our new Remail-Spam(tm) system lets you fit 1015 characters in a Subject: line, just like this one, so your whole message can fit through those anti-marketing filters! You can MAKE M0NEY REAL FAST building your downline - send e$1 of Bank Foo ecash to the top three addresses in the Cc: line but at least it cuts down on the annoyance level. It also supports messages like Subject: Secrets of the Scientologists for Sale! Pick up message for free sample and price list! Operate your own Thetan today! which permit direct-e-mail spams, or as some people prefer to call them, marketing opportunities. An interesting security/legality wrinkle is that if somebody is trying to multicast-publish unencrypted contraband data, it's sitting around in the mail-pickup spool, it can be seized by Bad Guys / courts / sheriffs / etc. As with most remailers, there's also a risk that outgoing unicast mail could be seized while in the spool, which is higher for a pickup system because the data may be in the spool longer. # Thanks; Bill # Bill Stewart, stewarts(a)ix.netcom.com, +1-415-442-2215 # goodtimes signature virus innoculation

2 1

Re: Long-Lived Remailers
by hendersn＠zeta.org.au 17 Dec '03

17 Dec '03

>Ideally the final emanation point will be epherimal indeed. Perhaps only a >few minutes or an hour or two. I really like this idea. How about instead of a full-scale remailer being the final jump of the message, you have a _very_ simple remailer set up along the lines of anon.penet.fi. No encryption, just strip off the headers and send the message to its final destination. Sorry for being clueless in how this works(I'm learning as fast as I can), but wouldn't this kind of system be incredibly easy to start up and fold? You could have a host of such final emanation points winking in and out of existence while the actual encrypting remailers remain relatively safe. Zed(hendersn(a)zeta.org.au) "Don't hate the media, become the media" - Jello Biafra PGP key on request

1 0

Lotus Notes 4.0 stream encryption.
by Joseph L. Moll 17 Dec '03

17 Dec '03

Can anyone comment on this? --- Joseph L. (Joe) Moll mailto:jmoll@acquion.com Network and Communications Engineering http://www.acquion.com phone:864-281-4108 fax:864-281-4576 ACQUION, Inc. Greenville, SC USA -- Specialists in Electronic Commerce disclaimer: This email is not to be considered official correspondence ---

1 0

CLI_pr3
by jya＠pipeline.com 17 Dec '03

17 Dec '03

5-23-96. WaJo: "Chasing Criminals at Cyberspeed." Three recent developments in the money laundering trade have governments especially worried: the proliferation of offshore financial centers, the collapse of the Soviet Union and the adaptation of emerging technologies to criminal ends. Officials think newly developed "smart cards" will be particularly appealing to criminals. Smart cards could be used to download cash from bank accounts, then used to make payments or deposits anywhere in the world. All without anyone knowing who holds the smart card, because encryption guarantees anonymity. Says Stanley Morris, director of FinCEN, "The only way we can adequately assist our federal law enforcement counterparts in following the trail of the multinational money launderer is through our linkages with multilateral arrangements such as ... [Clipper 3]." 5-23-96. FiTi: "Japanese recruit 2,000 spies to monitor Asia crises." Their main source of official information will be material gathered by six electronic listening posts stationed across Japan. CLI_pr3 (for 2)

1 0

nyt: Report Warns of Security Threats Posed by Computer Hackers
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Copyright 1996 The New York Times Company May 23, 1996 Report Warns of Security Threats Posed by Computer Hackers By PHILIP SHENON [W] ASHINGTON -- Government investigators warned Wednesday that computer hackers cruising the Internet posed a serious and growing threat to national security, with the Pentagon suffering as many as 250,000 "attacks" on its computers last year. The investigators, from the General Accounting Office, offered scenarios in which terrorists or enemy governments might break into Defense Department computer networks and shut them down, cutting off communications between military commanders in the middle of a war. "There will become an increasingly attractive way for terrorists or adversaries to wage attacks," the investigators said in a report prepared for two congressional committees. "The potential for catastrophic damage is great." The Pentagon did not dispute the findings of the study, although Defense Department officials said they knew of no instance in which hackers had obtained secret information or gained access to computer networks that control the firing of weapons. "We are certainly well aware that people are breaking in or trying to hack into our systems," said Susan Hansen, a department spokeswoman. While the Pentagon is developing encryption devices that show promise in defeating computer hackers, the accounting office, which is the investigative arm of Congress, warned that none of the proposed technical solutions was foolproof, and that the military's current security program was "dated, inconsistent and incomplete." The explosion in the use of the Internet and the increasing power and sophistication of small desktop computers has compounded the Pentagon's problems, creating a worldwide army of hackers able to break into all but the most secure computer networks. The report cited Defense Department estimates that the number of unauthorized efforts to enter its computer systems -- "attacks," in the parlance of cyberspace -- was doubling every year and may have reached 250,000 in 1995, most of them made through the Internet. Pentagon figures suggest that in about 65 percent of those efforts, hackers were able to gain entry to a computer network. The investigators provided details on several recent attacks on the Pentagon's computers, including a 1994 incident in which two computer hackers were able to gain "complete access to all of the information" on the computer systems of the Rome Air Development Center, the Air Force laboratory in Rome, N.Y., where the Defense Department carries out some of its most important research on weapons systems. The report said the hackers rummaged through the computer networks for several days and stole information on the methods used by Air Force commanders to relay secret intelligence and targeting information during wartime. Working through the Internet and a variety of phone switches in South America, the hackers also used the laboratory's computers as a "launching platform to attack other military, government, commercial and academic systems worldwide," including the Wright-Patterson Air Force Base in Ohio and the Goddard Space Flight Center in Greenbelt, Md., the report said. One of the hackers, a Briton whose code name was "Datastream Cowboy," was later arrested in England. The authorities say they do not know the nationality of the other hacker, whose code name is "Kuji" and who was never apprehended. "There may have been some national security risks associated with the Rome incident," the report said. "Air Force officials told us that at least one of the hackers may have been working for a foreign country interested in obtaining military research data or information on areas in which the Air Force was conducting advanced research." The foreign country was not identified in the report. In separate incidents between April 1990 and May 1991, the report said, hackers from the Netherlands broke into computer networks at 34 Defense Department sites and browsed the electronic-mail systems of several department officials, calling up all messages that contained the key words "nuclear," "weapons" or "missile." The accounting office investigator who oversaw the report, Jack L. Brock Jr., said in testimony Wednesday before the Senate Permanent Subcommittee on Investigations that more than 120 nations are reported to be developing "information warfare techniques" that could "allow our enemies to seize control of public networks which Defense relies upon for communications." "Countries today do not have to be military superpowers with large standing armies, fleets of battleships or squadrons of fighters to gain a competitive edge," he said. "Instead, all they really need to steal sensitive data or shut down military computers is a $2,000 computer and modem and a connection to the Internet." The investigators said the Pentagon had made itself vulnerable to attack by making itself so dependent on computers and the Internet, a system that its own researchers created in the 1970s. "Defense's computer systems are particularly susceptible to attack through connections on the Internet, which Defense uses to enhance communication and information sharing," the report said, noting that an estimated 40 million people worldwide are Internet users. "In turning to the Internet, Defense has increased its own exposure to attacks." The Pentagon uses the Internet to distribute electronic mail and other information. During the war in the Persian Gulf, the Defense Department used the Internet to communicate with allied armies and gather and distribute intelligence information. _______________________ Regards, When we ask advice, we are usually looking for an accomplice. -Marquis de la Grange Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

2 1

No Subject
by unknown＠example.com 17 Dec '03

17 Dec '03

Copyright 1996 The New York Times Company ^^^^^^^^^^^^^^ Report Warns of Security Threats Posed by Computer Hackers ^^^^^^ ^^^^^^^^ ^^^^^^^ [W] ASHINGTON -- Government investigators warned Wednesday that computer hackers cruising the ^^^^^^^^ Internet posed a serious and growing threat to national ^^^^^^^^ security, with the Pentagon suffering as many as 250,000 ^^^^^^^ "attacks" on its computers last year. ^ ^ -- Love, Qut(a)netcom.com

3 2

The National Research Council Study of National...
by CRYPTO 17 Dec '03

17 Dec '03

Subject: The National Research Council Study of National Cryptography Policy (An incorrect web page/URL locator was posted in the previous message; apologies. If you found your way to the right page anyway and signed up for information, you don't need to do it again.) Please post this message widely I am writing to let interested parties know about the imminent release of the NRC's study of national cryptography policy. If all goes well, we hope to release it on May 30, 1996. However, prior to that time, we won't be able to comment on its contents. For current information on release, visit the web site http://www2.nas.edu/cstbweb/notifyme.html When you visit that site, you'll have the opportunity to be put onto a mailing list so that we can inform you by e-mail when the report is available in print and/or electronically, as well as any public events associated with the report (e.g., public briefings). Herb Lin Cryptography Policy Study Director Computer Science and Telecommunications Board National Academy of Sciences/National Research Council 202-334-2605

1 0