December 2003 - cypherpunks-legacy

Cash, cheaters, and anonymity
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

(As I said in another post, Netcom has a seriously broken mail system. Sorry for the delays.) I'll try to only respond to a few of Hal's good points, so as not to have too long a post here. His points are elided unless included. >Tim has made a lot of good points, and I'll only try to respond to a few: > >>NEGOTIATED PROTOCOLS TO REDUCE RISKS > >>However, just as most folks make arrangements with their bank/ATM machines >>(semantic meaning #2 of "ATM") to limit cash withdrawals to, say, $200 a >>day (it varies), so too can digital cash arrangements make similar >>contractual deals to limit losses. Some possible plans: > >>* Plan A: The protocol insists on retinal scan or other biometric >>authentication between the "smartcard" used as the cryptographic keying >>device and the putative owner. The "Thunderball" plan. (issues: preserving >>anonymity with biometric authentication, spoofing of the channel between >>card and physical apparatus, theft of smartcard, etc.) > >In Demolition Man, Wesley Snipes plucks the eyeball out of the victim to >hold it up to the retinal scanner and escape. Hacked-off thumbs may provide >similar workarounds for fingerprint protection. Maybe what we want is Yep. part of the reason I dubbed it the "Thunderball" plan: in that movie, almost 30 years ago, a stolen nuclear weapon is armed by spoofing the retinal scanner with a stolen eyeball (or maybe it was fake contact lenses...it's been awhile). Given the stolen nukes theme, it's amazing that the debate has shifted so little in 30 years. (ObCrypto links: Gus Simmons, who most of you should know about via his "Contemporary Cryptology" book and his work on subliminal messages, was the *main guy* on the "Permissive Action Links" (PALs) used to secure American nukes. I asked Whit Diffie, a close friend of him, if it was true that Simmons and others leaked security info to the Soviets to help them to secure their own nukes against unauthorized use...apparently they did, with the approval of the U.S. government.) ... >I think this is where the tamper-proof wallet idea comes from; it is the >closest anyone has come to providing truly conserved digital cash. With >such a system you can get the benefits of on-line clearing even in the off- >line environment, just as people will accept cash today without taking it >to the bank first. As I remember the observer protocol (Chaum's "Scientific American" article, August of 1992, as I recall), a trusted manufacturer is needed. Tamper-resistant modules, etc. This still allows spoofing. I know that off-line clearing, in which I get my money at some time after the transaction, is a whole lot less satisfying that receiving confirmation from my own agents/bankers that the money has already been transferred into my account. I agree that various protocols will exist, at various prices, with various benefits. .. >I think this is the key point. All of our speculation about the relative >advantages of the various forms of cash is largely irrelevant, as long as some >form of privacy-protecting payments comes into existance. Then the details >of the implementations will determine the relative costs and the market >advantages of each approach. The hard part will be getting that first cash >system in place. Which a free-market person such as Hal agrees with, of course. The market will ultimately evolve various protocols. Provided that regulations do not stop certain approaches, of course. ... >>([...] My use of the term "claim" >>here is of the "You present the right number, you get access" kind. Like >>the combination to a safe. The train locker idea makes this clearer, and >>gets around the confusion about "digimarks" of "e$" actually _being_ any >>kind of money it and of itself.) > >Dollar bills got their start this way. At one time they were just "claims" >on the real dollars in the bank vaults. Yet most people find it more con- >venient to think of them as money, even back when you could still turn them >in for gold. I think it's useful to think of ecash as being money as well, >although granted it is money with its own characteristics different in some >ways from banknotes, checks, or coins. The plethora of financial instruments, derivative, etc., will be echoed with digital money (indeed, some existing instruments already overlap with digital money, albeit not yet of the Chaumian flavor). For example, traveller's checks evolved to fill a niche for a form of money which could be "lost or stolen" and yet still be replaced. Don't leave home without it. Lots of niches exist, and many new ones will be created. >One thing I think is clear is that off-line cash will not be issued to >anonymous recipients. Imagine a magic quarter which would reappear in >your pocket after you put it into the coke machine. How many people would >be willing to resist using it? That's what you'll have with an off-line >coin issued to a pseudonym. We agree. Protocols I've seen make off-line cash problematic. "There is no digital coin." But on-line cash can be, and hence will be, issued to anonymous recipients. It's already done, with numbered Swiss bank accounts (at least in the past), and with the train lockers I mentioned. People put money in train lockers anonymously, then give the key to others, in exchange for goods and services (drugs, return of kidnap victims, etc.). > >>And as networks get much faster, expect even off-line cash to fade. Depends >>on costs, insurance rates, benefits, and of course on regulations. > >This is probably right, although ironically the infrastructure for off-line >cash might be simpler. On-line cash needs 24-hour availability, quick >(nearly instantaneous) response, a fully automated cash validation system. >We have this now, with the Visa cards, but it didn't appear overnight. And >I doubt that the Internet is a suitable communications medium for it (due >to reasons of availability, reliability, and security). Off-line cash could >be handled with longer turnaraounds in a machine which is not on the net, >using manual intervention so pass words and such are not stored on-line. >Of course the disadvantage is that the off-line cash requires identity >authorization during issuing. Yes, it requires an infrastructure. But for reasonable-sized transactions, the few cents for a current VISA transaction would be lost in the noise. Even if more computations are needed (as they will be, presumably), on-line transactions will be manageable for the larger transactions. Very small transactions (buying snacks and newspapers) can be handled off-line. This is already done, as when people buy "subway cards" that are semi-tamper-resistant (we all know they aren't, but most people don't try to diddle them). Ditto for phone cards, parking coupons, etc. (But why bother with off-line cash for most purposes? Physical cash is convenient for such things. However, markets will decide.) >Tim's ideas about escrow agents and a credential-less society are very >interesting as well and I'll try to make some comments on them later. > >Hal I look forward to hearing these comments. Understand that I wrote that essay basically off the top of my head, pulling together some ideas that I think have been pretty obvious for a while. We don't often discuss these sorts of ideas, preferring (I guess) to correct each other on points of trivia about the flight range of the A-10 Warthog (;-}). Life on the Internet. --Tim May .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. "National borders are just speed bumps on the information superhighway."

1 0

Not me PGP-tweaking
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tcmay(a)netcom.com (Timothy C. May) on Sun, 28 Aug 12:58 PM >My ire at John Young came from his apparently malicious >"tweak" at me in which he sent me PGP-encrypted mail Warn't me, Tim. Still too crypto-knobbie without the skill for PGP mail or post. I got lumped with other tweakers while trying say a humorous word on your behalf. Ah well, so much for humor in the midst of a spat. I'll duck next time. John

2 1

RE: Golbal Econ.
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> >An "internet economy" needs a basis of trust, as well as security > >mechanisms appropriate for the current level of IP security. What basis > >of trust do you envisage? > Secure transactions are here already. ... for parties with established commercial relationships. > Most of this can be done in civil law. It's done all the time in the > securities markets. If you have certificate which is collateralized, by an But the contractual agreements upon which these transactions are based don't scale too well to the [small] vendor / casual purchaser sector, which I guess the term "internet economy" is intended to encompass. The most likely basis of trust for this sector is not going to be achieved through each transient buyer-and-seller pair-instance entering into an explicit contract to enable the seller to believe the buyer's electronic [proxy-]promissory note - but by an extension of the current mechanism for telephone or mail-order payment, with the trusted third parties being VISA, AMEX, etc. While CommerceNet is the most prominent make-the-internet-safe-for-business initiative, it still only expects to have 1 million customers within five years - a goal that is modest enough given today's Internet user base, and growth rates. Even so, industry analysts consider this goal ambitious. Expectations for an internet economy based on techniques above and beyond the ability to securely send one's credit/charge card details are unlikely to be fulfilled in the short/medium term. - pvm

1 0

Re: Golbal Econ.
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> > All payment mechanisms require a basis of trust - so > > that the seller knows s/he will get paid . > The above bank/vendor/customer/mix scenario seems the > simplest to start out with on the Internet at this time. Indeed. But what I have still not seen in this thread is an articulation of a business case for existing financial institutions to support the putative [on|off]-line payment mechanisms - in particular as an alternative to charge/credit cards for one-off transactions. - pvm

1 0

New Cypher ListServ (part 1)
by David Downey 17 Dec '03

17 Dec '03

I recently purchased my own domain called CyberSpaceTechnologies.com, and with it I recieved the ability to own and operate a ListServ of my own. I will continue to be a member of this one. Yet in order to make sure that we may always have a place from which to discuss this most important of issues, I have started the Cryptography-Politics-PGP-L listserv. This listserv will be up in approximately 72 - 96 hours hopefully. Those of you with long time experience with listservs, and those that have run them before, I would be honored to hear from you on the best way to run this. I have decided beforehand that it would be an unmoderated list. The ONLY monitoring that I will do, is to glean email addresses and upstream server addresses from spam messages for the purpose of notifying offenders that such actions are not wanted or tolerated on this list. I hereby pledge that in no way shape or form, will I passively allow spammers or other entities to use email addresses from this list for ANYTHING without first getting permission from the email address owner. If ANYONE sees that happen, PLEASE notify me IMMEDIATELY! I want this list to be a place where open discussion of this issue may take place regardless of age, sex, creed, religion, experience, or lack thereof. We are a community of believers, believers in the right to freedom, privacy, and the ability to remain an idividual. The only thing I ask, and this is a request not a demand, is that all list members treat new and old members with the level of respect and courtesy that you would expect for yourself, if not better. Not much to ask, I don't think. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: In the year 2525
by Matthew Ghio 17 Dec '03

17 Dec '03

"Rick H. Wesson" <wessorh(a)ar.com> wrote: > If I stole all the digital cash in the world, and held it for 30 > seconds in a numbered account, how much interest would I have? Zero. If you stole all the money, there would be none left to pay you interest. :)

1 0

Re: In the year 2525
by David K. Merriman 17 Dec '03

17 Dec '03

> If I stole all the digital cash in the world, and held it for 30 > seconds in a numbered account, how much interest would I have? Well, you'd certainly have *my* interest.... :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: We get the government we deserve
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Tim C. May wrote: > We get the government we deserve. The Drug War is happening because > Americans shrilly say "Do something!" and would rather have the D.A.R.E. > commandoes educating their kids than do it themselves. Ditto for most of > the laws passed by the tens of thousands every year. (Ever wonder why we > need thousands of new laws? I do.) DARE really isn't so bad... Just because we recognize that people should have the freedom to use drugs if they choose to do so, doesn't mean that such drugs are good. Maybe a lot has changed since the DARE program was given at my school, but it mostly focused on why drugs were bad, allowing people to make a more informed decision about using drugs. That seems to me to be protection against fraud... I was talking about this with a cop recently, and he said that the DARE program was the most effective tactic against drug abuse. He admitted that busting drug dealers wasn't really effective (for several reasons). So maybe attitudes are changing. I asked him about legalization. He was somewhat hesitant on this point. His only objection was that he was afraid that it would "send the wrong message." However, he did admit, that everyone he had ever picked up for drug abuse was also involved in other crimes, theft being most common. So even if drugs were legalized, the same criminals would still get arrested for their crimes.

2 1

Returned mail: unknown mailer error 1
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- sh: /users/home/entropy/procmail: not found 554 "|IFS=' ' && exec /users/home/entropy/procmail -f- || exit 75 #entropy"... unknown mailer error 1 ----- Unsent message follows ----- Received: from toad.com (localhost) by IntNet.net (5.0/SMI-SVR4) id AA03078; Sun, 28 Aug 1994 20:13:55 +0500 Date: Sun, 28 Aug 1994 20:13:38 +0500 Message-Id: <9408290013.AA03078@ IntNet.net> Errors-To: cypherpunks(a)toad.com From: cypherpunks(a)toad.com (Cypherpunks List) To: entropy(a)IntNet.net (Jcooper) Subject: blah content-length: 24 Blah Blah Blah -cp >From owner-cypherpunks Sun Aug 28 11:17:53 1994

1 0

Announcement of premail v. 0.20
by Raph Levien 17 Dec '03

17 Dec '03

Hi all, I am releasing premail, a remailer chaining and PGP encrypting mail client, to the Net. If you are interested in using the cypherpunks remailers, but are intimidated by them or simply find them too hard to use, then this software can help. Premail will also PGP-encrypt and optionally sign outgoing mail. The README file is attached. Please check it out and let me know how you like it. Raph Levien ----------------------------------------------------------------------- README file for premail v. 0.20 27 Aug 1994 -- Raph Levien <raph(a)cs.berkeley.edu> Premail is a mail client for Unix workstations, supporting PGP encryption and anonymous remailers. It can be used either stand-alone or as a layer under your favorite user mail client. Premail has been designed to be as simple and transparent as possible. Features include: * Chaining of messages for cypherpunk remailers. * Automatic selection of reliable remailers. * PGP encryption and signing. * Online and offline operation. Premail is designed to masquerade as sendmail. It accepts mail in the same way, and takes the the same options, and providing additional header fields for its privacy features. Thus, if you can get your mail client to pass the mail to premail rather than sendmail, then you gain the use of the privacy features without changing the way you send mail. In the interest of simplicity, premail only handles outgoing mail. It does not handle incoming mail, or PGP decryption. Installation ------------ This section explains how to set up premail for basic operation, without PGP encryption. Use of PGP encryption is highly encouraged, and is covered in a later section, as are configuration and advanced features. This section assumes that your machine is connected to the net when you run premail. It is capable of offline operation as well, as discussed in a later section. 1. Get the source. Given that you are reading this file, you may have already done this; if so, go to step 3. The latest version of premail is available at: ftp://kiwi.cs.berkeley.edu/pub/raph/premail-0.20.tar.gz 2. Unpack it. To do this, run: gzip -dc premail.tar.gz | tar xvf - 3. See if you can run it. First, do "cd premail", then "./premail" (without the "" marks in both cases). If it prints a usage summary, you are in luck. If you get "command not found," then the problem is most likely that your system's copy of perl does not live in /usr/bin. Type "which perl" to find out where it actually is, then edit the first line of the file "premail" to match that, and try again. 4. Copy premail into a directory in your path (this step is optional). For example, if ~/bin is in your path, then do: cp premail ~/bin After this step, you probably want to run "rehash" so your shell knows were to find premail. 5. Set up the premail configuration file by typing: cp .premailrc ~ 6. Test whether premail really works, by typing: premail your(a)own.email.addr Path: 1 Subject: Test Does this really work? . If everything goes well, you should get a response from an anonymous remailer in a few minutes. Then, premail is set up and ready to use. You probably want to set up PGP as well, but you don't have to. This and other configuration options are covered below. The configuration options are controlled by the ~/.premailrc file, so you might want to browse through it and tweak things to your taste. Setting up premail for PGP -------------------------- When properly set up, premail will automatically encrypt outgoing mail using PGP. This applies both to traffic routed through the remailers, and to email encrypted for the final recipient, who would use PGP to decrypt it. On the other hand, you can skip this section if you don't want that. First, you need to make sure that you have PGP set up on your machine. When you do, just type: premail -getkeys This will finger Matt Ghio's remailer list at remailer-list(a)chaos.bsu.edu . If this site is down, or if you are not connected to the net, you should get the list from somewhere else. You can specify either an email address to finger or a file. For example, if you save the keys into remailkeys.asc, then you can run: premail -getkeys remailerkeys The messages from PGP will tell you that it's adding about a dozen new keys to the keyring. You also need to tell premail that you've got PGP running, and have added the remailer keys to your keyring. To do so, add the following line to the ~/.premailrc file: $config{"encrypt"} = "yes"; Also, if you've got PGP in a non-standard place, so that typing "pgp" will not call it up, then you need to add this line to the ~/.premailrc file: $config{"pgp"} = "/wherever/you/put/pgp"; The vox remailer has a problem with MIT PGP 2.6. Thus, premail will by default not encrypt mail going through vox. If your PGP version is 2.3a or 2.6ui, then it should work fine, so add this line: $config{"oldpgp"} = "pgp"; or, if PGP is in a nonstandard place, $config{"oldpgp"} = "/wherever/you/put/pgp"; Integration with user mail clients ---------------------------------- Without premail, outgoing mail works as follows. After you compose your mail, your mail client hands it off to a program called sendmail, which forwards it to the Net. Sendmail (written by Eric Allman at UC Berkeley) knows a lot about email addresses, networking, and so on, but very little about privacy and security. That's the job of premail. It is possible to use premail in either mode: under your client, or by itself. Either way will give the same features, it's just that integrating it with your client will be more convenient to use (if a bit harder to set up). To use premail, type: premail recipient(a)email.addr and enter your mail as you normally would, ending with either Control-D or a line with just a . on it. Or, you can prepare an email message with your favorite editor, and send it with premail -t < your.file To add premail support to emacs, just add this line to your .emacs file: (setq sendmail-program "/your/premail/pathname/here") With other mail clients, you should be able to use a similar technique. Contact me if you need help with a particular client. If you are root on your machine, you can install premail in /usr/lib/sendmail, so that it will work for _all_ mail clients. This is a fairly bold move, so it would be wise to test this carefully before doing so. To do so, move the existing sendmail into, say, /usr/lib/real_sendmail . Then, add the line $config{"sendmail"} = "/usr/lib/real_sendmail"; to premail. Finally, copy premail to /usr/lib/sendmail. If you choose to do this, let me know how well it works out. Using the privacy features -------------------------- Premail has two important privacy features: chaining through remailers, and PGP encrypting the messages. To chain through the remailers, simply add a header line such as Path: 3 to your mail. The number 3 says how many remailers you want it to chain through. Three is a good compromise between privacy on the one hand and speed and reliablilty on the other. The remailers will automatically be selected for their reliablity and speed, using the remailer list I maintain (finger remailer-list(a)kiwi.cs.berkeley.edu to see it). If you want to specify a particular sequence of remailers, you can do that. For example, if you are very fond of the idea of your mail crossing national boundaries, you might want to send it through Canada, Austria, and Holland, in that order: Path: extropia;wien;usura When using the Path field, your identity will be completely obscured. If the recipient tries to reply to your mail, it will get nowhere. You can specify a reply address using the Anon-From field: Anon-From: an123456(a)vox.hacktic.nl The Anon-From field only shows up in mail which goes through the remailers. In ordinary mail, it will be ignored. So, you can put it in all of your mail without worrying about compromising your identity. In fact, you can make premail automatically use it in all anonymous mail by adding this line to your ~/.premailrc file: $config{"anon-from"} = "an123456(a)vox.hacktic.nl"; Similarly, if most of the mail you send will be through the remailers, then you can set premail to do that as the default. Add this line (or whatever path you want, if not 3) to ~/.premailrc: $config{"defaultpath"} = "3"; Then, whenever you want to send non-anonymous mail, add this header field: Path: ; The other important privacy feature is the ability to PGP encrypt outgoing mail. This works whether or not you use the remailers. The recipient's key must be in your public key ring before you can encrypt mail to them. Then, all you have to do is add this mail header field: Key: user_id The mail will be encrypted with this user_id. It will be formatted using the MIME content type of application/x-pgp. If the recipient has a MIME-capable mail reader, they can set it up to automatically call PGP when receiving encrypted mail. Otherwise, you don't need to worry about it. You can also have premail automatically sign your mail, as well. This feature is a potential security problem, so use it with caution. Add these lines to your ~/.premailrc: $config{"signuser"} = "your_user_id"; $config{"signpass"} = "your pass phrase"; Again, a warning: in doing so, you have just stored your pass phrase in a disk file, which is considered a security no-no. On the other hand, if you are using this for medium-security applications, or if you have good control over access to your machine, then it should be OK; certainly a _lot_ better than not using PGP at all. The ~/.premailrc file should always have -rw------- (600) permissions. Use with caution. How to use the cypherpunks remailers like anon.penet.fi ------------------------------------------------------- Even though the cypherpunks remailers do essentially the same things as anon.penet.fi (though faster and with better privacy), they work quite a bit differently, and can be somewhat intimidating. Premail can help. First, you will need to get an anonymous alias. At this time, the only cypherpunk remailer which will do this for you is "avox", or anon(a)vox.hacktic.nl. To get the alias, do: premail your(a)own.email.addr Subject: alias Path: avox Hopefully, this will assign me an alias. . In a few hours, you will get email back with an alias of the form an123456(a)vox.hacktic.nl . Then, when you send anonymous email, give your alias as the reply address. Here is an example: premail recipient(a)email.addr Anon-From: an123456(a)vox.hacktic.nl Path: 3 Hello, if you reply to this, mail will get to me. . Unfortunately, unlike penet, avox does _not_ make the person replying anonymous. The best way for them to be anonymous is to use the cypherpunks mailers as well (hopefully by using premail!). How to post to Usenet --------------------- The easiest way is to use a mail-to-Usenet gateway. For example, to post to alt.skydiving, just send mail to alt.skydiving(a)demon.co.uk . A full list is available by fingering remailer-list(a)chaos.bsu.edu, or from http://www.cs.berkeley.edu/~raph/ghio-remailer-list.html . Extra goodies ------------- Premail supports a few more features, for advanced users. These include: offline mail preparation, logging, a password for penet, and a debugging mode. The configuration options specifying these are described in the ~/.premailrc file, which is what you would need to edit. Have fun!

1 0

Re: We get the government we deserve
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

alex <cp(a)omaha.com> wrote: > nobody(a)shell.portal.com wrote: > > I was talking about this with a cop recently, and he said that the DARE > > program was the most effective tactic against drug abuse. He admitted > > Sorry to be straying from crypto, but: > > I heard exactly the opposite, that studies have shown no difference > whatsover in the usage rates in kids who went through DARE and kids who > don't go through DARE. I don't know; this was just one cop's opinion based upon his experience. He said most of his offenders were in their late 40s, having picked up a heroin problem after taking mophine in Vietnam, and they were doing all sorts of crazy (and stupid) things to support their habits. He said that the drug problem was 'getting better' because many of the junkies were dying from overdoses, and fewer of the younger generation were getting involved in that type of thing. YMMV depending on which part of the country you live in. You're right, this isn't crypto, but I suppose the war on drugs does bring up some privacy issues...

1 0

Re: Golbal Econ.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:10 PM 8/28/94 +0100, p.v.mcmahon.rea0803(a)oasis.icl.co.uk wrote: >But what I have still not seen in this thread is an articulation >of a business case for existing financial institutions to support >the putative [on|off]-line payment mechanisms - in particular as an >alternative to charge/credit cards for one-off transactions. I'd like to take a crack at this one. In the offline business model I'm mucking around with, the bank is responsible for "vouching" for the purchaser. An ATM gateway (which requires a bank) is how cash is sent to and from the underwriter. This cash is used to pay for and collateralize the digital certificates. And when cash is brought off of the net, the ATM gate serves as a place to send a "deposit" of the redeemer's cash. Banks get a commission for this. In addition, an institutional bank is also the trustee for the suspension account, which collateralizes the cash on the net. There are fees for that. The mechanics of getting paid are pretty straightforward. The size of the market is probably the most important question. I hold no illusions about this, but I think the costs of entry are still such that with reasonable royalty demands and with falling prices for equipment and network access a business could be started the proverbial garage (OK, 1000 ft or less of class b office space) and survive. Costs of entry will continue to go up, however. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

RE: Golbal Econ.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 9:50 PM 8/28/94 +0100, p.v.mcmahon.rea0803(a)oasis.icl.co.uk wrote: >> >An "internet economy" needs a basis of trust, as well as security >> >mechanisms appropriate for the current level of IP security. What basis >> >of trust do you envisage? > >> Secure transactions are here already. > >... for parties with established commercial relationships. No, for individuals transacting business with commercial entities. The NYT article we disparaged for being rediculuously overdue is a case in point. > >> Most of this can be done in civil law. It's done all the time in the >> securities markets. If you have certificate which is collateralized, by an > >But the contractual agreements upon which these transactions are based >don't scale too well to the [small] vendor / casual purchaser sector, >which I guess the term "internet economy" is intended to encompass. I don't think so. If an underwriter has a standard purchase agreement with the purchaser, much like all the fine print we see in a packet of Amex checks but never read, which stipulates a collateralized certificate and that agreement is issued thousands or millions (someday billions?) of times, then what's the difference between that and one agreement for a single trade between commercial parties? I'd call that scalable, wouldn't you? > >The most likely basis of trust for this sector is not going to be achieved >through each transient buyer-and-seller pair-instance entering into an >explicit contract to enable the seller to believe the buyer's electronic >[proxy-]promissory note - but by an extension of the current mechanism for >telephone or mail-order payment, with the trusted third parties being >VISA, AMEX, etc. Okay. If the issuer is a trusted third party creating an exchange item of value. There is no promise required by any party except the issuer's promise to show up fork over physical cash on a one-for-one basis when the certificate is redeemed. > >While CommerceNet is the most prominent make-the-internet-safe-for-business >initiative, it still only expects to have 1 million customers within five >years - a goal that is modest enough given today's Internet user base, >and growth rates. Even so, industry analysts consider this goal ambitious. I think that the presupposition here is an underestimate, but it still may not be enough to support an underwriter just yet. It's an underestimate because CommerceNet is still an on-line business trying to get the "cream" of the market, largeish transactions. Their financial partner, Bank of America, is trying to do what it knows, which is credit cards and checks. However, the ability of small vendors of information to make low-cost transactions of practically any size is where the money will be, I believe. I believe that the things you may be able to buy on the internet are legion with just a little more bandwidth: music, information, software, on-line consultations, maybe even a movie ;-). The most important thing is that offline transactions with internet cash may enable much more granularity in the transaction base. There may be money for a business which underwrites those transactions. There has been some discussion here about much larger business-to-business cash transactions using the same idea, but that's not what I'm talking about here. I think that a presence as an underwriter of internet cash is sort of an option on market participation as the market grows. It may be that the experience may be worth something over time. > >Expectations for an internet economy based on techniques above and beyond >the ability to securely send one's credit/charge card details are unlikely >to be fulfilled in the short/medium term. Who knows? I'll tell you a story. I really got hit over the head with the idea that internet commerce was possible when I read one of the first issues of Wired, and there was this MTV VJay, of all people, saying that the record companies will go out of business as soon as somebody figured out how to "upload" money to the musicians themselves. This started me thinking, and I ran a bunch of Nexis searches on internet, and came up with "cypherpunks". Joy. The point is, whenever I think about internet commerce, I think about someone buying a copy of a song from a musician as the lowest level of economic granularity. What I get is an offline cash system. Cheers, Robert Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Golbal Econ.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 2:49 PM 8/28/94 -0500, Jim Hart wrote: >With an online clearing system, four elements of trust are >needed: > >+ both the vendor and the customer need to trust the bank >+ the customer needs to trust the vendor to deliver the >goods and change once the vendor has been paid >+ any one out of n of the digital mixes (proxy servers) used >to communicate between the parties needs to be trustworthy >+ independent auditors for the bank > I don't see why an offline system couldn't qualify for all of the above. >This kind of trust comes through repeated relations: if the >vendor has delivered in the past, and benefits from staying >in business in the future, they will deliver the goods today. >Same for the bank issuing and honoring currency. Regular >money supply figure updates and independent auditing of a >free bank are important, so that they cannot take hidden >actions to inflate the money supply. (Alternatively, >an online bank can peg the value of its tokens to, and >facilitate conversion to and from, a widely issued currency >such as the dollar). In an offline system, the underwriter's collateral position can be monitored by a trustee, which is itself audited also. This takes care of the contents of the "railroad locker". If the currency is consistently redeemed without the spectre of double spending, then the reputation of the currency increases. That should be taken care of with proper fraud detection and enforcement. >There are entry and exit problems: it costs to gain a >reputation, and if one's need for a future reputation is >small it pays to abscond. These can be overcome >by the agent trying to gain the reputation, via offering >up-front subsidies to use their services (like sign up >bonuses), by sponsorship and introduction of new services >by known reputable agents, by keeping maximum transaction sizes >low, and by other means. Many of these techniques are >well known and commonly used by businessmen. Amen. As I said previously on this list, if I'm an underwriter, and a legitimate customer comes up to my redemption window with a previously spent cash, he may be out the money, but I'm out the reputation of my product. Prosecuting fraud is the ultimate solution to this problem, but it's obvious that the above methods make perfect sense to protect the integrity of either off-line or on-line system. Thanks, Jim. I agree with Tim. I always learn something when you put something up. In particular, I'm now thinking about what happens if the risk of double spending is small enough to insure against. That would effectively do what issuers of credit cards or traveler's checks do when their products are "double spent". Make the victim whole and run the culprit to ground. For credit cards, it's cheap enough (3%) for them to self insure, with a vigilant enforcement effort. Unfortunately, there's probably a "frontier" stage at first, where the currency is more at risk. It is a caveat emptor situation, with Wyatt Earp for enforcement of the integrity of the underwriter's cash certificates. The brain grinds away. I hope I'm not stripping gears... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: e$: e-cash underwriting
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:57 PM 8/28/94 -0700, Hal wrote: >hughes(a)ah.com (Eric Hughes) writes: >>One solution is clear and direct: charge for each redemption attempt. >>In that situation, multiple attempts get rejected, and the issuer is >>recompensed for the attempt. No morality need be invoked. > >The problem is, the fraud doesn't occur (typically) when the note is >redeemed at the bank, it occurs when the note is exchanged at the >market. Is this proposing to charge the merchant when he in good faith >turns in the cash which was given to him by the customer, and it turns >out bad? What cruel irony! Here he is already cheated once, and the >bank will charge him an extra fee as additional punishment? > >I must be misunderstanding. This seems not to deter double-spenders at >all. The more I think about this, Eric, the more I think I caved in too early. Can you explain exactly how charging a back-end load on a digital cash certificate prevents double-spending? >>There remains an issue as to the size of this redemption fee, which >>would have to be small. In order to optimize the transaction costs of >>charging this fee, a bank might be willing to accept identity in >>escrow for the transaction and to remove the fee for good >>transactions. Identity might be a pseudonym revealed after 10 bad >>attempts, say. This system removes the requirement for identity and >>substitutes it for an economic optimization based on identity. This reminds me of the previous discussion of holding a person's cash bond hostage for good behavior. In this case, you're holding unencumbered redemption rights hostage and reducing transaction costs in relation to the person's relative risk. I think I get it now. I sort of took it on faith before, but I'm not so sure all this is necessary, see below. >Here I am lost completely. Whose identity is in escrow? The person to >whom the coin is given in the first place? But I thought we were >referring to a double-spending protocol in which users revealed their >identity to the bank. Apparently not? Is the idea here that the bank >doesn't know the user's identity, but some other escrow holder does, and >it gets revealed only if the user double-spends 10 times? But that would >still be identity-based, just with different rules about when it gets >exposed. I really don't follow this at all. I think that the business model I've been proposing may handle this a bit. In order for someone to cash out, they need to be able to speak to an ATM machine, which implies a bank-acceptable identity (whatever that means). It allows for nyms to trade offline, and it banks on being able to catch the nym by police work (Ace Ventura, Nym Detective!) if a "self-credentialed" nym double spends. Since most fraud schemes require a nym to do it, web-of-trust stuff would have to apply in the case of transactions with nyms. It's ugly, but it should work. > >To me, there is no problem with revealing identity in certain situations >as long as it is unlinkable to my other activities.. And I will be much >more willing to lend credit or other forms of trust to pseudonyms if I >know that they are willing to pay the ultimate price of punishment to >their own very physical bodies if they cheat me. What more assurance >could I want? And yet, as long as all parties are honest, we have no >fear of our identities being revealed against our will. I'm pretty sure I'm a little more loosey goosey about this. I think that there may be enough of an enforcement mechanism even if nyms remain completely anonymous. Cheers, Robert Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:27 PM 8/28/94 -0700, Hal wrote: >rah(a)shipwright.com (Robert Hettinga) writes: > >>I suppose what I meant was is there any fully identified offline digital >>cash system in the literature. I haven't heard of any from secondary >>sources, like around here, or from my cursory reading of Schneier, for >>instance. > >"Fully identified cash" is not widely discussed in the literature because >it is (relatively) trivial, and here because it is not privacy >protecting. "Fully identified cash" is equivalent to a check made out to >"cash". All you need is a signed directive to your bank to transfer >money from your account number such-and-such to the bearer. > Open mouth. Insert sea boot. <Yech!> That's what I get for shooting everything that moves. I think I even remember this now. I should have remembered it before I opened my mouth. Sorry. Fully identified digital cash is basically a digital check. Got it. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

New Cypher ListServ (part 2) **REVISED**
by David Downey 17 Dec '03

17 Dec '03

The Cryptography-Politics-PGP-L ListServ is in operation.(We just finished up with the majordomo scripts and the like). Here is what you need to do to join. BTW, this list is a digested list. Please do not freak if things do not go right straight from the get go. I hope to have this as painless as possible, yet we all know that Murphy wrote Murphy's Law just for this instance. Please bear with me. Once again, ANY suggestions, short of flames, will be listened to 100%! Now for the nitty gritty. SUBSCRIBE/UNSUBSCRIBE TO Cryptography-Politics-PGP-L ===================================================== Subscribing ----------- To subscribe, send the message subscribe Cryptography-Politics-PGP-L to majordomo(a)cyberspacetechnologies.com Unsubscribing ------------- To unsubscribe, send the message unsubscribe Cryptography-Politics-PGP-L to majordomo(a)cyberspacetechnologies.com Posting ------- Messages sent to Cryptography-Politics-PGP-L(a)cyberspacetechnologies.com will be posted to the entire list. Digests ------- When subscribed, send message to majordomo(a)Cyberspacetechnologies.com with get Cryptography-Politics-PGP-L-digest as the message body. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: Cash, cheaters, and anonymity
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 12:58 PM 8/28/94 -0800, Timothy C. May wrote: >As I remember the observer protocol (Chaum's "Scientific American" article, >August of 1992, as I recall), a trusted manufacturer is needed. >Tamper-resistant modules, etc. This still allows spoofing. I know that >off-line clearing, in which I get my money at some time after the >transaction, is a whole lot less satisfying that receiving confirmation >from my own agents/bankers that the money has already been transferred into >my account. So much for the observer protocol. Sigh. Tim, I think that we can equivocate an enormous amount about the phrase "some time" above. It is entirely possible to move whatever money you get in a transaction off the net at little or no cost, especially if the currency in question is front-end loaded, instead of back-end loaded, immediately after the transaction happens. It may also be possible to "test" an arbitrary piece of cash during an offline transaction by depositing it before accepting any more. However, the nice thing about using about an otherwise offline system in a near-online scenario, like the one above, is that you aren't wedded to using it all the time. If you can trust the cash you get, then your costs should be lower. Setting up a system like it can happen faster with less overhead for the issuers, also, so I expect that the first profitable digital cash systems will probably offline ones. How you feel about that satisfying "clink" sound, when you deposit that cash immediately upon receipt in your favorite online system, I can't really help you with... >>One thing I think is clear is that off-line cash will not be issued to >>anonymous recipients. Imagine a magic quarter which would reappear in >>your pocket after you put it into the coke machine. How many people would >>be willing to resist using it? That's what you'll have with an off-line >>coin issued to a pseudonym. > >We agree. Protocols I've seen make off-line cash problematic. "There is no >digital coin." But on-line cash can be, and hence will be, issued to >anonymous recipients. It's already done, with numbered Swiss bank accounts >(at least in the past), and with the train lockers I mentioned. People put >money in train lockers anonymously, then give the key to others, in >exchange for goods and services (drugs, return of kidnap victims, etc.). Light dawns on marblehead. The problem becomes allowing a nym to take his money off the net. We run into the law here if the money is too much at one time. Personally, I don't have any problems with preventing this, but I see precisely how this is diametrically opposed to the manefesto of this list. Can't we simply have a bank somewhere which accepts questionable, even anonymous credentials? Don't we have those already? It seems to me that Credit Suisse has every right to put up their own ATM gate on the net. The ability to unmask a double spending nym shouldn't be any harder than finding a nym who has created his own credentials in the first place, which means waiting for him to repeat himself and screw up, you wait for someone close to him to snitch, and you make sure he can't use the same nym again. >Yes, [an on-line transaction system] requires an infrastructure. But for >reasonable-sized transactions, >the few cents for a current VISA transaction would be lost in the noise. >Even if more computations are needed (as they will be, presumably), on-line >transactions will be manageable for the larger transactions. Very small >transactions (buying snacks and newspapers) can be handled off-line. This >is already done, as when people buy "subway cards" that are >semi-tamper-resistant (we all know they aren't, but most people don't try >to diddle them). Ditto for phone cards, parking coupons, etc. It's entirely possible that ontology may repeat phylogeny. Offline systems like cash always presage more complicated systems. I'm just curious whether if on offline system is implemented because it's easier, people will go through the extra effort of messing with an offline system except when they want to borrow something, like when they want to use a credit card. It's not entirely clear to me that on line systems are the "climax forest" of the internet ecology. But as Hal and Tim have said in this thread, the market will decide. I think that an offline cash underwriting market is just about ready for competitors to enter it. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Bad govt represents bad people?
by sw＠tiac.net 17 Dec '03

17 Dec '03

>Phil Karn writes > >> It really gives one pause. Is government really the enemy of personal >> freedoms, or does it merely reflect an intolerant and unenlightened >> general population? John Kreznar replies- >Excellent question. Answering it the wrong way leads to tremendous >energy misdirected to trying to influence politicians and bureaucrats, >even when they are effectively representing their constituencies in the >general population... John seems to mean 1) the people are bad, and 2) people who believe the people are good try to influence politicians. Point 1: Saying that a bad government is just representing bad people gives it more credit than is due. Sure, that's what it claims to do, but does that have anything to do with reality? The whole is different from the sum of the parts. Besides the parts there is their arrangement. Government as we know it is a bad arrangement of people. It contains positive feedback structures that amplify certain mistakes instead of correcting for them. The bad things that happen with governments often play on people's irrational fears and psychological "hot buttons." They also make use of the news media's eagerness to cover certain kinds of subjects and events. A feedback loop will take advantage of whatever signal paths are out there. So, you have people whipped up into showing their worst sides, and then given exaggerated coverage on the news. It's hard to say what would give a true picture of what most people are like. On the other hand, governments contain negative feedbacks (formerly called checks and balances) that can sometimes make them act *more* sanely than the average mob taken from their own population. On John's point 2: The goodness or badness of the people has little to do with whether it makes sense to try to influence politicians, since they do not represent and are hardly influenced by the will of the majority anyway. It's the structure of government that needs changing. What might help change that is a complicated thing I won't go far into. But whether you're going with or against popular opinion probably has never mattered as much as how clever, ruthless, resourceful, well-connected, etc. you are. --Steve - - - - - - - - - - why did the chicken cross the infobahn? finger for more info.

2 1

Re: crypto anarchy thoughts
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Robert Hettinga wrote: > Any argument which uses anonymity as the first cause for implementing > a digital cash system deserves to lose. Like sophisticated engraving, > intaglio printing, and a zealous anti-counterfeiting effort, strong > crypto and zealous anti-double spending efforts are the technologies > which enable trust in a digital cash certificate for it's own sake. This may be true, but how exactly do you plan to argue "anonymity" is necessary in a digital cash system (from the point of view of the bank and stores)? I mean, strong crypto could provide "zealous anti-counterfeiting" without providing anonymity. > Privacy, and maybe even crypto-anarchy or anarcho-capitalism, is the > icing on the cake. Precisely my point. Except I think the icing will be left off. Oh, and in response to Tim May, no, I'm not afraid to use my real name; I've been on this list quite a while (perhaps this is useless trivia). I just thought I'd try comminicating via anonymous remailer, perhaps establishing a pseudonym while I'm at it, so I'll be signing posts from now on (actually I already signed one previous post). Just playing around with some crypto-anarchy concepts. Thoth -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLmFhkfFYvlqvuKtBAQFFTgP9G1A8OtshS9DYFnNXyAYMkefHG9ECifKC 01b6A8ic/gdeEBkn0G1RpVfGlMEUqRrs7w6Q0jxaRv3HEKvOKN2a3wXA0w5ao+RX 3AB2aBiIY2awANBzCM6MZBw2q9sLn8ITWTokxs/j7wV2WMyBh1/2NlIuHBkNyf0X pSGTo43oHfw= =k1Cm -----END PGP SIGNATURE-----

1 0

Re: pgp fanaticism
by nobody＠ds1.wu-wien.ac.at 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Tim May wrote: > at least use a digitally-signed pseudonym, so we can know we're > talking to the same person. Done! I will be "thoth", keyid AFB8AB41. > In the meantime, I prefer to concentrate on the things I do pretty > well, like writing and thinking. Perhaps my apparent frustration is caused by the fact that I've become convinced that crypto-anarchy will not come to pass (I posted a lenghtly scenario earlier of that I think the future will be like). I think that writing and thinking is the only thing any of us can do that will have impact. The only coding effort I can see paying off is helping to make PGP better. Maybe that's what I'll do. Thoth -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLmFkXvFYvlqvuKtBAQHnAwP/RvH7UWt4wzDLjQ4oDUdJiEd5g32q4ueH U/zh6JzDFQyB8LaECT5PTrgEyYin05jlgxyvBp6PNTIoMTpWA7+/gLZ0q546ZSEj xgCtBesES2O1jDPmcXsOSMoN1CVJ9hToaDhgZVtoxoxcEtCht7h09nGr0cHZznMn M7NpkmEvwWQ= =kvQg -----END PGP SIGNATURE-----

3 2

Sendmail & POP for PCs & Macs w/TCP?
by sw＠tiac.net 17 Dec '03

17 Dec '03

Is there any reason sendmail and POP shouldn't compile fairly easily for PCs and Macs that have TCP/IP support? If that was done, couldn't I configure my Eudora to talk to a local sendmail and POP (TCP/IP within my own machine) which would then do whatever fancy filtering and then talk to the remote sendmail and POP? Can sendmail receive mail through POP? Or would it be easier to write an SMTP/POP intermediary from scratch? Or, jeez, has this all been done? --Steve - - - - - - - - - - why did the chicken cross the infobahn? finger for more info.

2 1

Linux and PGPsendmail
by blane＠squeaky.free.org 17 Dec '03

17 Dec '03

X-Secure: add-key I now have my system somewhat kludged into the net. I can now EASILY send and receive PGP messages from my home box. I am connected to my shell account at free.org throught a local xyplex terminal server and term 2.0.4 I use popclient to get my mail from my host(a better way may be possible), and I have my local smtp service redirected to squeaky.free.org so that I can send mail out without a hassle. Anyone who needs help getting set up like this can e-mail me. PGP messages are welcome! Brian

1 0

Re: Is Off-Line Digital Cash Dead?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Different businesses have different attitudes toward off-line cash and similar things. For instance, Bart/Metro magnetic subway tickets, and the similar scrip that supposedly is popular in Japan are all semi-electronic money, half-offline (don't know if the subway tickets get reported to central locations or if all the processsing is done locally...), and yet there's nothing more than honesty and the technical difficulty of forgery that keeps them from being forged. Postage meters are also off-line, and unlike subway rides, which are hard to make lots of money accumulating (:-), mail-oriented businesses could save lots of money using fake ones. The main similarities I see between the above kinds of money is that they're mainly issued, either directly or indirectly, by the providers of specific services, and they're hard to use for other kinds of service. Since they use physical tokens, though they may have digital information on them, they're obviously hard to email across the internet, but anybody you can send email to is already online... As I see it, there are three main reasons for wanting offline cash - - avoiding the need to wire your cash register equipment - avoiding the per-event communication costs for the transaction - avoiding the time delay for the communication Per-event costs may be low, but in the non-wired world they're non-trivial. A phone call typically costs at least one message unit, say 5 cents. A CDPD cellular packet, according to some pricing I've seen, is similar. That's not much money when you're selling cars, but it's a lot for newspapers. Here at the former National Cash Register company, we've found that retail stores really like wireless communications to the cash register; in stores without datacomm wiring, it means you don't need to install any, and even if there's wiring in place, being able to move point of sale terminals around can be worth a lot, and if you only have to find a location with AC power wiring and not data, you're more flexible. The time delay for credit card verification is also an issue - modem-based systems typically take 15-20 seconds, while on-line systems take 2-3 seconds when the network isn't busy. That's an important issue at a retail store, when you can spend the transaction time putting merchandise in bags - it's far more important for things like road tolls or subway turnstiles. And waiting three days for your remailer network to bounce back an acknowledgement on your retail cocaine transaction will just _not_ do :-)! If you can accomplish all these successfully with offline systems, great! Too bad it's hard to do while retaining anonymity. Bill Stewart

1 0

Re: DigiCash ???
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Jim Dixon writes: > In message <9408281521.AA13945(a)ua.MIT.EDU> Jason W Solinsky writes: > > > I would like somebody to explain how I would go about using an anonymous > > > digicash system to buy a automobile? [ new car at local dealer ] ... > Do we care that you can't get it on the road without insurance in most > states, and that the registration must be in someone's name? Unfortunately, the government has gotten away with nearly banning non-anonymous automobile use and ownership, for various reasons including ability to tax, keeping insurance companies happy, controlling the population's behavior, etc. However, by the time digicash is well enough established that a car dealer will _accept_ N thousand dollar payments in it, if the rules for being allowed to own cars or money aren't much nosier, you want to walk into the dealership on a rainy night in February, offer them an annoyingly low price for the car, they accept, you refuse the offers to lease or finance the car, and they say "Foo Bar Holding Company? We won't take your corporate check without bank certification, but we'll take Star/Plus/Sanwa/Mac ATMs, Western Union digicash, credit cards for an extra 3%, or Federal Reserve notes for an extra 1% cash transaction reporting fee." Bill

1 0