December 2003 - cypherpunks-legacy

Re: Vinge's True Email name ?
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>Lou Poppler says: >> I knew that old compuserve account was good for something. >> They list Vinge, Vernor San Diego CA 72267.2656(a)compuserve.com > Of course, he might have used his true name because he wanted to hear from people. Tom Clancy seems to enjoy the newsgroup created to discuss his books and he posts there regularily. Many people strive to become famous because they love the adolation of the fans. Others don't. Who knows about VV?

4 3

Re: Anonymous payment scheme
by RGRIFFITH＠sfasu.edu 17 Dec '03

17 Dec '03

>At 09:45 AM 1/3/95 -0800, Hal wrote: >> ... As I wrote, banks are >>required to get SS#'s for depositers right now, and I wouldn't expect >>that to change any time soon. If anything, the trend appears to be >>towards more tightening rather than less. ... > >Isn't that only a requirement on interst-bearing, or potentially >interest-bearing, accounts? > > --Paul J. Ste. Marie > pstemari(a)well.sf.ca.us, pstemari(a)erinet.com > Yes, but the account form will have a place for it anyway and the account opening person will demand it. My experience a few years ago was that I had to go to an officer and point out that the account was not interest bearing and so the SS# was not required in order to get the account opened without it.

1 0

HUMOR:...and we thought _PRZ_ had troubles!
by ddt＠lsd.com 17 Dec '03

17 Dec '03

My apologies for this non-crypto posting, but I just _couldn't_ resist sharing. Ironically (incredulously?), paranoia does nothing to improve one's grasp of adjectives and adverbs... Anyway, please, please restrict your replies (if any) to private email amongst yourselves and don't follow my poor example and post anything more about it to the list. BTW..."Half" street?! dave ____________________________________ "Fascinating, Captain." -Mr. Spock =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= cut here =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Newsgroups: alt.alien.visitors Subject: Truth or Paranoia? From: doctor.doom(a)citylink.uu.holonet.net Date: Fri, 6 Jan 95 21:56:00 EST I found the following disturbing post on a BBS in the Washington DC area: Msg # 48 of 83 Date: Fri 12-03-93, 6:29 pm From: UNIT Read: 7 times [1 Reply] Forwarded From: 1900 Half Street, SW Subject: important The story I am about to relate may seem incredulous in many ways even thought it is true and I solemly attest that it is true despite the fact that it seems incredulous in many ways there is verifiable evidence and i urge you to verify the evidence on your own if you should find this incredulous which is the natural response. I am a victim of government sponsored terrorism and racism sponsored by the us government and big corporations which actually work HAND IN HAND with the us government towards these ends. This of course includes the liberal media although some cells of independence remain and not all individual journalists are accessories to the conspiracy. Suffice it to say that democracy does not in any way exist in the United States of AmeriKKKa. The government has been out to get me ever since I was born in 1966 as a result of a specific genetic coding abnormality which makes me unique among the 99.9999 th percentile of the American population and makes people like me marked for harrassment. The abnormality may have been spawned by mass CIA mind control tests conducted in 1961, which affected certain birth patterns. They actually have attempted to cause me to try to kill myself on several occasions and have attempted to drive me crazy by chemical and psychological means including retroactive radio control from the future (any scientist will tell you that radio waves which move faster than light speed are capable of moving backwards in time and thus controlling the past). The constant chemical assaults on my well being mean I cannot leave my apartment except in dire circumstances and then I must breathe through a gas mask. Not only that but people are strategically placed at all places I interact with people out of necessity (I cannot avoid such encounters entirely) to make me self aware and paranoid. These efforts are futile and I continue to defy the Amerikkkan government. On June 11 1986 they deliberately influenced me by radio to be present at the intersection of Sherman Avenue and Harvard Street NW at precisely 1:42 am and I had to cross seven blocks of territory that had been sealed by the police. This is documented. I witnessed seven police forces engaged in a shootout that lasted three hours. THe police forces were shooting at EACH OTHER and I counted at least thirty verifiable casualties. Although this has never made the newspapers due to the government/corporate conspiracy the information is readily obtainable but must be sought through FOIA requests at the FBI. The files are disguised as traffic fatalities and the true cause of death is not noted. Also documentable is my genetic trait which Johns Hopkins in Baltimore will provide upon demand. I am considered a threat to the CIA because of my superior evolutionary status and my radical thoughts. In 1971 the United States abandoned the Bretton Woods system of fixed exchange rates and secretly implemented a dual currency system along with ruling elites from other major countries including the USSR and Red China. I know this because agents have tried to buy me off with this currency which exists solely in the form of informational transactions and has no physical manifestations yet makes a mockery of the valueless Dollar. I am a man of integrity and I refused to participate in this plot. Needless to say the federal deficit is measured in dollars and is therefore nonexistent and irrelevant. The secret currency system is solvent. In 1987 the Wall Street Journal documented the cataclysmic stock market crash but made no mention of the real underlying factors behind it, which again represented a government conspiracy. After I wrote to the Wall Street Journal to point this out, attempts to kill me trebled. There are also listening devices implanted everywhere to monitor my actions and junk mail sorted with DMSO and curare arrives daily. I remove the mail with tweezers and leave it on the counter for the mailman as unreturnable. He wears gloves of course. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government does not directly try to kill me but relies on third-party means which I have so far avoided. A rental car I obtained in Sausalito in 1989 was irradiated with depleted uranium which increased the total mass of the car by 33% d would have caused me to go over a cliff were it not for the normal precaution I take of always driving 15 mph under the speed limit. But it is this kind of insidiousness which I am consdtantly faced with. I also can only cross the street in crosswalks so that any attempt to kill me with a vehicle could not be blamed on pedestrian error. The only reason I am still alive is because I persist in making my case public at every opportunity, which means the government will not try to kill me directly, since that would verify my claims instantly in the public's eyes. For that reason I urge all of you to write to the media, contact your senators, and do everything you can to let the conspirators know that my story has been heard, and that the eyes of the public are upon the conspiracy. It is only through concerted collective action that I can remain alive and the AmeriKKKan government which has been ruling illegitimately since a secret coup in 1947 (documented at the Library of Congress) can be brought down and freedom restored. -end?-

1 0

Re: for-pay remailers and FV
by Nathaniel Borenstein 17 Dec '03

17 Dec '03

Excerpts from fv: 9-Jan-95 Re: for-pay remailers and FV db(a)Tadpole.COM (2073*) > Also, there is no reason on earth to take FV for payment under > such a scheme, No reason on Earth? Try any of the following: 1. You can actually get paid, in real money, using a system that is operating NOW. 2. It requires no special software for the user of the remailer service, thus preserving a very positive feature of most of today's anonymous remailers. 3. You don't need to have a credit card merchant account (and the technical arrangements for using it) in order to run a remailer service. There are more, but those are probably the top three. > I don't see any reason to get FV involved, unless one were so lame > as to be unable to get signed up directly with the credit card > companies as a merchant -- a process of appropriate complexity > to indicate the posession of at least one (1) clue, which is prob. > desirable in someone who's going to be handling remailer finances Well, I could be wrong, but from the above paragraph I can only infer that you've never actually tried to set yourself up as a merchant. The hardest part is getting approved for a merchant account. Unless you already have an established business or money in the bank, this will *probably* be a showstopper if you want to set up a remailer-for-pay service. Getting a merchant account is never trivial, and getting one in a whole new industry is VERY hard. Once you have a merchant account, establishing the right technical setup to do the actual authorization and purchases is not rocket science, but it certainly requires more than "1 clue" -- in particular, it typically requires hooking up some special hardware, installing and configuring some new software, and some serious thought about the implications for your system's security. None of this is needed if you use FV. Also, as Paul pointed out, the requirement for reversibility applies to ANY credit-card-based service, not just FV. This is NOT an option, it is required by law (reg Z). Excerpts from fv: 10-Jan-95 Re: for-pay remailers and FV Hal(a)shell.portal.com (2603) > Perhaps you could charge some small amount for them, but require VISA > payment, and check the names on the VISA cards. (This doesn't hurt > anonymity when the tokens are actually used because of the blinding.) To > get multiple tokens a person would have to commit some serious real world > name trickery, a considerably higher barrier than making up a pseudonym > on the net. This is workable. It also reinvents a big chunk of what FV does, if you do it yourself. -- NB

2 1

Re: Remailer Abuse
by Rich Salz 17 Dec '03

17 Dec '03

What lists did you post to?

1 0

RC5 data, anyone?
by Andy Brown 17 Dec '03

17 Dec '03

Has anyone got any plaintext/cyphertext/key data sets that I can use to test my RC5 implementation against? +-------------------------------------------------------------------------+ | Andrew Brown Internet <asb(a)nexor.co.uk> Telephone +44 115 952 0585 | | PGP (2048/9611055D): 69 AA EF 72 80 7A 63 3A C0 1F 9F 66 64 02 4C 88 | +-------------------------------------------------------------------------+

1 0

Rumored CBS "hit" on internet coming
by Brad Dolan 17 Dec '03

17 Dec '03

This may be old news or it could be bogus but fyi anyway: >From parsons(a)bga.com Mon Jan 9 05:16:49 1995 >From: Brad Parsons <parsons(a)bga.com> >Subject: CBS/C.Chung Plan Hit Job on Internet? (fwd) >To: bdolan(a)well.sf.ca.us > > >Brad, Could you forward this to the cypherpunks list? Thanks.--BJP > >---------- Forwarded message ---------- >Date: Mon, 9 Jan 1995 03:48:01 -0600 (CST) >Subject: CBS/C.Chung Plan Hit Job on Internet? > >A friend tells me that CBS and Connie Chung plan a hit job on Internet >on the evening news today, 1/9/95. Apparently it may be in the context >of youths supposedly learning how to make bombs from online info. In >case I don't get to watch it, could somebody make it a point to watch >it and give us a summary of the report. Thanks. Reply, if you're inclined, via e-mail. I'm off the list until the Carol Ann stuff dies out. - Brad Dolan, bdolan(a)well.sf.ca.us

3 2

Re: revoked transactions/guerrilla fee remailers
by jrochkin＠cs.oberlin.edu 17 Dec '03

17 Dec '03

At 8:15 PM 01/09/95, L. McCarthy wrote: >- - From what I've seen so far, accepting payment would seem to make anonymous >_operation_ of a remailer well nigh impossible. Anonymous operation with >revenue would require a corresponding level of anonymity in the transfer of >money. Until such time as conversion of funds from a net-liquid form to a >conventional form becomes unnecessary (or just commonplace ?), financial >traffic analysis can't adequately be thwarted. >All this bodes ill, IMHO, for the prospect of guerrilla or quasi-guerrilla >remailers charging for service any time soon. There's just too much >infrastructure to which they'd need to be tied at the moment. Well, that's certainly true, for the reasons you gave. Right now, it's enough of a chore just to get non-anonymously run remailers charging for operation. And it's not easy to set up an effective guerilla remailer either. I think the set of tools and environments that make it possible to run a remailer anonymously and charge for it certainly aren't going to exist until the component problems of charging for a remailer at all and running a guerilla remailer at all are made easy. I think once both of those problems are dealt with, it won't be too dificult to deal with the combined problem of guerilla for-pay remailers. Or at least, exactly what things are neccesary to solve that combined problem will be obvious.

1 0

positive publicity for anonymity
by nissim＠acs.bu.edu 17 Dec '03

17 Dec '03

I've just posted a proposal to alt.config for a new group alt.temping I'm hoping that temporary workers will use this as a forum to compare and contrast temp agencies, wage differences, 'permanent hire penalties' etc. There are about 4.4 million business service temps in the US. Wage differentials are noticeable - one egency will pay $2.00 more than another; this means $320/month to a temp worker. I expect temps to use anonymous posting capabilities to compare wage rates and company patterns *anonymously* because they may fear discrimination from their agencies. (I know I would) This seems like a very positive use of anonymity. Not only will millions of people on the bottom rung of office life be able to gain advantage by information, there are clear parallels to areas in the past of the left where unions and workers rights were seen as causes of first importance. In fact, the troubles involved in being temporary have been championed several times on television. This might make a good counterargument to 'teenagers and pipe bombs' If we say anonymity is a tool that helps up to 3-4% of the work force make intelligent choices and get paid more we may key into the left wing slant of the media. Treon Verdery (not posting from Adam's account this time!)

1 0

AT&T produces video encryptor -- is it clipper based?
by perry＠imsi.com 17 Dec '03

17 Dec '03

I just saw a story go by on the dow jones wire saying that AT&T had developed a "comprehensive security system for commercial information services". It is said to be an encryption system developed jointly by Bell Labs and VLSI, and its intedned for set-top boxes and "the internet". VLSI was one of the contractors on Clipper. Anyone know if this is an "escrowed" system? Anyone know any other details? Perry

2 1

Re: intelligent discovery agents
by Rich Salz 17 Dec '03

17 Dec '03

>Visit Sang at http://www.inlink.com/users/sangria/homepage.html >Sang has more information on Robots, Spiders, Ants, and Worms >than any other computer person I have yet to link up with. I suspect your original respondent doesn't get around very much. Rummaging around the above URL gets you little more then http://web.nexor.co.uk/mac/doc/robots/robots.html Tracing down the above URL points you to You really want to get the WWW conference proceedings; try email to wwwf94(a)osf.org and also http://www.ncsa.uiuc.edu/SDG/IT94/Proceedings/Agents.html Ob-crypto: there is a Security.html (instead of Agents) but it's more commerce-oriented, except for the DCE Web paper.

1 0

(fwd) Re: Racism on the Internet
by jamesd＠netcom.com 17 Dec '03

17 Dec '03

Xref: netcom.com alt.internet.services:40076 alt.internet.media-coverage:2932 Path: netcom.com!ix.netcom.com!howland.reston.ans.net!pipex!uunet!nwnexus!news.halcyon.com!usenet From: mpdillon(a)halcyon.com (Michael Dillon) Newsgroups: alt.internet.services,alt.internet.media-coverage Subject: Re: Racism on the Internet Date: Wed, 28 Dec 1994 18:11:51 +0000 Organization: Memra Software Inc., Armstrong, B.C., Canada Lines: 36 Message-ID: <dfQ0lapDlT1B073yn(a)halcyon.com> References: <18570UODGFHLRSDHOUP(a)curvet.com> NNTP-Posting-Host: halcyon.com This is forwarded from can.infohighway. Note the quote from Rutkowski at the bottom. This info should be more generally know on the net. In article <18570UODGFHLRSDHOUP(a)curvet.com>, dshaw(a)curvet.com wrote: > > IN>ae763(a)FreeNet.Carleton.CA (Harvey Goldberg) writes: > > >I work for the Canadian Human Rights Commission. > >I am currently doing research on the use of the > >Internet for the propagation of hate material. > >The purpose of the research is to determine what > >measures could be considered to control the use > >of the Net for this type of purpose. > > >I would appreciate hearing from anyone who has > >any views, information or comments on this > >subject or who know of anywhere on the Internet > >where this matter is discussed. > > According to Tony Rutkowski, Executive Director of the Internet > Society, "The Internet from a regulatory standpoint falls into the > category of private value-added networks, and in most countries under > the treaty provisions of the ITU, as well as the GATT, these are > networks that are outside the purview of government. To the extent > that there is any kind of obligation by governments, it is to allow > such networks to exist on a competitive basis". <Internet World, > January 1995>. --------------------------------------------------------------------- Cool cats, brick bats, bad boys wearin' big hats Surf's up, my cup, floating, flying, rising up. Michael Dillon mpdillon(a)halcyon.com C-4 Powerhouse, RR #2 michael(a)junction.net

1 0

Re: for-pay remailers and FV
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 03:53 PM 1/9/95, Doug Barnes wrote: > ... Also, there is no reason on earth to take FV for payment under >such a scheme, if one wishes to preserve anonymity, and not have >to deal with the fraud/reversal factors. (The stamp issuer >would not know which blind-signed stamps were issued to the >turkey who reversed all his credit card transactions two months >after buying them -- see various threads on this vis-a-vis >using FV to buy blinded digital cash and why it won't work too >well.) > ... I don't see any reason to get FV involved, unless one were so lame >as to be unable to get signed up directly with the credit card >companies as a merchant -- a process of appropriate complexity >to indicate the posession of at least one (1) clue, which is prob. >desirable in someone who's going to be handling remailer finances MC/Visa require the reversibility of transactions as a condition of their merchant agreements. It's not something peculiar to FV. In fact, under certain conditions it is mandated by federal law. Escort services have a similar problem as far as non-returnability goes, but I don't know how they finesse their way around it. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

revoked transactions/guerrilla fee remailers
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > MC/Visa require the reversibility of transactions as a condition of their > merchant agreements. It's not something peculiar to FV. In fact, under > certain conditions it is mandated by federal law. Escort services have a > similar problem as far as non-returnability goes, but I don't know how they > finesse their way around it. Two plausible tactics for escort services: [0] Price inflation: treat a revoked transaction rather like shoplifting, by passing the costs on to the customers; escort services are not cheap [1] Embarrassment: tip off family and employers of people who accept escorts, then decide not to pay for them; the perceived threat of publicity should keep plenty of folks in line There's not much that can be done to someone who uses an escort service once, revokes the transaction, and doesn't care who knows about it. How might this apply to remailing services ? Right now, with a fairly small customer base, I imagine price inflation would be impractical, but embarrassment might prove fairly effective. In the developed market we envision, presumably operators could get away with price inflation, but embarrassment would lose much of its potential sting. (I assume that once a critical mass of populace uses remailers, an announcement that Josie Worsham has used a remailer would elicit only yawns.) Do others see the resulting applicability of additional regulations to remailers as an issue in having them charge for service ? Within the category of fee-charging remailers, the distinction between non-profit and for-profit operations may be worth considering. I suppose that the IRS and analogous agencies would be inclined to ask questions about it, for starters. My threat model for the remailer bramble includes, at a minimum, a host of typical government agencies obligated to wrap everything in red tape. Look for anti- trust investigations to be launched against a price-fixing cartel of remailers. - - From what I've seen so far, accepting payment would seem to make anonymous _operation_ of a remailer well nigh impossible. Anonymous operation with revenue would require a corresponding level of anonymity in the transfer of money. Until such time as conversion of funds from a net-liquid form to a conventional form becomes unnecessary (or just commonplace ?), financial traffic analysis can't adequately be thwarted. All this bodes ill, IMHO, for the prospect of guerrilla or quasi-guerrilla remailers charging for service any time soon. There's just too much infrastructure to which they'd need to be tied at the moment. -L. Futplex McCarthy; PGP key by finger or server "The objective is for us to get those conversations whether they're by an alligator clip or ones and zeroes. Wherever they are, whatever they are, I need them." -FBI Dir. Freeh - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxHeC2f7YYibNzjpAQGhlQP/fkyvN0QqDkbLhgqecGUaeu3cbCstMd4y lgs/XzCeiXVt6EiQ8tmDVbq4G0QYTGntph/3knciJopGrH+Nu6LVmiqWNiRWFxm8 zJBRenCW2SN9nRixJiI4S2n0yQ//v9C7sOEfmu9SToQDYc+U1CBNSUhhJAveT1GN BD4WNFlm/WY= =VY8W - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxHfcSoZzwIn1bdtAQGyEAGAwKES86hkJ8GkLsYCr+vEAjH1/L2GdrCj jw0b83L7FHA99sUihIYe2zUUxr+Sqb2b =7Aai -----END PGP SIGNATURE-----

1 0

Re: Pornography, What is it?
by Raul Deluth Miller 17 Dec '03

17 Dec '03

Pornography is in the eyes of the beholder. [Especially if the beholder happens to be a postmaster in Memphis...] -- Raul D. Miller N=:((*/pq)&|)@ NB. public e, y, n=:*/pq <rockwell(a)nova.umd.edu> P=:*N/@:# NB. */-.,e e.&factors t=:*/<:pq 1=t|e*d NB. prim=:1&=@| 2&^@<: [. large=:>&(2^1024) x-:d P,:y=:e P,:x NB. (d P,:y)-:D P*:N^:(i.#D)y [. D=:|.@#.d

1 0

Pornography, What is it?
by root 17 Dec '03

17 Dec '03

From: ravage(a)bga.com To: cpunks the world over Hi all, I am very interested in the data haven issue now that I have my site up. The aspect of pornography is a problem that has to be faced. To this end, I would like to ask that we look at how pornography is defined. >From my own view, I fail to see any way to truly define pornography as anything other than the ravings of a neurotic (both on a personal and a societal level). Every example of pornography I have seen has been put in that category because it contravenes some personal or group taboo. Take care.

3 5

data havens
by Raul Deluth Miller 17 Dec '03

17 Dec '03

The problem with encryption, in general, is that it's an attempt to hide information -- unless the information is trivial, encryption is only a temporary measure. Believe it or not, the government (or, more properly, people associated with the government) is still trying to figure out which industries are Iraqi owned -- one technique being brought to bear is statistical analysis of company activities, with special attention to changes which occurred during the gulf war. The only way to have data havens be acceptable to the U.S. government would be to have them become acceptable to the U.S. population (or some significant fraction of them). This would imply phasing out the DEA and the IRS, at a minimum. [Newspaper article this weekend: how it's so horrible that some people deal in cash and thus are evading the IRS.] More generally, the way to keep a data haven from being located is to make sure it doesn't have a location... This is hard to do without severely impacting latency. -- Raul D. Miller N=:((*/pq)&|)@ NB. public e, y, n=:*/pq <rockwell(a)nova.umd.edu> P=:*N/@:# NB. */-.,e e.&factors t=:*/<:pq 1=t|e*d NB. (,-:<:)pq is four large primes, e medium x-:d P,:y=:e P,:x NB. (d P,:y)-:D P*:N^:(i.#D)y [. D=:|.@#.d

1 0

Privacy markets
by rishab＠dxm.ernet.in 17 Dec '03

17 Dec '03

mkj(a)october.ducktown.org wrote: > Bottom line: Anonymity is the only available tool which puts control > over my own privacy firmly into my own hands, where it belongs, and > does so without infringing on anyone's freedom of speech. Certainly Some months ago I extended this to the concept of privacy markets - where individuals will be able to disclose their 'truename value' to providers of services (such as libraries, publications) whose marketing would benefit, in lieu of cash. I rather think big business is in a better position than government to exploit the 'profiling' fallout of universal use of truenames. In the hope of increasing the declining signal content on the list, I'm reposting my article: ====================== Electric Dreams Weekly column for The Asian Age by Rishab Aiyer Ghosh #35, 31/October/1994: Selling privacy as a commodity It was once said that you should never post publicly to cyberspace what you don't want to see in tomorrow's newspapers. While newspapers are rarely interested in your idle thoughts, others are. Future employers, advertisers and an army of 'user profilers' have begun to exploit the availability of huge data banks of Net traffic, just waiting to be indexed by your names and opinions. It is already possible to buy CD-ROM or tape archives of posts to newsgroups on the Internet. Collecting newsgroup posts as they arrive is trivial. Apart from ordinary Internet connections, all newsgroups are available on one- way, open-access satellite data broadcasts. As traffic flows in, it can be indexed and backed up on extremely cheap storage media such as Digital Audio Tape, for later search and retrieval. While the US National Security Agency is naturally one of the best at hunting for signs of incorrect thinking in cyberspace, several techniques to search large volumes of data by very flexible criteria are publicly available. Electronic writing is one of the best sources for employers to learn the views of prospective employees. The groups people participate in can also form useful inputs to consumer profiles. Some companies have already started offering directory services based on posts to USENET, the semi-official collection of major newsgroups. It is easy to imagine Profiles-R-Us shops that sell dossiers on any individual, detailing political, religious and sexual preferences, and other interesting tidbits - all the nasty things you ever said about Microsoft, for instance! Public discussion is of course just that, and it's ridiculous to attempt to prevent it being put to use for purposes not originally intended. The remedy to an invasion is to build walls; when the invasion is one of privacy, the walls are technological. Some pioneers are already protecting themselves through the use of encryption, digital signatures, and multiple pseudonyms - making it impossible for profilers to associate opinions with real people. In a way, the Invasion Of The Profilers is a good thing - it will make individuals realize what little privacy they have, and teach them the value of privacy. Not everyone will want to seal themselves in private cocoons. Most will not object to some loss of privacy, but in exchange for a (not necessarily monetary) share of the profilers' profits. Individuals will control their privacy and selectively reduce it when it benefits themselves. A particularly useful application of this is in an electronic public library. Once access to data is severely restricted to protect intellectual property rights, the Internet as a source of knowledge for everyone will die, unless libraries are opened to provide information free of cost. Such libraries need not survive on subsidies; rather, they can ask for a copy of any information base in cyberspace from all publishers. By limiting access to individuals who are willing to give up some privacy, the library and publishers will benefit from the sale of users' access records to advertisers. Advertisers will be delighted, as most other inputs for profiling in a privacy- aware society will be unavailable. Finally, users will get free access to information if they so choose, at a cost that they can agree to. While one can be frightened by the ease with which a multitude of Big Brothers can monitor the citizens of cyberspace, technology, as always, has something for everyone. As it becomes easier to search through electronic communications, it also becomes easier to protect privacy to varying degrees. Individuals will be forced to be aware of risks to their privacy. With the opening of markets for profiles, privacy may finally find a concrete value. Rishab Aiyer Ghosh is a freelance technology consultant and writer. You can reach him through voice mail (+91 11 3760335) or e-mail (rishab(a)dxm.ernet.in) --====(C) Copyright 1994 Rishab Aiyer Ghosh. ALL RIGHTS RESERVED====-- This article may be redistributed in electronic form only, PROVIDED THAT THE ARTICLE AND THIS NOTICE REMAIN INTACT. This article MAY NOT UNDER ANY CIRCUMSTANCES be redistributed in any non-electronic form, or redistributed in any form for compensation of any kind, WITHOUT PRIOR WRITTEN PERMISSION from Rishab Aiyer Ghosh (rishab(a)dxm.ernet.in) --==================================================================-- ----------------------------------------------------------------------------- Rishab Aiyer Ghosh "In between the breaths is rishab(a)dxm.ernet.in the space where we live" rishab(a)arbornet.org - Lawrence Durrell Voice/Fax/Data +91 11 6853410 Voicemail +91 11 3760335 H 34C Saket, New Delhi 110017, INDIA

1 0

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

Pierre Uszynski writes: > Significant abuse is > that which causes significant problems for the operators: posting > secret religious technology, forging prime minister mail, harrassing a > member of any number of opposite persuasions, etc... on that note, check out this excerpt from the remailer-help file of the q(a)c2.org remailer: > Abuse/Self-Preservation Policy: > Abuse of the Q Mixmaster Remailer consists in those uses of the remailer > which endanger its continued operation. Please don't ruin anonymity > services for those people with legitimate needs for them.

1 0

Response to CBS News "drive-by" attack on the internet
by Brad Dolan 17 Dec '03

17 Dec '03

January 10, 1995 Eric Ober President, CBS News 524 W. 57th Street New York, NY 10019 Dear Mr. Ober: In its 1/9/95 evening news broadcast, CBS aired a segment presenting a number of people who argued that the content of school libraries, written communications, and electronic communications should be censored for the common good. Since CBS did not present anyone with an opposing point of view, I assume the position presented is believed by CBS to be correct and not controversial. At first I was concerned about your network's apparent lack of support of first amendment rights to freedom of speech and of the press. Then I realized that these freedoms are only to discuss topics which could not result in physical or moral harm to anyone. I have some friends who share your concerns. They have been trying for years to reduce availability of morally dangerous materials like _The_Catcher_In_The_Rye_ and _Heather_Has_Two_Mommies_. They will be so excited to hear that you are now on their side. Sincerely, Brad Dolan bdolan(a)well.sf.ca.us

1 0

Re: Anonymous videoconferencing applications
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Alan Bostick writes: > I thought so too, at first; but then I thought of this obvious application: [lurid details omitted ;] "Ever seen your children bound and blindfolded from across the globe ? You will...." > Whether technology is going to be developed for the convenience of > kidnappers and terrorists is an open question. I'd answer, "Undoubtedly," but I wonder just how readily available such technology would be to, uh, the rest of us. > But there is clearly > at least this one clear use for anonymous video conferencing. Perhaps headhunters would find it handy for anonymous job interviews with candidates who prefer to remain nameless, but not jobless.... -L. Futplex McCarthy - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxIrqmf7YYibNzjpAQGE9AQAlSGdkOEWsbXICCygoa4Sr+Gj9y91xHeS 3YpA40lODXDmvAoIxWRtpOt2k3a1G381xwxaSCh7b+Wh90V4dknS/ysvu/VLLdUG k1H/eGttn+TzcVPARc0fxExDV5yNxueDRaqil1sDnsgtVyBMzCmu6jdHKL4molku 5zN0SLh2RLY= =zmcz - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxIstCoZzwIn1bdtAQFiIQF9Ho6rMKp+ii7kSgFalxf8j+05ZHTFkxCc /LQUDOvxy1jXK5+EpaOwP/LyI5fru7YQ =ZD2g -----END PGP SIGNATURE-----

1 0

Re: Data Haven problems
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 07:25 PM 1/9/95, dfloyd(a)io.com wrote: > ... Of course, the DH will be hidden by a good remailer (anon.penet.fi), but >it is trivial to use traffic analysis to find where the DH lies. Just >monitor traffic from/to the remailer and do a series of store/retrives. >Then for confirmation, forge a mail from the dh site to the remailer with >the password (obtained from sniffing) to yourself. ... Hmm, hmm. Using c'punk remailers with encrypted send blocks fixes one problem, especially if the c'punk mailers do some sort of file splitting and reassembly along the lines of what happens to IP packets that are too large for a given link. What would also help would be a mechanism for randomly varying the encrypted send-to block. The password replay attacks can be fixed by encrypting the transmitted password along with a timestamp/sequence number. One problem that remains would be a trail left by the increased traffic to/from a DH vs a normal user. That could only be fixed by a multitude of DH sites. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

2 1

PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF (long)
by Christopher Allen 17 Dec '03

17 Dec '03

-----BEGIN PRIVACY-ENHANCED MESSAGE----- Proc-Type: 4,MIC-CLEAR Content-Domain: RFC822 Originator-Certificate: MIICRjCCAdsCBQJTAAAEMA0GCSqGSIb3DQEBAgUAME4xCzAJBgNVBAYTAlVTMRMw EQYDVQQIEwpDYWxpZm9ybmlhMSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1l bnQgQ29ycG9yYXRpb24wHhcNOTQwNjI3MDAwMDAwWhcNOTUwNjI2MjM1OTU5WjCB 4DELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExKjAoBgNVBAoTIUNv bnNlbnN1cyBEZXZlbG9wbWVudCBDb3Jwb3JhdGlvbjETMBEGA1UEERMKOTQxMTQt MzYxNTETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNU2FuIEZyYW5jaXNj bzEeMBwGA1UECRQVNDEwNC0yNHRoIFN0cmVldCCmNDE5MRIwEAYDVQQMEwlQcmVz aWRlbnQxGjAYBgNVBAMTEUNocmlzdG9waGVyIEFsbGVuMHAwDQYJKoZIhvcNAQEB BQADXwAwXAJVKa43Pd6AhLaYGRLMwvGGvZ7dtzK+XpsRtwKYEDQKHE8swS09ViEg MKuMa/+weQXDBpqQ6SDj/xgHGzmwGhkbeitPWr/6Du5gemMLrhhTs8eMhAXLXwID AQABMA0GCSqGSIb3DQEBAgUAA1YAEkQDfJmroAMZD5v1F7fPK38y4waoX0FSpdsf jcXf04URcEJc5dCFm0DzrMPMdVpNz5tpSBy0ZUeg/xqbwRfHIW34bMAVLc9kojIi AGXlHL/q8HRCIx== Issuer-Certificate: MIIB6TCCAVYCBQJBAAAKMA0GCSqGSIb3DQEBAgUAMFwxCzAJBgNVBAYTAlVTMSAw HgYDVQQKExdSU0EgRGF0YSBTZWN1cml0eSwgSW5jLjErMCkGA1UECxMiQ29tbWVy Y2lhbCBDZXJ0aWZpY2F0aW9uIEF1dGhvcml0eTAeFw05NDA1MDUwMTEwMDRaFw05 OTA0MzAwMTEwMDRaME4xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlh MSowKAYDVQQKEyFDb25zZW5zdXMgRGV2ZWxvcG1lbnQgQ29ycG9yYXRpb24wcDAN BgkqhkiG9w0BAQEFAANfADBcAlUpc+2/Ec+bydwsB6enemznB/aQwd4gp2YSI3FW PHl2tc/aa7HZFA0qCL/0Ol6ituC+yUEO3IWKQ5U8hhl1RVqmW7mzwNOr2yeHIFA5 rqXvAvMvlGpvAgMBAAEwDQYJKoZIhvcNAQECBQADfgA2QEssX/nG3spHBpbkU4KV oQdVhxtQEmjuIrqBVI9jQRntacJ0tw1m5MsLV6hNMV/mD0yKmDc9ywSF7ZWIipVY tz8E52yQEprR+JxTad+/ZtTI0wEvEM5313jUF4ivF86eOuZDqHd4zbRHk6ggIAGH 86GFbMaWDaKoGUrde2== MIC-Info: RSA-MD5,RSA, J9l0zSgqnVqK8a9QQ3Ml+O6tv58PsVmCELOQTqj1i8HCQoHpJ+bEmayf4WyIbqoY y4xFecAPQfP5hpHPLVoLX4IM7kNT0UhDHW8XklfhhAVE1+Y0Og== Date: Mon, 09 Jan 1995 09:00:00 -0800 Subject: PRESS RELEASE - RSA Licenses Commercial Distribution Rights to RSAREF From: Christopher Allen <ChristopherA(a)consensus.com> Organization: Consensus Development Corporation, San Francisco, CA USA Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Text-Source: ftp://ftp.consensus.com/pub/consensus/pr/RSAREF-PR.txt X-HTML-Source: http://www.consensus.com:8300/RSAREF-PR.html Summary: RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Keywords: press release, consensus development corporation, rsa data security, rsaref, commercial license, support, marketing, maintenance, encryption, digital signature, source code, tool kit, PEM, privacy enchanced mail RSA Licenses Commercial Distribution Rights to RSAREF ===================================================== RSA announces that it is licensing commercial distribution rights of its RSAREF software to Consensus Development, allowing for implementation of commercial Privacy Enhanced Mail (PEM) applications. Press Release - ------------- REDWOOD SHORES, CALIFORNIA--JANUARY 9, 1995--RSA Data Security, Inc. and Consensus Development Corporation jointly announce today at the RSA Data Security Conference that Consensus Development is licensing the commercial distribution rights of RSAREF from RSA Data Security. RSAREF (pronounced "R.S.A. reff") is short for "RSA reference implementation" and is a cryptography source code toolkit designed to allow developers to create PEM (Privacy-Enhanced Mail)software and other encryption/authentication tools. Until now, RSAREF has been an unsupported RSA product approved for use only as part of freeware and not-for-profit software applications. Consensus Development will now be able to market and license RSAREF to commercial software developers, and provide software support and future enhancements to the RSAREF source code library. This announcement is significant because it is the first program of its kind to make the RSAREF implementation of RSA's popular patented authentication technology available to commercial vendors. "Data mailed, posted, or put on servers on the Internet is inherently untrustable today, " said Jim Bidzos, president of RSA. "Tampering with electronic documents takes no special skills, and leaves no trace.With the availability of RSAREF for both free software as well as commercial software there is no need for this situation to continue." Now that a commercial license to RSAREF is available, applications may now be developed and sold that incorporate Privacy-Enhanced Mail's authentication and encryption capabilities. Christopher Allen, President of Consensus Development adds "The PEM standards have been under development for a couple of years and only now are coming to fruition. The ability to offer both freeware developers and commercial software vendors a license to RSAREF will kickstart the adoption of PEM-capable mail software." Consensus Development will be creating an email discussion list for software developers interested in RSAREF. To join the discussion, send a message to <listproc(a)consensus.com> with the body of the message requesting "subscribe RSAREF-DEV-L firstname lastname". Background - ---------- The RSA cryptosystem was invented and patented in the late 1970's by Drs. Rivest, Shamir, and Adleman, at the Massachusetts Institute of Technology, who started RSA Data Security in Redwood City, California, in 1982. Digital signatures are produced using the RSA Cryptosystem, which is a public-key cryptosystem. Each user has two keys - one public and one private. The public key can be disclosed without compromising the private key. Electronic documents can be "signed" with an unforgeable signature by using a document/private-key combination to produce a signature unique to the author and particular document. Anyone using an application that supports RSAREF and has the public key of the author can subsequently verify the authenticity of the document. Applications of digital signatures are endless: expense reports, electronic forms and purchase orders, contract revisions, engineering change orders, even tax returns can be electronically signed to speed electronic document flow and eliminate fraud. Furthermore, digital signatures can also be used to detect any virus before a program is executed, since any change whatsoever is detected. One reason that the paperless office has never materialized is that paper must still be printed so that handwritten signatures can be applied. RSAREF eliminates that necessity. Applications supporting RSAREF could have prevented last year's computer fraud at Dartmouth College, in which students were tricked into missing an important midterm by a fraudulent electronic mail message claiming to be from university faculty. Corporate Profiles - ------------------ RSA Data Security, Inc. <URL=http://www.rsa.com/> is the acknowledged world leader in encryption technology, with over three million copies of its software encryption and authentication installed and in use worldwide. RSA is a defacto standard for encryption and digital signatures, and is part of existing and proposed standards for the Internet, CCITT, ISO, ANSI, IEEE and business and financial networks around the globe. RSA develops and markets platform-independent software developers' kits, end-user products, and provides comprehensive consulting services in the cryptographic sciences. RSA technology has been embedded in the products of many companies, including Microsoft, IBM, Apple, Oracle, General Magic, DEC, Sun, Novell, Lotus, Motorola, Northern Telecom, AT&T, WordPerfect, General Electric, Hughes Aircraft, and many others. The company is headquartered in Redwood City, California. Consensus Development Corporation <URL=http://www.consensus.com:8300/> is a software development and consulting firm specializing in the support of organizations that need long-distance collaboration via wide-area networks and the Internet.Consensus Development has been offering consulting and software tools in the area of collaboration support since 1988 and is based in San Francisco, California. Clients include Aladdin Systems, American Information Exchange (AMIX), America Online, Apple Computer, Attain, Authorware, Berrett-Koehler Publishers, Claris Corporation, Component Integration Laboratories, Connectix Corporation, Digicash bv, Group Technologies, InterCon, ON Technology, Portfolio Systems, RSA Data Security, Ronin Publishing, Software Ventures, Visa International, and Xanadu Operating Company. Contact - ------- Kurt Stammberger RSA Data Security, Inc. 415/595-8782 <kurt(a)rsa.com> Christopher Allen Consensus Development Corporation 415/647-6383 <ChristopherA(a)consensus.com> $$ - ------------------------------------------------------------------------ ...Christopher Allen Consensus Development Corporation.. ...<ChristopherA(a)consensus.com> 4104-24th Street #419.. ... San Francisco, CA 94114-3615.. ... o415/647-6383 f415/647-6384.. ...Mosaic/WWW Home Page: .. ...Consensus Home Page .. -----END PRIVACY-ENHANCED MESSAGE----- Created with RIPEM Mac 0.8.5 b1

2 1

Re: DH Traffic Volume Analysis
by L. McCarthy 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Paul J. Ste. Marie writes: > One problem that remains would be a trail left by the increased traffic > to/from a DH vs a normal user. That could only be fixed by a multitude of > DH sites. Ubiquitous remailing -- having a significant portion of the net population bouncing around randomly fluctuating encrypted traffic as background noise -- should help to cover both remailers and data havens. It would be nice to have more people firing off occasional encrypted stuff to muddy the waters. (Picture yourself in Bridge over the River Kwai if it helps ;) -L. Futplex McCarthy; PGP key by finger or server - -----BEGIN PGP SIGNATURE----- Version: 2.6.1 iQCVAwUBLxIkLGf7YYibNzjpAQGZfgQAp464Szt+W1pvcHQRLH39kmato3tQaHIn mNSNjeXBwWqrgIXYoLAQfcX1qvVb0NJQikGc4P7Xo/o7Aa2LOIWTt6TRxXlUkaod gmYr6XGvoCST1eciMeMTKRjVRJgA6p4/GmQwQwmvFtTus1waS5T+RsNX0nbCu3ng eg3sZ5s7pKI= =973H - -----END PGP SIGNATURE----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBLxIlNCoZzwIn1bdtAQFGBQF/Zl+lLTMyM55oRF2PSsA0ld13i/I1uyvW sD3C3JkqgQ9XsDjGquKXoPwDCsAEgN6E =7MWJ -----END PGP SIGNATURE-----

1 0

Re: for-pay remailers and FV
by Hal 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: Pierre Uszynski <pierre(a)shell.portal.com> > Finally, I do not believe that introducing payment in the remailer > system would curb abuse in any significant way. Significant abuse is > that which causes significant problems for the operators: posting > secret religious technology, forging prime minister mail, harrassing a > member of any number of opposite persuasions, etc... Do you think for a > minute that a 5 cents postage is going to stop these messages now? And > how about when remailers do attain good reliability and untraceability, > for 3 cents? I had suggested an idea a while back where you would try to address the abuse issue directly rather than charging per message. I agree with Pierre that any reasonable per-message charge will not help in many forms of abuse, although it should address the worst spam attacks. The idea is to have a sort of digital cash token, but it is free. The key is that each person just gets one of these, but they are reusable. After a remailer sends a message, it waits and sees if it gets any complaints. If not, the token is re-blinded and made available to the original user via some kind of pool. He can then send another message. But if he commits abuse, he doesn't get his token back. Obviously there are problems with this, the worst probably being how we can keep people from acquiring lots of tokens under different names. Perhaps you could charge some small amount for them, but require VISA payment, and check the names on the VISA cards. (This doesn't hurt anonymity when the tokens are actually used because of the blinding.) To get multiple tokens a person would have to commit some serious real world name trickery, a considerably higher barrier than making up a pseudonym on the net. Another problem is that as stated above, you could only send one anonymous message every day or two. Perhaps we relax the rules and let people have a few of these tokens; they can then abuse the system a few times but each time they lose a token. A similar idea might work for the data haven problem, although I don't understand exactly what is intended there. This approach is a variation on the "is a person" credential, which attempts to make sure that each person only gets one of something. A lot of situations would benefit from such a credential, although some people don't like them. Hal -----BEGIN PGP SIGNATURE----- Version: 2.6 iQBVAwUBLxIw2RnMLJtOy9MBAQGWCgH6A1SFyzZDDhd/NVrMck5SAf3mS4IOl5On aJNFKUopZi4Fb7tqQfbFukDl/lF+clnBDBNh/yXAsFcABJaWaTUzZA== =pLOT -----END PGP SIGNATURE-----

1 0