December 2003 - cypherpunks-legacy

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

>Is the concept here that: Whereas conventional crypto generates/hashes >a *key* with which to encode the text, IPG generates a *pad* from a key, >more or less the length of the text, with which to encode the text?? It makes no difference whatsoever, no PRNG can have more entropy in the output stream than there was in the initial seed. Indeed, in general, the longer the PRNG runs for the more chance an adversary has of breaking it due to an increased amount of output. >It seems to me they're putting an additional layer of stuff ("OTP") between >the key generation and the actual encoding, so what's the problem with that, >as a concept? Well for a start it`s not a one time pad because that requires a totally real random pad. They have a stream cipher, as for whether it is any good or not I would normally not trust a man with the talent for bullshit Don Wood has. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

4 3

Anarcho-Science Fiction
by Robert Hettinga 17 Dec '03

17 Dec '03

At 2:08 am -0500 11/24/96, Roy M. Silvernail wrote: >[ I freely admit this is noise ] Yeah. What he said. >C'mon, both of you... 'First Contact' falls _way_ short of Doc Smithean >proportions. Although Data's charade did kinda remind me of the fourth >Skylark book, in terms of plot-device rescue of a failing direction. >(IMHO, Doc Smith is the master of the over-the-top school of sci-fi >plotting) Unfortunately, I've had trouble sticking my tounge in my cheek far enough for people to see it lately. My apologies. >> Even Babylon 5, AKA "Science Fiction He Wrote", has a bigger clue. > >B5 is my current favorite TV sci-fi, when I even turn the damned thing >on. Ditto. Again, I was trying so hard to be facile that I wasn't clear enough. :-). For all the constraints of televised science fiction, I *really* like JMS and B5. Especially compared to the pseudoscientific sugar-coated totalitarian happy horseshit that passes for Star "Treck" these days. Much less such scienceless silliness as the X-Files, or Lois and Clark. However, at the risk of being forced into the trap of science fiction which tells more about when it was written than the future, I find the presentation in science fiction of faster-than-light travel, "alien" visits or travel to "alien" cultures, time travel, prophecy, telepathy, (or any other pseudomystical claptrap) to be extremely annoying. Almost as annoying as "fantasy", which doesn't even belong near the science fiction bookrack (how about the "romance novels" section? ;-)). Much less, a science fiction bookstore. For instance, I think the concepts of faster-than-light travel and anything beyond rudimentary interstellar radio reception of other civilizations belongs in the era of the Lensman's "inertialess" drive. An almost pretelegraphic, age-of-sail world view, developd when sea power was still the dominant form of "projecting" force. However, I do look forward to science fiction with cryptoanarchic economies, and, interestingly enough, a solarcentric universe. People just don't understand that we have a monsterous amount of undeveloped physical resources in this solar system. I expect that when we actually look down with any accuracy on the moon's poles, for instance, we'll find water buried there ("where the sun don't shine" as a friend put it a few days ago), just like it is on Murcury. The belt alone is big enough for us to spread out into into it for the next, say, 7000 years. That's at the human species' historic argicultural and industrial growth rates, the very same "frighteningly asymtotic" growth rates that had the Club of Rome gibbering hysterically in the early 70's. Before, of course, we came to our senses and remembered that Malthus is still quite dead. A central fact of human existance is that progress is always more "geometric" than population growth. Every time we discover a way to extend human life expectancy, the population grows until everyone goes through a demographic transition and figures out they don't have to breed so much to get the same rewards out of life anymore. We're humans. We build stuff. We always find new resources, and we always use them to our own advantage. So, what else is new? The extinction rates that happen and the habitat modifications that humans *always* make when they take over a new ecosystem have been with us ever since we had the ability to kill at a distance and use fire. A very long time. Modern humans grew up living on savannahs, so they cut or burn down forests so they can hunt game or grow food. (Or suburban lawns, for that matter.) The aborigines burned their habitat for 40,000 years. The American prairies have evolved to burn, a process immesurably accellerated by the active burning by 14,000 years of humans. Fortunately, we're about to be confronted with our toughest resource challenge yet. An "ecosystem", or more properly, a set of ecosystems, that we're going to have to build ourselves, from scratch, outside the earth's atmosphere, either free-floating in space, or on the surface of an inhospitable planet. I used to think that that will mean that we would then use the opportunity to "save" the rest of the species of this planet from certain extinction. Earth as biopark. Now I see that kind of thinking is pure romantic hogwash. We are not anti-nature. We *are* nature. We will do what it takes for us to survive, like any other species. Earth will not be "saved", it will continue to be modified to our own needs. Because, like the metaphorical dog, we can. <ewww!!!> :-). We may not make the same disaster of it that we made of the Tigris-Euphrates valleys or the Southeastern Mediterranean, but the "conserving" nature is an oxymoron. Or maybe even a tautology. Anyway, this also means taking other species with us when we move off the earth, and changing those species, and ourselves, to meet the physical conditions of survival in a new paradigm of extraterrestrial resources. By way of my own politically correct "reclaiming" of language, I mean "extraterrestrial resources" literally, of course. Not "extraterrestrial" as in ETs or BEM's, or LGM's or UFO's, or any other such "alien" bunk. I'm carving my own crop circles into the landscape of pseudoscience, if you will, ;-), and using "extraterrestrial" to mean just what it says: off the earth. Speaking of other "species", I now also see the technology of cryptofinance to be integral to this next stage of human expansion. Centralized industrial control regimes aren't suited to extremely decentralized automated decisions, like the kind that could happen in a micromarket. I think that eventually, the idea of micromoney as processor food will create the economic efficiencies necessary to coordinate the very large macroengineering projects that extraterrestrial existance will require. If you can use cryptofinancial controls to organize a swarm of habitat-building bots, then your structure appears to an observer like it's building itself. The bots work because they're paid to. They "evolve" into more efficient builders of stuff because they make more money when they do, and they compete with each other to do it. By the same token, the money is not raised by some kind of central financial "action-figure" like McNamara, or William Sword, or J. Pierpont Morgan, (and especially not a World Bank McNamara-mandarin) but by a swarm of millions (or billions) of finance-bots of various kinds living throughout a geodesic economy looking for places to park their excess cash. Central project planning considers such competition wasteful, and the paradox is that the Misian calculation argument holds for a manager of a macroenterprise the same way it did for any Soviet Commisar. Sooner or later, you can't figure it all out in enough detail to execute it, and that's where the project stops. I think we'll step through this dilemma into a world where everything is, as Kevin Kelly says, "Out of Control", where stuff happens not because someone planned it down to the last detail, but because, like the above dog, it can <ewwww!>. So, what does that mean in terms of science fiction? Well, certainly Stevenson understands all this, only he's not as much of a space-opera hound as I am. Sterling's "Schismatrix" handles extraterrestrial society fairly well, but it certainly is pre-cryptoanarchy. I didn't like "Islands in the Net" even though it had the same theme of taking someone out of their mileu and stopping time around them while the world passed them by. In IitN, the heroine was being captured by guerillas, in Schmatrix, it was kidnapping and putting people in suspended animation for a decade or two, just for kicks. Frankly, protocrypto or no, Vinge strikes me as more than a little silly at times, with stasis fields, and physical constants varying with your distance from the galactic core, and talking dogs and all that other stuff. Cherryh writes almost perfect space opera, among other things, and I see her as a perfect decendant of Smith and Heinlein. People I think I now lump in with Forrester's classic "Hornblower" novels. I really like Ian Banks, but even his ideas and certainly his politics (and not his story telling, of course) now pales in comparison to the stuff you get from imagining the consequences of a geodesic economy. Gibson now seems positively industrial, and even the Difference Engine makes perfect sense when seen in this light... One of the reasons I don't like science fiction anymore is that, like a lot of people here have said about themselves, and for the first time in my life, I'm out in front of the science fiction writers on something which is so fundemental that, frankly, their stuff now makes me laugh. This from someone who not too long ago read science fiction by the yard. I suppose this will eventually make me want to evangelize stuff like cryptoanarchy, financial cryptography, and micromoney mitochondria to science fiction authors. Or, maybe, just by shooting our mouths off here and by being archived doing so, all of us already have done our evangelizing. On the other hand, some day this stuff will be old hat, and I can go back to buying science fiction by the yard to learn about new stuff. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Skipjack patent and GATT
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Since Skipjack is protected by a secrecy order, the NSA can patent the algorithm without disclosing it. As soon as it is reverse-engineered, the patent is officially issued and expires 17 years from the time it was issued. GATT now changes the patent laws so that a patent expires 20 years after application. Does anyone know how this will affect the Skipjack patent? If the secrecy order is considered application, then that would shorten the lifetime of the patent considerably (assuming it isn't disclosed or reverse- engineered any time soon). I doubt this is the case, and I suspect that either the 17 year lifetime will still apply or the patent will expire 20 years after the patent is issued. TIA. Mark - -- finger -l for PGP key PGP encrypted mail prefered. 0xf9b22ba5 now revoked -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQEVAwUBMpoTWyzIPc7jvyFpAQFHywf8Do9Fni5GC0kfL0XR7FGM6yLhVwLNgf4h XJZlpMMML46MWmmqwjfJnCgi+ktMQMHxTT2mCYA2eIzEBq0FbAc8M9340Xkx0KPH L1qi2tQ1ZCKnUdVWYENYL65uJAk4dB3lgsnmBJwNb80GD3tP6LVSq5wFSa2pz/Pu 3HO5YNUHmTfvrtZE2wt/7CMwJNxEPTKpTGAbDnwkri6y2u2aDrUD1nhnlfzqUz86 85TNTIpqPo06d3g1wKSKmddwqYeu3kpyu0khdUzS5rjj/7sJAECLQi2IlXkXOLjo OsaKG+sl9UNSYn9wrU+HvE9BbhlmC4B1sfOHPBqJDQ405QWurQHSZg== =sRxa -----END PGP SIGNATURE-----

1 0

Re: Smart card attacks vs. clipper?
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

(snip) > Seems like it's a bit of a different story, since in the Clipper's > case the algorithm is (ostensibly) unknown, but I'm just curious as > to whether there is some compromise of its security-through-obscurity. Actually, in a more recent attack to be published at USENIX (if i remember correctly) the attack being performed can also be utilized to help determine unknown algorithms. I will try to dig up the reference (unless someone gets to it first). Matt > -- > ______c_________________________________________________________________ > Mike M Nally * IBM % Tivoli * Austin TX * How quickly we forget that > mailto:m5@tivoli.com mailto:m101@io.com * "deer processing" and "data > http://www.io.com/~m101/ * processing" are different! > >

1 0

Donate your spare cycles to a good cause
by Lucky Green 17 Dec '03

17 Dec '03

It's that time of year. Please donate the spare cycles on your Pentium or PowerPC to a good cause and help find a new Mersenne prime while you sleep. See http://ourworld.compuserve.com/homepages/justforfun/range.htm for details. Seriously, folks, what is your PC's CPU doing half the time? I thought so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred

1 0

Re: Exon Countdown Clock and farewell messages
by azur＠netcom.com 17 Dec '03

17 Dec '03

This is a draft of my letter to our dear retiring senator. Any suggested improvements? ------------- Honorable Senator Exon, Although in all likelyhood you will never read this memorandum, I wish to express my sincere regret at your retirement and thanks for your many years of ignoble service to our nation misrepresenting the wishes of your constituents. You have served as a stallwart against change as did those who resisted the telephone, automobile, radio, television and computer (to name but a few) before you. You are a champion of politically correct thinking and behaviour, perhaps the most dangerous manifestation of an American trend to intolerence and obedience to social rules. It is a shame we will not have your carcass to kick around in the halls of Congress come next term. All the luck you're due. -- Steve Schear

2 1

[CRYPTO] Bank Cards, Interac, Bank Machines, etc
by C Kuethe 17 Dec '03

17 Dec '03

I'd like to hear what everyone knows about security holes in bank machines. I don't believe in that little bank machine cracker they used in Terminator 2, but I'm interested in the algorithms and protocols the ABM uses to communicate w/ the home bank. My bank says they have some special chip inside the ABM to secure the transfer, and that's all they told me. I also heard that the magnetic stripe on the back contains your card number (the shiny metallized numbers on the front) encrypted using DES using your PIN as the key. Way out to lunch? Too close for comfort? Any knowledge...heck, even rumors.... would be appreciated. That way we can see what kind of FUD is out there. My bet is that the magstrip with DES'd card number on it theory is FUD. But my bank did say that there were some fraudulent transfers (read successful hits) in Europe. I bank with Alberta Treasury Branches, and they said their hardware is immune to the attack that was performed in Europe.... I will have to dig a bit on that one. Anyway, I hope I hear something from all of you soon... -- Chris Kuethe <ckuethe(a)gpu.srv.ualberta.ca> LPGV Electronics and Controls http://www.ualberta.ca/~ckuethe/ RSA in 2 lines of PERL: http://www.dcs.ex.ac.uk/~aba/rsa/ print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: KILL cypherpunks !!!
by Eric Wilson 17 Dec '03

17 Dec '03

At 07:28 PM 11/25/96 -0500, you wrote: >On Mon, 25 Nov 1996, aga wrote: < whole bunch of stuff > >> This is a world-wide internet problem that you are about to get >> taken care of. You will be among the first locations to be >> eliminated. And just remember that your termination is your own >> doing. You had your chance to keep the fucking cypherpunks list >> OFF of your e-mail to me, and blew it. > >Oops, now what will I ever do? Wow, I'm going to miss cypherpunks. I didn't post much, but I've always been an avid reader (sniff). If I only had it to do all over again... Oh, by the way, since you're planning on doing away with things, could you get rid of some of these outfits that do the mass e-mails, thanks in advance. >> I pump iron and run three times a week. And as a Tae Kwon Do >> black belt holder, I get lots of physical activity. I am in >> better physical shape than any other man that you know. > >I have a date this weekend already, thanks. I find you're martial arts reference very interesting. But if you were truly any good, you wouldn't be waving it in everyones face like a banner. I find your demeanor to be that of someone that has never practiced the warrior arts. If you had, you'd have developed more respect for your fellow human beings. I'm guessing you're a very lonely person, whos only way of getting attention is to try and cause a conflict. Share your pain with us, and together we'll grow stronger ( Star Trek reference ;)). But if you can't do that, shut off your computer ( or leave your terminal), and go find someone to talk to, like a counselor. Eric Wilson ----------------------------------------------------------------- Join the BugList! "How many times?" The Blind Man http://case.cioe.com/~serw30

1 0

Need info on non-OS specific random functions (pref C++)
by Rick Osborne 17 Dec '03

17 Dec '03

I am looking for information on non-OS specific RNGs. Nothing really complex, just easily portable to a few different OSs and compilers. Any pointers would be appreciated. Thanks! Rick Osborne / osborne(a)gateway.grumman.com / Northrop Grumman Corporation ------------------------------------------------------------------------- Q: How many surrealists does it take to screw in a lightbulb? A: Two. One to hold the giraffe and the other to fill the bathtub with brightly colored machine tools.

2 1

An interesting tid-bit
by Mark Neely 17 Dec '03

17 Dec '03

I was just testing out some new search software, and polled Alta Vista to see how it all worked. I used "sex" as my search term, and Alta Vista reported that their were "no documents matching - sex ignored"! Interestingly enough it will let you search with other, sex-related terms (such as "nude", "f*ck" etc), but not sex! Very bizarre indeed. Mark Mark Neely - accessnt(a)ozemail.com.au Lawyer, Internet Consultant, Professional Cynic & Author BizWeb: For Serious Intrepreneurs - www.maximedia.com.au/bizweb

2 1

market for hardware RNG?
by jim bell 17 Dec '03

17 Dec '03

I'm considering building a PCB to make a hardware random number generator. My first impression is that it will consist of a reverse-biased zener (for a broadband source of uncorrelated white noise) driving one of those one-chip FM recivers, with the audio output driving an 8-10 bit flash A/D convertor. Fairly simple. For cryptologic applications, the output would have to be hashed down to a somewhat smaller output of bits since not all outputs are equally probable, but I suppose after such massaging it could produce at least 2 bits of randomness per sample at a 10 kilosamples per second or so, possibly much more with a wideband receiver chip. But on thinking about this a little more, I began to wonder if anybody really wants this. Pessimistically, it occurs to me that: 1. Many if not most people don't even understand why a hardware RNG is desirable. 2. Users of programs like PGP today already get at least a fairly decent RNG already. Would they want better? (I'm not suggesting a total replacement; I assume that the output of any hardware RNG would be hashed with more "traditional" PC sources, like disk timings, keyboard timings, etc, which should deter attempts to attack just the hardware part.) 3. Even hardware RNG's aren't "perfect": they could be subverted, replaced, or perhaps influenced. Would someone who was sufficiently sophisticated as to recognize the need for it actually accept a real, functioning device? On the other hand... if this kind of pessimism had infected Phil Zimmermann before he wrote PGP 1.0, he might have deleted the first 50 lines of code, erased the file, and said, "fuck it!" Jim Bell jimbell(a)pacifier.com

2 1

Netscape working with the NSA.
by Tim Tartaglia 17 Dec '03

17 Dec '03

Check out the following: http://www-tradoc.army.mil/dcsim/browser.htm Here's an excerpt: > ...Netscape has been working with NSA...Their proposed solution is based > on the use of Fortezza card technology. In November NSA expects to > certify Netscape Navigator 3.0 for "unclassified but sensitive" use... Tim

2 1

The dish on TEMPEST
by Lucky Green 17 Dec '03

17 Dec '03

The following is from a tread involving a friend of mine. An ex-military fellow. Take it for what you want. I believe him. >>> This depends in large part on the strength of the >> > degausser and how long it remains powered up. The one >> > I have I used to "clean" 10.5 inch tape reels written >> > at FM broadcast quality to a noise level -20db down from >> > brand new tape - this back in my quadraphonic stereo >> > days. It will not quite suck satellites out of orbit... >> > TWA planes, maybe. >> >> >> -20dB down from new would be a better spec if new tape was typically >> nulled rather than just blank low-level white noise. >> >> However, even so, a SQUID is a very scary thing.... I've been out of commission for a week and found 276 messages in my in-box today. The tapes I was writing about were those already "prepared" for recording "items of interest", and had already been degaussed in the preparation procedure to FM broadcast standards then/there. My little hummer would take whatever whit noise remained even then to a further 20 dBA DOWN from the ridiculous levels then/there specified. In other words, it's pretty good. Of course, IF Big Brother wants, there are any number of ways for him to obtain whatever information he wishes. I recall long, long ago, I was privileged to watch a demo of equipment (1955 or 1956, I forget exactly) in a truck parked a MILE away from our CommCenter, in the years before Faraday cages, TEMPEST, etc., and watch these guys print out a 5x5 copy of our top secret traffic as it was read by the [elided upon request] one-time-tape encryption devices. Shortly after that demo, our CommCenter was moved into a cave (no joke) and modified to "low level" dc signalling voltages. And other measures were taken to screen the area... I _have_ led an interesting life... As for Squids, only if you read Jules Verne are they scary. Otherwise, cleaned and fried with a tangy dipping sauce, well, that's another story! --Lucky

1 0

CNET News Dispatch November 25th, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

************************************* CNET NEWS DISPATCH Monday, November 25, 1996 San Francisco, California, USA ************************************* CNET NEWS DISPATCH is a daily newsletter that summarizes the up-to-the minute technology news presented by CNET's NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd ************************************* CONTENTS SCOOPS AND TOP STORIES Mother of all notebooks to be shot out of Canon in December The Web version of driving your car at blazing speeds of up to 325mph Death, where is thy...ping?(?) "Honey? Could you answer the toaster? I'm talking to Frank on the microwave." Comdex sucks! No, it rules! Sucks! Rules! Does not! Does so! Oh, so that's why O.J. has that battered copy of Neuromacer ANNOUNCEMENTS An easy way for you to customize NEWS.COM Search the site for particular topics and articles Send us your questions, comments, flotsam, and jetsam How to subscribe and unsubscribe Late-breaking stories just a click away with Desk Top News ************************************* SCOOPS AND TOP STORIES MOTHER OF ALL NOTEBOOKS TO BE SHOT OUT OF CANON Here are some numbers that might keep ThinkPad and PowerBook vendors up late at night: 200-MHz Pentium processor, 13.3-inch active-matrix display, 1.4GB hard drive, 8X CD-ROM drive. These formidable figures apply to Canon's 3200FX notebook, appearing in December at a showroom near you. It should thus become the highest-performance notebook on the market --but is it worth the price?... http://www.news.com/News/Item/0%2C4%2C5692%2C00.html?nd ************************************* THE WEB VERSION OF DRIVING YOUR CAR AT 325 MPH Have you been impressed by Peak Technologies' Peak Net.Jet, whose creators have dubbed it the "turbocharger for the Internet"? If so, keep an eye on the horizon for Datalytics' Web accelerator, Blaze, which will supposedly let users surf the Web up to five times faster than they do today. The company claims that four key weapons in Blaze's arsenal give it the edge over existing accelerators, not to mention a team of blue-chip bundling partners... http://www.news.com/News/Item/0%2C4%2C5707%2C00.html?nd ************************************* DEATH, WHERE IS THY...PING?(?) Maybe you've never been pinged. Maybe you've never known the feeling of being on the business end of a huge chunk of data that overwhelms and then shuts down your machine. But if it DOES happen to you (as Karl Malden used to say), what will you do? What WILL you do? StorageTek's Network Systems Group claims it has the magic bullet that is a mere four lines long and takes only seconds to download... http://www.news.com/News/Item/0%2C4%2C5708%2C00.html?nd ************************************* "HONEY? COULD YOU ANSWER THE TOASTER? I'M TALKING TO FRANK ON THE MICROWAVE..." Even before the appearance of the much-awaited "information appliances" that are supposed to help us live like the Jetsons, Mitsubishi Electric America and Diba are trying to drive down their cost by as much as half using new chip technology. Some of the miracle gadgets expected include set-top boxes with email and Web access, Internet-enabled phones with touch-screen interfaces, and a "tour guide" device with a CD-ROM and built-in camera that visitors could use in self-guided tours of museums and exhibits. Oh, and don't forget to ask for the exciting "Toast Waiting" feature... http://www.news.com/News/Item/0%2C4%2C5704%2C00.html ************************************* COMDEX SUCKS! NO, IT RULES! SUCKS! RULES! DOES NOT! DOES TOO! If you've been to Comdex and survived, how did you manage it? NEWS.COM wants your war stories. We will publish the best five, and the winners--picked on a totally subjective basis by our editorial staff--will get supercool CNET T-shirts. Mail suggestions(a)news.com, and include the words 'Comdex stories' in the subject header of your message. To paraphrase the Prez, "Let us feel yur paynnne..." http://www.news.com/Comdex/?nd ************************************* OH, SO THAT'S WHY O.J. HAS THAT BATTERED COPY OF NEUROMANCER... As humorist Dave Barry might solemnly intone, "We are not making this up." Yes, Virginia, hackers did indeed vandalize the O.J. Simpson civil trial section of AOL's Court TV site. A user reported that when he clicked onto the particular section, a screen popped up with the words, "This area is under construction," and, "It's a PIC of OLAF." Such esoteric language puts this one right up where with Dan Rather's surreal "Kenneth, what is the frequency" episode... http://www.news.com/News/Item/0%2C4%2C5712%2C00.html?nd ************************************* ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 SEARCH THE SITE FOR PARTICULAR TOPICS AND ARTICLES Search the entire NEWS.COM database for stories you saw in News Dispatch, or track any story we've run. http://www.news.com/Searching/Entry/0%2C17%2C0%2C00.html?nd SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com HOW TO SUBSCRIBE AND TO UNSUBSCRIBE To subscribe to News Dispatch: Send mail to listserv(a)dispatch.cnet.com with the message: subscribe news-dispatch (your name) in the message body. To unsubscribe send the message: unsubscribe news-dispatch LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd ************************************* CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Re: Symantec's claim.
by Alan Olsen 17 Dec '03

17 Dec '03

At 03:45 PM 11/25/96 +0200, cracker(a)icon.co.za wrote: >Anyone come across the pkz300 trojan,if you have it send it please. Why would you want it? The PKZ 3.0 trojan is at least 5 years old. (I am amazed I can still read the disk my copy is on without the magnetic media flaking off.) It is a pretty pathetic trojan at that... And no, I am not going to send you a copy. You would use it not for good, but for evil. (And not the fun sort of evil either. That required things and devices you are far to young to know about... As well as black leather clad women with <ahem> ... Sorry...) I suggest that you put your inquisitive nature into researching something that will do you some good. (Or at least, get you out of the house.) --- | "Remember: You can't have BSDM without BSD." | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

1 0

[GAK] Clipper chip
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim C[rook] May likes to lick the semen-shit mixture that accumulates in the crack of his mother's ass.

1 0

Re: Another Nutty Idea about SPAM
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Steven Garman wrote: > I have had yet another twisted idea. I would be interested in your thoughts. > > Once method of combatting the spammers is to use disinformation. For example > we use new addresses for their "remove" lists to check on their honesty. > > What about attacking the lists themselves with false data? Say you run a site. > You can make and delete accounts as you please. So, make a whole bunch of > new accounts, and submit them by various means to places that will probably > use them in bulk e-mail lists. Then, delete the accounts. Viola, the lists > have some worthless addresses. Another nutty idea: to create a database of people who do NOT want to receive unsolicited advertisements, and make it widely available. The obvious problem is that some very uncsrupulous spammers would want to grab this database and use it as a source of email addresses. This problem has a solution, however: instead of distributing people's email addresses, distribute MD5 checksums of their addresses. For example, an entry for ichudov(a)algebra.com would be b51175dae78f25427351d5e3ff43de30 There is no way to guess the original text from an MD5 checksum. Spammers should be advised to exclude all addresses with MD5 checksums from that database from the recipient list, and include instructions on how to get one added to the database into their spams. Database maintainers could even provide a email filter-bot that would accept recipient lists by email and send back the same lists, but WITHOUT addresses that wish not to receive spam. This way stupid low-tech spammers (who make up the majority) will be able to process their email lists quickly and easily. This database may be maintained centrally. Users may be able to sign up for inclusion into that database by email or by filling out a Web-based form. Identity verifications may be done by using cookie protocol. - Igor.

2 1

Re: Provably "Secure" Crypto
by Dana W. Albrecht 17 Dec '03

17 Dec '03

The Deviant <deviant(a)pooh-corner.com> writes: > On Mon, 25 Nov 1996, Dana W. Albrecht wrote: > > Rigorous proofs of the non-existence of an algorithm are not new. > > Neither are rigorous proofs that any algorithm which can solve a given > > problem requires a minimal running time. Or, in an even stronger sense, > > Hrmmm... I seem to see a problem (namely Moore's first law) in assigning > anything a "minimal running time". Perhaps "minimal instruction count" > would be more suited to your example. Because if you're talking about > time, it essentially boils down to "the longer something takes the less > time it takes". > > > that a particular known algorithm for a given problem is indeed a > > (provably) optimal algorithm for that problem. > > Never happen. It just won't. As a rule, there's _always_ a faster way. This is just simply not true. In fact, since you seem to have gracefully failed to quote the section of my prior post which demonstrates otherwise, let me re-iterate it: > > For a (non-cryptographic) example of a proof of the first sort --- that > > is, that "there exists no algorithm" --- consider the famous "Halting > > Problem" for Turing machines. (I believe someone else has also > > mentioned this.) There are many proofs such as this one, often related, > > though the Halting Problem itself is perhaps the most famous example. > > > > For an (again, non-cryptographic) example of a proof of the second sort > > --- that is, that "any algorithm that solves a given problem requires a > > minimal running time" --- consider the proof that the "minimal" number > > of key comparisons in the worst case required to sort a random list of > > elements for which only an ordering relationship is known is O(nlog(n)). > > See Knuth, Volume 3, section 5.3. For a simpler example, a standard > > "binary" search which requires O(log(n)) comparisons to find a given > > element in the worst case is provably the optimal algorithm for this > > task. Which part of this have you failed to understand? Look in section 5.3.1 of Volume 3 of "The Art of Computer Programming" by Knuth. You will find there a rigorous proof that the "information theoretic lower bound" of an algorithm which sorts by comparison of keys is O(nlg(n)). Alternatively, refer to section 6.2.1 of the same book where it is demonstrated that a binary search by comparison of keys on a sorted list where no other information is available is an "optimum" algorithm. If you wish to discuss this further, then you're going to have to directly address what's widely known and beautifully articulated in Knuth. > > Turning once again to cryptography, there is presumably an "optimal" > > algorithm for factoring a "general" number in the "worst" case. Of > > Ok, now I have to pose a question: If cryptographers actually beleive > this, why continue to search for a faster one. That's easy. That an "optimum" factorization algorithm exists does not mean it is _known_. Similarly, while one might demonstrate a mathematical lower bound on the worst-case running times of all possible (known and unknown) factorization algorithms, this does not mean that an actual algorithm which runs in this time is known, nor does it even mean that an actual algorithm which runs in this time even exists. If you want a completely useless (but easy to prove) lower bound on the number of operations a factorization algorithm must necessarily have, I submit to you a trivial one: 1. Proof of this is left to the reader. :) Proofs of more interesting lower bounds left to experienced mathematicians. > > Turning once again to cryptography, there is presumably an "optimal" > > algorithm for factoring a "general" number in the "worst" case. Of > > course, known algorithms for factorization seem to regularly improve and > > no one has even suggested that any current algorithm is (provably) the > > "optimal" algorithm. Worse case bounds on running time for currently > > known algorithms can certainly be produced, but no one currently knows > > if these are the best algorithms. > > Again I say, there's _always_ a faster way. No, there's not. While no proofs of useful lower bounds on factorization algorithms are presently known, this does NOT mean that they do not exist. That such proofs exist for other, simpler algorithms (see above) just simply refutes this statement. > > Obviously, discussion on this topic is unrelated to such security > > problems as implementation mistakes, fault analysis, outright theft of > > keys, etc. I hope that I've been careful to explain what I mean by > > "provably secure" and that it's not interpreted to include these types > > of attacks. > > Yes, I must commend you on your amazing tact in asking this incredebly > irrevelant question. You're welcome to think it's irrelevant. I, for one, am glad that people like Matt Blaze took the trouble to do some work in this area. I'm also grateful that this has been pointed out to me in response to my previous post. (Thanks to "Mark M." <markm(a)voicenet.com>) Dana W. Albrecht dwa(a)corsair.com

1 0

Re: Netscape working with the NSA.
by Greg Broiles 17 Dec '03

17 Dec '03

At 05:34 AM 11/26/96 +0000, Tim Tartaglia wrote: > >Check out the following: >http://www-tradoc.army.mil/dcsim/browser.htm > >Here's an excerpt: > >> ...Netscape has been working with NSA...Their proposed solution is based >> on the use of Fortezza card technology. In November NSA expects to >> certify Netscape Navigator 3.0 for "unclassified but sensitive" use... The NSA has two main tasks: gathering [foreign] signals intelligence ("SIGINT") and making it difficult/impossible for other parties to get signal intelligence from the US ("INFOSEC"). Given the context of the information you found, it looks like they're negotiating with Netscape and Microsoft to evaluate the strength of their browsers to that the browsers can be used for "unclassified but sensitive" tasks; that is to say, NSA is operating in their "protect domestic data" mode, not their "wiretap everything" mode. Certifying the browsers (or other domestic privacy tools) as safe if they're not (or if they've got designed-in weaknesses) would play a very dangerous game - the NSA would gain little and risk a lot. They could (and probably do, or will soon) mandate the use of GAK crypto for official "sensitive" applications; so adding hidden weaknesses (which are essentially stealth GAK) doesn't give them much they don't have already, but it does create the potential that a third party will learn of the hidden weakness (through careful study or exploiting a traitor or whatever) and then have access to information the gov't would like to keep private for an unknown period of time - followed by a sudden expensive & disruptive switch of crypto tools when the discovery of the weakness became known. So it seems unlikely that there's anything bad going on here; it doesn't make much sense for the NSA (or other TLA) to intentionally weaken a crypto app and then certify it as secure for government use. They want to keep the good stuff for themselves, and make us use the weak software. They don't seem to be especially shy about telling us when they want to spy on us. I suppose it's possible to see government contracts as a foot in the door to economic "incentivization", e.g., if Netscape and Microsoft want the govt's money/approval badly enough, they'll switch over to the dark side. But this danger is pretty much unavoidable; and the government's got enough ways to coerce folks (cf. Jim Bidzos and the guys who want to run him over in the parking lot) that this seems mild by comparison. If the government chooses to apply some pressure to incentivize a corporation, they'll find a way. So far, it appears that they played fair when they certified DES as secure - and folks on the outside have been banging away on DES for almost 20 years, without finding any trapdoors. The balance of risks suggests that they'll probably keep playing fair when certifying privacy tools; not because they're nice guys, but because it's in their best interests to do so. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Bounty Server, Revisited.
by Petro 17 Dec '03

17 Dec '03

I have started drafting a proposal statement for the Bounty server. This is where I am at right now. I need as many comments on this as to the way it will work as possible. I am posting this from petro(a)smoke.suba.com because that is my primary account rather than snow, which is only for cypherpunks. Sorry for any killfiles this sneaks by. Please reply to snow(a)smoke.suba.com or the list. Thanks. Bounty Server, The proposal: Version 0.1 Abstract: This proposal is an attempt to outline a system for awarding cash payments for the creation of new technologies without the overhead or ownership associated with conventional systems such as contract or work-for-hire, or employee-employer systems. The objective is to actually bring this system online. Background: There is a lot of software floating around. It basically falls into 5 catagories: Commercial, Shareware, Freeware, Gnu (and other "Copyleft" schemes) and Public Domain. <Need to fill this in, but at this point we all know what the 5 types are> It is the "Copylefted" software that interests me at this point. There is quite a bit of high quality "Gnu" software, and at least one operating system based on the GNU mentality (linux) however there is a dearth of _enduser_ tools such as mail and news readers for the more popular end user operating systems, word processors and graphics editing software, easy to use Graphic Design Software (TeX is NOT easy to use) and easy to use Cryptographic software. In order to get these kinds of tools, especially the Cryptographic tools widely deployed, there needs to be a reason for someone to invest the time and effort into polishing the user interfaces and designing them for the average internet user to operate. Figuring out new algorythms is fun. Being on the cutting edge, or flipping the bird at Governments is fun. Doing something that has already been done isn't nearly as sexy, yet to deploy the kinds of tools we want _today_ and promote the development of the kings of tools we will want tomorrow, there needs to be some sort of mechanism in place to pay programmers to make these tools. This mechanism (IMO) should be "market" driven, it should allow the community of users to decide which projects should have priority, and which shouldn't. This mechanism should be as flexible as possible. This mechanism should be as simple as possible, and as easy to use as possible. Originally I proposed this to apply to software, but I don't see why it should stop at software. Initally the server will be restricted to software, but I hope that this will work out, and be expanded further. The proposal: What I am going to attempt to do is to set up a "Bounty Server" where someone can iniate a "bounty" on a peice of technology. The initator will write up a set of specifications for the technology, and an initial award to be paid to the developer. They then post it on the server and send their initial "bid" to the organization. This is the "bounty". Other people can add to this bounty, allowing the totals to add until someone claims that bounty by providing proof of development to the initiator of the bounty. In software terms they would upload the software to the server and notify the originator of the bounty, and the server operators. Other technology will be figured out as it becomes necessary. Originally I was going to put the stipulation in that the software written must be Copylefted. I decided that that wasn't really necessary, but rather simply desired. To aid in that desire, I am going to build in an initative to releaseing the software "copylefted". To get more specific: A bounty is considered to be posted when the initial payment is cleared by the bank, and the specifications (discussed later are considered clear enough to avoid interpretation problems. The initial bounty contract gets posted to the WWW server, (possibly) to a "developers list" of interested people, and (possibly) to an appropriate UseNet Newsgroup. Once the bounty is posted, other people can "bid up" or add to the bounty, and their contribution will be added to the total bounty as well as their "name" (email address) added to a list of contributors (unless they request not to). The amount they gave will not be listed. It isn't important. At this point contributions and initial bids will be accepted by credit card, check, money order, and possibly ecash (e-cash will be taken at some point, but it really isn't important at this point since almost no one uses it.) The first developer to upload a _working_ package to the server will be awarded the total bounty, minus "brokerage" fees (discussed later) "First" will be soley determined by the time stamp of the server. As soon as the package is uploaded, the initiator and the server adminstrator will be notifed, and the bounty marked "claimed". If the package is accepted by the initiator, the bounty will be marked "closed", the package moved to an FTP site for distribution (if Copylefted) or moved offline if not (archived copies will be kept for legal reasons-- more on that later). At that point a check for the developer will be cut (or ecash mailed if that works out). The Server Adminstrator will also do an cursory check to make sure that there are no obvious copyright violations. In the event that there is a conflict between the initiator and the developer, the claim will go into adjudication. The server adminstrators decesion is final, and he will make every effort to settle the claim fairly. Adjudication will incur an additional fee (see the fees section). Writing the bounty: The bounty specifications should include the following: 1) Target Operating Enviroment (i.e. Operating System for Software, and whatever for other technology) 2) What the desired technology is intended to be used for (i.e. a Word Processor, a Hardware RNG etc, whatever) 3) Desired Characteristics of the technology--specific features of the technology. It isn't enough to say that you want a word processor, you must specify minimum features you wish this technology to contain (i.e. WYSIWYG, Postscript output, Outliner etc.) 4) Desired "quality" level: Proof of Concept, Alpha, Beta, Release etc. 5) Copyright status desired--whether the software will be owned by the initiator of the bounty (in which case it is unlikely that anyone else will contribute), owned by the programmer (well someone might be that magnanomous), or "copylefted". 6) Where the initiators money is to go if the bounty is not claimed: I will provide a short (8 or 10) list of charities that the money will go to if the bounty is not met. This is to keep the initiator honest, as well as the server. Each contributor will also get this choice. I am sure that I am missing something here, and I will need some assistance in fleshing this out, as well as a couple of people to write different specs as examples. Adding to the bounty: The bounty will be considered added to when the deposit clears and is credited by the bank. A person adding to the bounty will also be allowed to choose from the list as to where they would like their money to go if the bounty expires. Fees: The Organization will get 2% of any bounty where the software or Technology that is copylefted. 20% of any other scheme. Adjudication will incur an additional fee of 2 to 5% depending on the difficulty in judging the claim. All interest that acrues belongs to the Organization, and will be used to defray any costs, or to provide for additional bounties should there be an apprecialble excess. Status: At this point in time I am (obviously) still in the process of developing the procedures. I have registered a Domain Name (bounty.org) and I have a couple promises off assistance in certain areas. As well, I have a server to start off with. Where I need help at this point: Legal issues. Any lawyers want to talk to me about this? Comments. I will be working on this, revising it, and soon I will be putting it up on www.bounty.org. Postmodernism is the refusal to think--Ron Carrier petro(a)suba.com Deconstruction is the refusal to believe that anyone else can either. Revolution and War are not murder unless you lose. This is a basic tenet of civilization.--Jim Choate on the cpunks list.

1 0

Tell me this,referring to Symantec's claim.
by cracker＠icon.co.za 17 Dec '03

17 Dec '03

Okay granted,i am virtually sure Deeyenda does not exhist,but i asked a simple question. Altavista is a cute idea though ;) Who posted this shit then,someone care to get back to him???? >The internet community has again been plagued by another virus.This message is being spread >throughout the internet,including USENET posting,EMAIL and other inherent activities...The >reason for all the attention is because of the nature of this virus and the potential security risks >it makes.Instead of a destructive trojan virus (most viruses!),this virus,referred to as Deeyenda >Maddick,performs a comprehensive search on your computer,looking for valuable information >such as email and login,passwords,credit cards,personal info,etc. The Deeyenda virus also has >the capability to stay memory resident whil running a host of applications and operating systems, >such as Windows 3.11 and Windows 95.What this means to internet users is that when a login and >PASSWORD are sent to the server,this virus can COPY this information and SEND IT OUT TO AN >UNKNOWN ADDRESS (varies). >The reson for this warning is because the Deeyenda virus is virtually undetectable.Once attacked >your computer will be unsecure.Although it can attack any O/S,this virus is most likely to attack >those users viewing Java enhanced Web Pages (Netscape 2.0 + Microsoft Internet Explorer 3.0 + >which are running on Windows 95) . Researchers at Princeton University have found this on a >number of world wide web pages and fear its spread. > Please pass this on,for we must alert the general public at the security risks >Steven K. Johnson >Computer Center >Carnegie Mellon University >(412) 455-3756 >e-mail : SJohnson14(a)cmu.edu Sounds like a pretty amazing virus to me??? More a crock of shit than anything else,but... Hey maybe it'll run for president as well.... Sorry to inconvenience anybody,ridicule should have a purpose ;) J a m e s "Lead.Follow. Or get out of the way" -------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Tell me this,referring to Symantec's claim.
by cracker＠icon.co.za 17 Dec '03

17 Dec '03

Okay granted,i am virtually sure Deeyenda does not exhist,but i asked a simple question. Altavista is a cute idea though ;) Who posted this shit then,someone care to get back to him???? >The internet community has again been plagued by another virus.This message is being spread >throughout the internet,including USENET posting,EMAIL and other inherent activities...The >reason for all the attention is because of the nature of this virus and the potential security risks >it makes.Instead of a destructive trojan virus (most viruses!),this virus,referred to as Deeyenda >Maddick,performs a comprehensive search on your computer,looking for valuable information >such as email and login,passwords,credit cards,personal info,etc. The Deeyenda virus also has >the capability to stay memory resident whil running a host of applications and operating systems, >such as Windows 3.11 and Windows 95.What this means to internet users is that when a login and >PASSWORD are sent to the server,this virus can COPY this information and SEND IT OUT TO AN >UNKNOWN ADDRESS (varies). >The reson for this warning is because the Deeyenda virus is virtually undetectable.Once attacked >your computer will be unsecure.Although it can attack any O/S,this virus is most likely to attack >those users viewing Java enhanced Web Pages (Netscape 2.0 + Microsoft Internet Explorer 3.0 + >which are running on Windows 95) . Researchers at Princeton University have found this on a >number of world wide web pages and fear its spread. > Please pass this on,for we must alert the general public at the security risks >Steven K. Johnson >Computer Center >Carnegie Mellon University >(412) 455-3756 >e-mail : SJohnson14(a)cmu.edu Sounds like a pretty amazing virus to me??? More a crock of shit than anything else,but... Hey maybe it'll run for president as well.... Sorry to inconvenience anybody,ridicule should have a purpose ;) J a m e s "Lead.Follow. Or get out of the way" -------------------------------------------------------------------------------------------- Type Bits/KeyID Date User ID pub 1024/9E318AA5 1996/09/24 Cracker <cracker(a)icon.co.za> -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3ia mQCNAzJHdKwAAAEEALl3A6auLG0JLdtgEzl6KfPNqbTTSDX4L4To2b7PLqGDVV5r BezC9dD/ITrCK9M64juiQ2p/DNjIihnXlEsJCy2btypStypQgU1fvAei3AnZ1cQ8 NiAnHNS+ImUAJgZjSHEQSevGE53IUovmWQ7YHUz9VpTTCtoJoUKxYuqeMYqlAAUR tBxDcmFja2VyIDxjcmFja2VyQGljb24uY28uemE+iQCVAwUQMkd0rkKxYuqeMYql AQEjagP/cYgGLAkWZJLeRcM4URwBX3J/0R54DadVnsvvoxDkzilv7U02IXZGZGnA CvXsu2sThS7qDBiHFop/OZs3WmlQbQ4BAZ/hiCs5tSU2e7fkk0EKxsGAD1pTbw/J rRU4WePLc++vv+6CBKw5NCSR5kMh8H3X4qtZZ9dYX9zsuzWKdpk= =YGH8 -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Another Nutty Idea about SPAM
by Omegaman 17 Dec '03

17 Dec '03

> Steven Garman wrote: > > Once method of combatting the spammers is to use disinformation. For example > > we use new addresses for their "remove" lists to check on their honesty. > > > > What about attacking the lists themselves with false data? Say you run a site. (snip) Igor Chudov wrote: > Another nutty idea: to create a database of people who do NOT want to > receive unsolicited advertisements, and make it widely available. Of course. But this does not address the issue of "unscrupulous spammers" which is what Steven was commenting upon. > The obvious problem is that some very uncsrupulous spammers would want > to grab this database and use it as a source of email addresses. > > This problem has a solution, however: instead of distributing people's > email addresses, distribute MD5 checksums of their addresses. For > example, an entry for ichudov(a)algebra.com would be > > b51175dae78f25427351d5e3ff43de30 > > There is no way to guess the original text from an MD5 checksum. > > Spammers should be advised to exclude all addresses with MD5 checksums from > that database from the recipient list, and include instructions on how > to get one added to the database into their spams. Okay fine. The spammer is "advised" but if he is unscrupulous in the first place, he'll simply ignore the advice and continue bulk-mailing to every address he can grab. > Database maintainers could even provide a email filter-bot that would > accept recipient lists by email and send back the same lists, but > WITHOUT addresses that wish not to receive spam. This way stupid > low-tech spammers (who make up the majority) will be able to process > their email lists quickly and easily. Indeed, stupid low-tech spammers would benefit from such a service if they wish to honor "do not send" requests. > This database may be maintained centrally. Users may be able to sign up > for inclusion into that database by email or by filling out a Web-based > form. Identity verifications may be done by using cookie protocol. I like the idea and if I had the resources, I would do it personally. Optimistically, many bulk e-mailers would sign on to the plan. (Ironically, one would probably have to solicit bulk e-mailers to sign up). However, many, being unscrupulous, ignorant, etc. will not be involved. The only way I see to get bulk e-mailers to utilize this service is to offer a positive and/or negative incentive for usage of the service. ie. "What do I gain by elminating people from my bulk mail-outs? What can be done if I don't follow this protocol?" Ideas? Comments? me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

3 3

Re: Provably "Secure" Crypto
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Dana W. Albrecht originally wrote: > Rigorous proofs of the non-existence of an algorithm are not new. > Neither are rigorous proofs that any algorithm which can solve a given > problem requires a minimal running time. Or, in an even stronger sense, > For a (non-cryptographic) example of a proof of the first sort --- that > is, that "there exists no algorithm" --- consider the famous "Halting > Problem" for Turing machines. (I believe someone else has also > mentioned this.) There are many proofs such as this one, often related, > though the Halting Problem itself is perhaps the most famous example. > > For an (again, non-cryptographic) example of a proof of the second sort > --- that is, that "any algorithm that solves a given problem requires a > minimal running time" --- consider the proof that the "minimal" number > of key comparisons in the worst case required to sort a random list of > elements for which only an ordering relationship is known is O(nlog(n)). > See Knuth, Volume 3, section 5.3. For a simpler example, a standard > "binary" search which requires O(log(n)) comparisons to find a given > element in the worst case is provably the optimal algorithm for this > task. Dana W. Albrecht (dwa(a)corsair.com) replies to The Deviant <deviant(a)pooh-corner.com> like this: > Which part of this have you failed to understand? Look in section 5.3.1 > of Volume 3 of "The Art of Computer Programming" by Knuth. You will find > there a rigorous proof that the "information theoretic lower bound" of > an algorithm which sorts by comparison of keys is O(nlg(n)). That is a bound on a _reliable_ algorithm. A faster one is to shuffle the elements and present it as sorted. Lightning fast, but only with low probability of correctness. That is what we are up against in a key search attack. The other guy just might guess my 100 bit key first time, millionth time or whatever - early enough anyway. So to get a lower bound you have to show that a lucky guess cannot be distinguished from an unlucky one - and if you do that without a one time pad I take my hat off. -- Peter Allan peter.allan(a)aeat.co.uk

1 0

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

oh mindless aga, >> This betrays your ignorance. I.Q. is scaled according to age. One does >> not "improve." Certainly not in your case. > >I have no ignorance, except for being ignorant of stupid people >who call themselves "punks." If you are ignorant of them, then how do you know that they are "stupid"? >Look asshole; it says "LAW DOCTOR" -- that is what "Juris Doctor" >means, stupid. And I am about to stick the motherfucking Laws >right up your cocksucking ASS! How is this possible? It seems that you are possible of rather contemptible contortions! >"Juris" means Law. So Juris Doctor means "Law Doctor." Clinging to technicalities here, aren't we? >that is irrelevant, and you are off-topic. Oooh! Oooh! Point the finger here, aga, at YOURSELF! >Europe is also irrelevant, and you keep missing the point here. >You have added the cypherpunks list again, and that was forbidden. What a wonderful statement: Europe is irrelevant!!! A truly educated mind here. >look asshole, you really want that list killed, do you not? >I have no bounds, as you will soon learn. When one is clapped in irons and thrown into prison for whatever it is that your acts can be classified under, then I am pretty sure they have _some_ bounds. >> > > Be careful who you threaten. It might get you in trouble. One wonders if you ever pay attention to what you actually write, aga? >WRONG! There is NO crime which covers anything that one does >internationally! And mailbombing is NOT "Unauthorized access," >regardless of where it occurs! Uhm...oops, aga, you're wrong here, there are plenty of crimes that are international crimes. War crimes for example, which o against the Geneva convention. Child abduction crimes, which go against the Hague convention. But I am sure they will give you a slight slap on the wrist, after all, you are only a stupid hillbilly with no idea of the law. >Pitt-1975; Dissertation was in 1983 actions. I practiced for >six years, and then became perfect. I currently do not practice for >any parties other than myself, family, corporation or Institutes, >and I need no license for that. And since I do not carry any >license from any State, there is NOTHING that you can do to stop me. Assassination comes to mind... >The State disciplinary board has no jurisdiction, nor does any >Law. A Criminal Lawyer is a specialist in ripping new assholes >on the witness stand, and that must now also be practiced on the net, >it seems. Remember, you are the one who asked for this, "Sadam." You seem to have this absolute _fascination_ with asses, faggots, cocks, and ripping _new_ assholes (as if you weren't a big enough one already. This is obviously some sort of concious repression: you just can't face the truth, can you, aga? >This is a world-wide internet problem that you are about to get >taken care of. You will be among the first locations to be >eliminated. And just remember that your termination is your own >doing. You had your chance to keep the fucking cypherpunks list >OFF of your e-mail to me, and blew it. Do we run and hide now, mommy? >> I suggest a hobby which entails more physical activity. >> > >I pump iron and run three times a week. And as a Tae Kwon Do >black belt holder, I get lots of physical activity. I am in >better physical shape than any other man that you know. He/she/it pumps iron, does he/she/it? Whilst running? No mean feat for a thing without a brain. Assuming that you are better than anyone else you have probably never met, someone who probably has no desire to meet a thing like yourself, is yet another example of your sheer assonance! >And just understand, as far as the internet is concerned, Europe does >not mean SHIT! Of course not...I am sure the European Internet thinks the same as you. After all, an inanimate object seems to think just as much as you! --The Edge

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Forbes: December 2, 1996 Cyberpower By Peter Huber James Carville once wisecracked that he wanted to be reincarnated as the bond market. What did he mean by that? He meant that modern, electronically connected markets are more powerful than any politician. To put it another way: The modem is redefining democracy. British Telecom timed its announcement perfectly--on the eve of the election. Think of BT's $20 billion merger with MCI as an antidote to bad government. By providing efficient, integrated global data connections, telecommunication companies now offer voters the ultimate shopping experience: shopping for better government. Travel the wires and see what I mean. To a degree that may astound you, your computer and your telephone enable you to choose what you like in the way of Federal Reserve, FDIC, SEC, FDA, OSHA, EEOC, NLRB or other cans in the alphabet soup aisles of modern regulation. The idea of choosing government is not, of course, new. If you don't like California law on the subject, you drive to Reno for marriage, divorce or gambling. To Mexico to buy cut-rate medicines unapproved in the U.S. To Florida to go bankrupt or to die. The urge to take a political hike has been there all along. What has changed is the ease and convenience. In the past you had to vote with your feet. Now you can vote with your modem, too. The Web supplies an instant global storefront. While the U.S. market still dominates the Internet, 36% of servers are now outside this country. Virtual establishments on the Web already offer incorporation in Belize, bank accounts in Switzerland, currency trading in Germany, brokerage accounts in New Zealand. International 800 numbers are proliferating. Money, the most liquid of assets, has become the hardest to regulate. Rich people have always parked their money abroad when they didn't trust the political climate at home. Today millions of ordinary investors can move their wealth between currencies and countries as fast as they can click icons on a screen. For some this is just an opportunity to cheat on their taxes. A Hamburg currency trader promises "tax-free profits." A Swiss on-line banker emphasizes "banking secrecy" and "protecting the privacy of bank clients." Swiss safe deposit boxes, the bank assures you, "cannot be sealed by foreign authorities in case of civil offenses." Other on-line offshore entities brazenly tout "tax-free" advantages for U.S. depositors. But evading tax collectors remains a sideshow in the vast business of international, wired finance. The center of the action involves the completely legal evasion of inept central bankers. More than $1 trillion in foreign exchange changes hands each day around the world. (By comparison, turnover of all stocks on the New York Stock Exchange for an entire year is only around $4 trillion.) One in seven equity trades in today's world involves a foreigner as a counterparty. And even illiquid assets--real estate, for example--are increasingly being securitized and then traded on global markets. As Walter Wriston, former Citicorp chief executive and author of The Twilight of Sovereignty (Charles Scribner's Sons, 1992), says: "Governments have lost control of the international value of their currency." A single integrated world market for tradable financial assets is taking shape. Lowell Bryan and Diana Farrell of McKinsey & Co. describe this evolution in Market Unbound: Unleashing Global Capitalism (John Wiley & Sons, 1996). The upshot? The prudent investor can now select investments based on the central bankers standing behind them, just as he now chooses a stock based on his appraisal of the chief executive officer. Do you think the German central bank is wavering? Try Alan Greenspan. If you think he is on the wrong track, try New Zealand. Global mutual funds have limitless ability to move capital among local, state, national and international portfolios--equity, debt, currencies, futures, the lot. By far the most effective way to vote against new government spending is to buy some other government's bonds. This kind of balloting is in fact conducted continually--by banks, pension funds and mutual funds. These are the new, private treasuries. By dispatching its capital elsewhere, the electorate can almost instantly depress the economy and thus the government's tax revenues. For any government that's seriously in debt, the globalization of financial markets puts a double squeeze on new discretionary spending. If global capitalists lose faith and drive up interest rates, it isn't just new spending that costs more, it's also the refinancing of old debt. The modemization of finance explains the federal government's mass conversion to more balanced budgets. As Bryan and Farrell discuss in their book, the tremendous new mobility of private capital sharply curtails government power over macroeconomic policy. Budget planners and central bankers become little more than fancy bookkeepers. They don't orchestrate economic forces, they react to them. Whether they talk left or right, governments worldwide have little choice but to abandon fiscally suicidal policies, most notably the practice of issuing long-term debt to finance current entitlements. Improvident governments that don't believe this end up like Mexico in 1995, with a collapsing peso and an overnight flight of capital. Even Washington's wisest understand the new reality. "I used to think if there was reincarnation I wanted to come back as the President, the Pope or a .400 baseball hitter," Clinton adviser James Carville quipped two years ago. "But now I want to come back as the bond market. You can intimidate everybody." Including, of course, government regulators. Wires are imposing a strict new discipline on the regulators of private banks, too. At a recent Cato Institute conference on the future of money, University of Georgia economist Lawrence H. White described how new payment technologies have lowered the cost of wiring money from $20 to 2 cents per transaction. This opens up the world of offshore banking to small investors--and it's all perfectly legal, so long as you keep paying your income taxes. Offshore banks pay higher interest on deposits and charge lower rates on loans because they aren't subject to the wide array of bank taxes, mandatory insurance premiums and antiredlining decrees imposed by U.S. regulators. For the first time, small depositors can decide for themselves whether the Federal Deposit Insurance Corp. is really worth the price they pay in less favorable interest rates. Securities regulation can now easily be circumvented in much the same way. With stock exchanges and brokerage accounts moving on-line, you can hold and trade U.S. equities completely outside U.S. jurisdiction. If the Securities & Exchange Commission goes over the edge of the regulatory Laffer Curve--by passing rules that stifle rather than protect--investors will easily be able to move to a Swiss broker, a London exchange or a Canadian commodities trader. The value of regulation, positive or negative, becomes something you shop around for, just as you shop for a trusty broker or low trading fees. Labor will never be as fluid as capital, but does follow it. The 1980s taught us that manufacturing jobs could escape U.S. unions, labor laws, tort lawyers and environmental regulators much more easily than we had realized. The aluminum still comes from an Alcoa mill in the U.S., but some 20% of the Boeing 777 airframe structure is built by Japanese workers at a Kawasaki/Mitsubishi/Fuji consortium. The wings and the cockpit of McDonnell Douglas' MD-95 are being built in South Korea. To be sure, most U.S. jobs, particularly the services that account for 54% of the U.S. economy, are still in nontradable sectors. If you live in Fresno, you can't easily get a haircut from a coiffeur in France. But services do already make up over 20% of global trade, and they represent the fastest-growing component of both trade and foreign direct investment worldwide. American companies outsource data entry to countries in the Caribbean. Manufacturers outsource product design, logistics management, R&D and customer service across national borders, too. U.S. insurance, tax consulting and accounting companies send claims and forms overseas for processing. Software, films, music, finance, advertising, and even health care and education all move as well. Haircuts? Not yet, but there's already serious talk of telemedicine. The Boeing way of choosing labor is now embedded in the structure of some 39,000 large, transnational corporations, which collectively hold over $2.7 trillion of assets outside their home-base countries. New foreign direct investment in the 26 nations in the Organization for Economic Cooperation & Development rose by 53% in 1995, while outflows from these countries increased by 42%. (For cross-border holdings of tradable securities, see chart, p. 146.) "The very phrase `international trade' has begun to sound obsolete," Wriston says in an interview. Again, information and communications technologies are the critical new lubricant. Many services, especially financial and anything involving software, consist of nothing but information and can be moved by wire alone. Moving solid goods still requires cheap transportation, too, but the cost of hauling things around keeps dropping, energy costs notwithstanding. And many of the products being hauled--everything from cameras to cars--keep getting smaller and lighter as they get electronically smarter. Once a manager in Detroit learns how to use the telecosm to outsource to Toledo, Ohio, she can outsource to Toledo, Spain; with cyber power all physical distances are roughly the same. And with this kind of global production system in place, a manufacturing company can move jobs and capital around like pieces on a chessboard, shopping continually for the best-priced labor--and the best labor laws. As Norman Macrae, former deputy editor of the Economist, foresaw some years ago, corporations of the future are not going to be nationally based, and they "aren't going to have long-lasting lines of production in settled places." Their managers will be able to move jobs almost as fast as governments can rewrite employment laws. At the margin, the managers of these transnational companies will adjust their portfolios of labor in much the same way as the manager of the Templeton Growth Fund trades stocks. So where does the globalization of labor markets leave the countless national regulators of employment and work? Whatever they address-- parental leave, handicaps or the minimum wage--laws that deny economic reality cannot be enforced if the jobs can pick up and leave. Much as they hate the fact, government bureaucrats are beginning to accept it. Yes, Washington did recently raise the minimum wage, but the real story there was how little and how late. The long-term global political trend is away from all such dictates, not toward them. When she thinks of herself as "labor" the average American citizen may not like this at all. But as a consumer she's collaborating enthusiastically. She buys Nikes and Nintendos made in Asian factories. She demands profit from her mutual fund and pension plan, not patriotic loss. Before long, she'll shop for life insurance in London and health insurance in Geneva, and the offshore actuaries will discriminate fiercely in favor of the healthy. In the 1980s the chief executive of Chrysler might have decided to buy a few million car engines from Korea. Today millions of individual Americans are gaining the power to shop anywhere they please. No longer can consumers, any more than investors or corporate managers, be economically quarantined. This means that consumer protection regulators face serious competition. An abortion now comes in a pill; there's little to stop you from buying that from an on-line pharmacy in Monaco if you have to. For years the FDA blocked sales of kits that allowed home testing for the AIDS virus. So a South African company peddled a $100 kit on the Internet, with delivery by mail. And the owner boasted openly that he was in business to thwart the regulators overseas. The daughter of a magazine editor I know needed a special asthma drug that the Food & Drug Administration hasn't yet seen fit to approve. Her dad E-mailed a contact in Paris, and the medicine arrived by air several days later. He would not have bought a drug from China or Belize, but he was willing to trust France. The world's drug regulators, in short, compete for his custom. A wide range of routine diagnostic services could easily be offered to U.S. citizens from laboratories in Bermuda. The Web would handle marketing and payment. Federal Express would deliver. What holds for lab tests holds for morals and culture, too. Nevada can dispatch strip shows and blackjack tables to any computer in Utah. If we shut down Nevada, gaming houses farther afield will quickly fill the electronic void. A two-minute Web search turns up the Aruba Palms, off the coast of Venezuela. Download free software and link into the hotel's casino for real-time blackjack, poker and slots, as well as full sports-book action. Or try out any of a dozen on-line gambling alternatives in Argentina, Belize, Antigua or the U.K. Or play the national lottery of Liechtenstein. Use your credit card, or use E-cash if you want to make both gains and losses completely anonymous. When it comes to pure content regulation--pornography the most vivid example--government authorities have lost their grip completely. If you don't like Utah's censors, three clicks of a mouse will put you under the unbuttoned authority of Utrecht. Canada has instructed its citizens not to watch too much U.S. television. But it's laughably easy now for Canadians to buy a small satellite dish and get subscription fees billed to a nominally U.S. address. Technology has rendered completely obsolete the very idea that government authorities can control morality and culture. Politicians may still give speeches about these things, but everyone knows the talk is just reactionary twaddle. All of this should be very reassuring. Most of us won't leave the country, not in person and not by wire. We won't have to. Competition improves the quality of everything else; it will improve the quality of government, too. Most politicians are pragmatists. They'll grasp that they have to deliver a good service at an attractive price--or lose market share to the competition. Bill Clinton understands this. Like James Carville, he learned that the bond market runs the most powerful polls of all. Clinton ran as a budget conservative. The trend is already clear in monetary and fiscal matters, where the competition for good government is the fiercest. Many of the abrupt currency swings of yesteryear--overnight devaluations, for example--just don't happen as much anymore. Wired financial markets are less volatile and much more honest. Nearly all industrial countries have brought their annual inflation rates under 3%. In The Death of Inflation: Surviving & Thriving in the Zero Era (Nicholas Brealey Publishing, 1996), Roger Bootle argues that the globalization of financial and labor markets left them no choice. Within this country, large states like California seem to be learning the same lesson. They have to stay in line on tax rates, investment climate and so forth--or lose jobs, investment and residents to their better-governed neighbors. And while rigorous comparisons are difficult, it does appear that industrialized nations are gradually converging toward quite similar regulatory structures in monetary policy, banking, insurance and securities trading. The overall price that competing governments charge citizens for service--the tax rate--seems to be converging, too. Take away health insurance, which some countries book as "private" rather than "public," and you find that the tax rates in industrialized countries are all quite close--much more so than they were in the 1960s. Governments that don't keep up with the competition can lose market share fast. Years ago Delaware developed a well-designed service called corporate law. Most big U.S. companies are Delaware corporations now. Other states tried to protect their consumers from high interest rates. So Citibank set up operations in South Dakota to issue credit cards nationally. In June the Supreme Court ruled that California residents may not challenge Citibank's late-payment fees as usurious under California law: The fees on Citibank cards are South Dakota's legal responsibility. The usury police in other states can all take a permanent vacation. We, the people, are all shipping tycoons now, with mobile wealth and mobile labor. We can choose Liberia's flag, for its unmeddlesome bureaucracy, or London's insurance, for its trustworthy courts. As managers, workers and consumers, we buy government in much the same way we buy shoes. Not through bribes or political action committees or anything like that--we buy it by paying taxes and complying with the laws. But when shopping in one government's mall gets too expensive or inconvenient, we shop in another's. So the old political carnival, filled as it was with freaks and geeks, is over. The old game of big promises on election day, soon forgotten in the enjoyment of power, is over. Citizens now vote continually, with London, Bonn and Tokyo on the ballot, too.

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

American Banker: Friday, November 22, 1996 MasterCard Raps Visa Security After Theft By JEREMY QUITTNER The theft of a personal computer with several hundred thousand credit card accounts stored in its memory has led MasterCard to suggest the security procedures of rival Visa are inadequate. The computer, stolen from Visa's San Mateo, Calif., data processing center early this month, contained information transmitted from point of sale machines for 314,000 active credit card accounts -- from Visa, MasterCard, American Express, Discover, and Citicorp's Diners Club. Visa has offered to pay $20 per account, potentially $6.3 million, to replace the cards. Although the five brands reacted quickly to the crime, and there has been no loss due to fraud, the incident shows how account information is vulnerable to fraud and theft from many directions. Michael Stenger, special agent, financial crimes division for the U.S. Secret Service, said criminals will go after account information wherever they can find it. "The computer is seen as a facilitator and a storage point," he said. "The main thing is (the thieves) need the information." Account information from the different credit card networks is commonly routed through MasterCard and Visa processing systems from point of sale machines, and sent to the appropriate party. "The question is, why was the information downloaded?" asked MasterCard spokesman Sean Healy. "We don't do that type of downloading." He said MasterCard stores point of sale information on cartridges in high security locations in its St. Louis processing facility, where it would be "virtually impossible to replicate" the Visa theft. However, David Melancon, a Visa International spokesman, contended, "Any card company that processes transactions" downloads account information. Jerome Svigals, a smart-card and security consultant in Redwood City, Calif., said Visa would have downloaded this information only if it was working in the capacity of Vital Processing Services, its merchant processing arm. He added the computer probably contained magnetic stripe information, such as account numbers, expiration dates, and encrypted verification codes. "There is little or no protection against this problem," he said. Visa said it may have been an inside job, although no one has been arrested. The thief or thieves were probably more interested in the computer hardware than the account information, Visa said. "We have had rigorous plant security, but obviously not secure enough," Mr. Melancon added. Visa, which said the vast majority of affected accounts were its own, said it immediately contacted all the parties involved and recommended they get in touch with cardholders. Mr. Healy said the stolen computer contained information on accounts at 500 of MasterCard's member banks. "We are recommending they close the affected accounts and issue new cards," Mr. Healy said. "We are monitoring authorizations very closely and have issued a worldwide security alert." American Express, on the other hand, has chosen to monitor its own accounts without informing cardholders. It would not specify how many of its accounts were involved. "The accounts are being monitored for fraud, but we have not found any," said Gail Wasserman, an American Express spokeswoman. Diners Club and Dean Witter, Discover & Co. said they were taking measures to protect their cardholders. American Banker: Friday, November 22, 1996 Bank Group Issues Guidelines for Protecting Consumer Privacy By Barbara A. Rehm Retail bankers on Thursday unveiled a nine-point plan to safeguard financial information about their customers. The Consumer Bankers Association is providing the privacy blueprint to its members, 900 financial institutions with more than $2.5 trillion in assets. "We are confident that these guidelines will enable our members to continue delivering top-quality service and choice while maintaining the trust of consumers," said Pam Flaherty, Citibank senior vice president and a member of trade group's board. The guidelines, in the works for two years, are designed to help banks maintain customer confidentiality standards even as new technologies speed information processing. For example, under the plan, banks "will limit the use and collection of information about our customers to what is necessary to administer our business, provide superior service, and offer opportunities that we think will be of interest to them." The blueprint also notes that banks will provide data about their customers only to "reputable information reporting agencies." The Consumer Bankers issued the privacy guidelines to show the federal government that the banking industry is policing itself and no new regulations are needed. American Banker: Friday, November 22, 1996 Get On-Line Quickly or Get Left Behind By JENNIFER KINGSON BLOOM and JEFFREY KUTLER Almost 600 people paid a quick visit this week to a future in which most consumers carry smart cards, do most of their banking and shopping on the Internet, and rest assured that their financial institutions have taken all necessary steps to ensure payment security and personal privacy. By now the bankers among the 600 have returned to a reality in which most chief executive officers don't know much about personal computers, pay more attention to commercial loan spreads and credit card profitability than to information technology, and still need convincing to pour a lot of investment capital into creating the aforementioned future. The vision of the possible appeared at American Banker's second annual conference on financial services in cyberspace. After three days of almost boundless enthusiasm for electronic cash and virtual banking, these concepts didn't sound futuristic at all. Stirring up a revival-meeting atmosphere, Mondex USA chairman Dudley Nigg referred to Internet banking as "the Holy Grail." But no longer does he consider it beyond bankers' grasp. Giving the opening speech Monday, the Wells Fargo Bank executive vice president decried the industry's past sin of "giving away the branch channel for free and charging for on-line service ... How ludicrous!" After Wells saw the light and dropped its fees for PC users, on-line customers jumped from 20,000 in early 1995 to 270,000 today -- 110,000 of them via the Internet. Mr. Nigg expects two million Internet customers in five years. It provides an unusual opening, he said, to "satisfy customer needs (while) we lower our costs ... That's the kind of economics that chairmen in our industry love to hear about, and is rare in banking. Rare is the channel where costs can be driven down." Mr. Nigg, speaking the same day MasterCard announced its acquisition of 51% of Mondex International, a smart card program he fervently supports, lived up to his keynote billing with the conference's most quotable quote: "If we don't get aboard this train early, we will miss it." He said technology is advancing so quickly and decisively that bankers no longer have the luxury of waiting for lower prices or more definitive outcomes before making a move. "If we regard this as purely hype, we will forfeit this opportunity to others who are waiting in the wings," Mr. Nigg said. "We have traditionally been slow to step up. In the past, second-movers had an opportunity to meet the train. Today, people are waiting for us to act. If we don't do so, somebody else will step in and take our place." "Don't do nothing, waiting to see if Internet commerce is real," said Verifone Inc. vice president Roger Bertman, picking up the theme two days later when discussing bank-merchant relationships. "It is absolutely clear you will miss an opportunity and risk losing pieces of your merchant portfolios." The Internet and personal financial management software like Intuit Inc.'s Quicken are "wedges driving financial services into the home," said Adam Schoenfeld, vice president of publishing at Jupiter Communications in New York. Though many attempts at electronic financial services were "poorly conceived and executed," he said, banks are serving two million customers by PC, and more than three times that number express interest in the medium, according to a recent Jupiter-Find/SVP study. Veterans of earlier, unsuccessful attempts at revolutionizing banking behavior like to bat around ideas on why the 1990s are different. One obvious reason is the breakneck spread of personal computers into consumers' homes. Huntington Bancshares senior vice president William Randle, a conference co-chairman, cited an October survey that said 19 million U.S. households now use home computers for some aspect of financial management. He also showed a commercial that touted the home banking capabilities of Packard Bell's products. "When manufacturers of computers start advertising banking as an application, times are moving fast," he concluded. There were other ideas as well. Gaurang Desai, a vice president at Montgomery Securities, said vendors and bankers are growing more comfortable with one another and are working together more productively. Henry Lichstein, a vice president and technology strategist at Citibank, said banks are learning how to market on-line services so they are attractive to consumers. Pointing out that Citibank has offered home banking for a decade, he said the program began "in earnest" last year when the bank stopped charging for it. In 1996, Mr. Lichstein said, "the big change was the Internet." And David Frankel, banking business manager at the Prodigy on-line service, recalled that when his company introduced on-line banking in 1988, it fell flat. Prodigy has spent the last eight months reconstructing its service for the Internet. "People are moving to the Internet directly at almost alarming speed," Mr. Frankel said. "We have recognized the future of the Internet and the ultimate demise of proprietary on-line services." Several speakers predicted that the introduction this year of television sets with Web browsers will jump-start home banking for the mass of consumers. In the Jupiter Communications survey, 25% of households with personal computers said they "would prefer to get their electronic financial services through the television," said Mr. Schoenfeld. Mr. Lichstein defined the task at hand -- "the process of anticipating change and aligning oneself to it" -- as "finding the strategic groove." Something is in a strategic groove, he said, when "if we do not step up to the challenge, someone else will." By that definition, Mr. Nigg was describing strategic grooves for the Internet and smart cards, particularly Mondex, which can operate as both a real-world cash substitute and a virtual-world payment transmission device. Mr. Lichstein put smart cards and consumer electronic banking in that very context. "The strategic groove in home banking," he said, "is in full swing." Critical or dissenting voices were pretty much drowned out. Charlotte Wingfield, a KPMG Peat Marwick partner, said she got a respectful reception to what she called the only presentation covering the biggest mode of banking distribution -- the branch. Citing a consumer survey KPMG commissioned from Yankelovich Partners, Ms. Wingfield concluded that "the branch's demise is greatly exaggerated." Her data indicated that even frequent PC users put "banking in person" ahead of software-based services on their list of preferences. Agreeing with Ms. Wingfield, a member of the audience who works for a technology company grumbled about the pro-virtual majority. "They make it sound like everybody has to be on the Internet by next Tuesday, or they're toast. That just isn't the case." Even a bank executive from the Northeast who is well versed in the Internet and intranets said, "I think it's all hype." In one session that devolved into a small-scale cat fight among software vendors, a Microsoft Corp. executive was trying to take the high road: Other purveyors of personal financial management software divulged the number of users they had doing on-line banking, but he wasn't going to play the numbers game. A representative of Intuit said 400,000 people were banking on-line through Quicken and BankNow. The chief executive of Meca Software said he had 200,000 active users. When Microsoft's turn came, Richard Bray, a product manager, kept insisting that 10% of Microsoft Money users were doing on-line banking. When pressed for specific numbers, he would go no further. Unluckily for Mr. Bray, he was also scheduled to speak again later in the day about the Microsoft Network for the Internet. It was in that speech that he casually said: "Two and a half million people use Microsoft Money." And 10% of 2.5 million would be ... William N. Melton, founder and president of Cybercash Inc., was torn within himself. He took a break from the American Banker conference to fly to the giant Comdex computer trade show in Las Vegas and returned with what he termed a "manic-depressive problem." When he first arrived in Scottsdale, he became "manic" when he learned that the bankers there had apparently gotten religion on the subject of the Internet. "We've been trying to talk to bankers for a long time, and said, 'The Internet is really here,"' he said. "I didn't think they were really getting it." After jetting off to Comdex, though, he became "depressed" that while the 250,000 people attending the show were "all doing nothing but thinking about the Internet," they didn't seem to be moving quickly enough toward on-line commerce. "We've been working on SET (the Secure Electronic Transactions protocol) for one to one and a half years, and hopefully within six months we'll have interoperability tests," Mr. Melton said with some disdain. After returning to Arizona, Mr. Melton swung back to manic mode. Hearing details about MasterCard's buy into Mondex persuaded him that "maybe it's going to happen." Mr. Melton was emphatic about what was needed to help make "it" happen: he called on banks to "unilaterally issue digital certificates" to get customers accustomed to on-line commerce and comfortable with evolving privacy and security measures. Mr. Melton and Mr. Bertman, general manager of the Internet commerce division at Verifone (another company Mr. Melton founded), acknowledged some other impediments or potential obstacles. "By 2000, the privacy issue will have really hit," Mr. Melton predicted. He said the negative consequences of such an explosive political issue could be mitigated by banks' convincing the public they have addressed it. But he warned of "a huge public debate." Mr. Bertman said the industry must help consumers and merchants make sense of a dizzying array of payment methods and options. Verifone and Cybercash, among others, have proposed "virtual wallets" as a solution. "Technologists tend to oversimplify the payments world," he said, "but there are some very complex issues" that financial institutions are best placed to resolve. Mr. Bertman added that while most discussions have focused on the on- line consumer, bank-merchant relationships are at least as critical and have been "underestimated and under-understood." "There is a question of how many banks do you need on the Internet," Mr. Melton said. "This is not a polite question, but it's going to become very competitive - more so than in the physical world where you are protected by the walls of geography." Mr. Melton was ready to declare victory on the security issue, saying, "It's essentially done." Given the availability of data encryption techniques and specifications like SET, which is being developed by MasterCard and Visa, he said: "Tell your customers, 'Don't worry. We'll take care of it'." Mr. Bertman said the SET development process will take well into next year, but the card industry should move ahead with Internet payments." Sholom Rosen, a vice president at Citibank who has invented a computer- to-computer electronic money system, raised a red flag. He said electronic currencies like those being promoted for the Internet -- Citibank's is not among them -- raise security issues different from those in conventional commerce, and they are not fully addressed by "strong encryption and protocols." For example, Mr. Rosen said, counterfeit losses are conventionally borne by the party who is discovered passing fake currency. In on-line commerce, the issuer of money -- likely a bank -- is the victim, with consequences for solvency and systemic risk that Mr. Rosen said haven't been thought through. Mr. Rosen stated in an interview that Mr. Melton and others are in an "entrepreneurial mode" and understandably eager to embrace exciting new things. "Comdex is fine, but banks are in the business of having to manage risks," Mr. Rosen said. ABA Banking Journal: November, 1996 Are You "Toast"? By William W. Streeter Has anyone walked up to you recently and said, "You're toast"? As you might surmise, the question has nothing to do with sun or food. It has to do with history, as in, "You're history, pal." And that's how author Don Tapscott meant it when he used the expression in his presentation at the ABA Annual Convention last month. He was speaking about the digital revolution, and with the single word "toast," he likely captured the collective angst of most people in the room. As author of the best-selling book, The Digital Economy, Tapscott is a prophet of the new order resulting from the digitizing of information. Like many of his ilk, his presentation was both mesmerizing and unsettling. He spoke of the likely disappearance of entire industries under the onslaught of the Internet, specifically referencing travel agents and food wholesalers. He didn't foretell that fate for banking, but he did speak of the "disintermediation" of the middleman. "If you're in the middleman business, start looking for a job," he said. It shouldn't take long to realize that banking falls under that heading. Consider that traditional banking is deposit intermediation, while the more recent additions to the business have largely been brokerage. Sounds like a "middleman" business to us. Tapscott urged bankers to "reintermediate." We haven't a clue what that means, but he did cite examples of several banks that have embraced the Internet -- Security First Network Bank being one (look for an update on it next month); Wells Fargo and The Bank of Montreal being two others. There's no denying that certain business have been displaced by electronics. The advent of desktop publishing software, for example, radically altered the "pre-press" and typesetting business that thrived pretty much since Gutenberg. Typesetting in particular was wiped out by computers in the space of about ten years. The function of putting words into type didn't disappear, it was simply transferred to publications' staffs, at a considerable savings. Those publications themselves face a challenge with the emergence of the Internet as a radically different means of disseminating information. Is banking similarly challenged? The answer without a doubt is "yes." Will the industry disappear like the typesetters? There are two considerations in answering that question. First, the typesetting business disappeared because electronics gave publishers greater flexibility at less cost. The same case is made by proponents of banking via the Internet, but it's not clear yet whether a majority of people and businesses are ready to do banking that way. Second, "banking" and "industry" are labels. The functions performed under those labels will of course continue as long as there is money, or more broadly, exchange of value. If by being "digitized" a product or service or process becomes more convenient, more flexible, or less expensive, the marketplace will embrace it. And it will probably do so pretty quickly. None of this says that there won't be a need for people to meet with people. Maybe many "face-to-face" meetings will occur by high-quality video connection. But all of them won't. There will still be a need to be reassured about something in person; to shake hands on a deal; or to look someone in the eye -- a live eye. As a proxy for this, consider that e-mail hasn't eliminated the need to speak by phone, any more than telephones eliminated the need to write or to see someone in person. Changes in fundamental technology have always caused business casualties -- as with the proverbial buggy whip example. Part of top management's job is to stay abreast of changing technology, and to hire and train people who can communicate in, and deal with, whatever medium is appropriate. The difference now is that the change to a digital age will bring more far-reaching changes than anything seen recently, and is occurring at dizzying speed. For sure, money isn't likely to go away soon, and neither, therefore, is financial services. That should ease some of the angst you may feel under the relentless barrage of "The Digital Age." But don't get comfortable either, or you will be toast. Retail Delivery Systems News: November 22, 1996 Mondex Deal Changes MasterCard Strategy Expect some turmoil in the smart card market as MasterCard International, of New York, readjusts its strategy in the wake of buying a majority interest in Mondex, of London, a bank partnership formed to pilot smart cards in England. The long-time rumored acquisition represents one of the largest investments of a U.S. company in smart card technology. Estimates are that MasterCard paid between $100 million and $150 million for the majority interest. MasterCard will adopt Mondex's technology as its strategic chip platform, the companies say. This raises questions for the future of pilots, such as the one planned in New York City's West Side by Citibank and Chase Manhattan and for the validity of vendor hardware and software created to work with MasterCash, analysts say. The New York pilot, which is meant to prove interoperability of the MasterCard and Visa systems, already has been delayed until the second quarter of 1997. Additionally, MasterCard has lost several of its key officers in the MasterCash division, raising questions about who is leading the venture, RDSN has learned. "A number of companies would like to see a crystallization of MasterCard's strategy with smart cards," says Dave Lott, an analyst with Dove Associates in Atlanta. "The deal raises a lot of questions in terms of what are they going to do with the product (MasterCash) that they've developed up to this time." Washington Post: Sunday, November 24, 1996 The Uncertain Value of 'Smart Cards' By Jane Bryant Quinn The next piece of plastic the banks think you ought to keep in your wallet is a "smart card." These cards come in several varieties and most aren't ready for mass distribution. But pilot projects are forging ahead in Atlanta and New York City early next year, and in Canada and several countries abroad. There's no obvious consumer need for smart cards today. But the bankers believe that you're going to love them anyway. You may even be mailed one and urged to try it. Smart card promoters make the assumption that you hate to carry cash. You hate fishing for bills and coins to buy a newspaper or a soda. You'd put down plastic, instead. This plastic card has money on it, embedded in a computer chip. A $ 20 card, for example, will give you $ 20 in spending power. If you buy a 75-cent newspaper, the seller will put your card in a special terminal and drain off 75 cents. No identification or signature is required. You now have a card with $ 19.25 left on it. After spending $ 1 on a soda, the value of your card goes down to $ 18.25. If you forget the amount, you can check it with a little portable card reader. Some readers also might list the last five things you bought. Don't confuse a smart card with a debit card. When you pay by debit card, money is moved automatically from your bank account into the merchant's bank account. With a smart card, however, you first move money from your bank account onto the card's computer chip. When you buy something, the money moves from your card to the merchant's terminal and then, electronically, to the merchant's bank. If every merchant, street vendor, taxi driver and bus accepted smart cards, you wouldn't have to carry cash. To some, that would be a huge convenience; to others, it's a shrug. But as long as some merchants took smart cards and others didn't, you'd have to carry both. Smart cards come in three varieties, some of them more flexible than others: * A prepaid, disposable single-purpose card. Telephone cards are a good example. You pay $ 10 or $ 20 for a card, dial an 800-number, give the number of your card and then make your telephone call. Minute by minute, the cost of the call is deducted from the value of the card. When you've spent all the money on the card, you throw it out. * A prepaid, disposable bank card. You buy the card at a bank and can use it at any store that has a terminal. * A reloadable card. When your money runs out, you can take it to a bank, an automated teller machine or a special kiosk and load it up again. Visa, MasterCard, Citibank and the Chase Manhattan bank will jointly test a reloadable card in a section of New York City next year. A reloadable card also could serve as your credit card, debit card or ATM card. What's in it for the banks? Eventually (although not at first), the banks probably would charge you for the card. There might be a fee when you used an ATM to load it up. The merchant also would pay a fee, in return for getting what is presumably a more secure transaction. What's in it for consumers? A very little bit of convenience. Putting down a card is a tad quicker than fishing out cash. You always have the equivalent of exact change. You wouldn't have to count your change, but you'd have to use the card reader to be sure the merchant's terminal deducted the right amount. You may or may not pay more for the card than it costs to get cash from an ATM. For a while, the smart cards probably won't have any more than $ 100 on them and the limit might be lower. So they're strictly for walking-around money. You'd still need your credit card, debit card or checkbook for more serious shopping. If the card malfunctions -- say, it registers $ 14 when you're sure you were carrying $ 36 -- a bank can check the balance on the computer chip, says Ron Braco, a senior vice president at Chase Manhattan. But if you lose the card, it's just like losing cash. You're out the money. Promoters of smart cards promise a lot of national and international uses that aren't yet anywhere in sight. I'll probably wait for them. Banks have a sales job to do on people like me who don't find it a nuisance to carry cash. Forbes: December 2, 1996 Banks are pushing new ATM cards that doubleas a Visa or a MasterCard. Avoid 'em. Carte Blanche For Crooks By Alexandra Alger Chances are that yet another chunk of unsolicited plastic has popped up in your mailbox. It is not just another credit card. It's a combination new ATM card and charge card. You can use it to withdraw cash from automated teller machines, as you do with your current ATM card. Or you can use it to charge purchases, without having to use your PIN (personal identification number). "It's as convenient as a credit card, but it's not credit! The amount of your purchase is immediately deducted from the balance in your checking account," says the brochure sent out by one major bank. And therein lies the danger--it's a debit card. We don't like it for three reasons: * It could give a thief carte blanche to your checking account. In case of fraudulent use of your debit card, you are the one who is instantly out-of-pocket, not the bank. You may have to fight the bank to recover your money, and you could lose it completely if you don't report the loss right away. Meanwhile, your bank balance and credit line could be depleted, and your checks could be bouncing all over town. * You lose the credit float, of 30 days or so, that you get with a zero-balance credit card. * You lose the option of withholding payments--important leverage in case of disputed charges. Banks are flooding the mails with these new cards. Visa has launched a multimillion-dollar national TV campaign to promote its debit cards, starring football superstar Deion Sanders. Some 4,000 U.S. banks, S&Ls and credit unions are issuing MasterCard- and Visa-affiliated debit cards--double the number of a year ago. Most of the nation's biggest banks have already joined the party, including California's Bank of America and New York's Chase Manhattan Corp. (to its new Chemical Bank customers). Citibank is planning its blitz next year. For banks, what's not to like? Merchants pay card issuers an "interchange" fee--typically 1% to 2% of the transaction value. Some banks even charge customers $1 to $1.50 a month just to have the card. Debit cards also help wean bank customers from costly check-writing. It costs banks $1.10 or so to process every check, but only 27 cents to handle a debit card transaction, says Edward Neumann, director of Dove Associates, a bank consulting firm in Washington, D.C. Bankers insist that the cards are good for customers, too. "The key is convenience--that's what we're selling," says John Russell, a spokesman for Banc One in Columbus, Ohio, the first bank to offer a debit card and now the largest issuer of them (over 4 million). But we think this convenience comes at too high a risk. Some debit- card crooks are subtle. They'll use swiped debit cards occasionally, charging up relatively small amounts. As long as the account holders overlook the charges on their bank statements, the party continues. The thief has a kind of annuity. Roy Funderburk Jr. learned about this the hard way. The 53-year-old mail carrier from Alexandria, Va. was going over his bank statement when he noticed two debit-card charges in one day at an Exxon station he occasionally used in Washington, D.C. That sent him back to statements for previous months. What he found were $1,000 in bogus gas station charges made over a nine-month period. No charge was more than $20. He hadn't lost his Visa debit card, so was baffled about the misuse. Funderburk's branch manager at American Security Bank (now NationsBank) told him not to worry, he would be reimbursed for his losses. But a month later Funderburk got word that he'd only be recompensed for the fraudulent charges made within the previous 60 days-- $247. He was out $761. Funderburk was furious. He went to the Washington Police Department, the Secret Service--even the FBI. The latter two told him they only looked into cases involving at least $5,000. Finally, on the advice of a lawyer, he took the bank to small-claims court. He struck out there, too; the judge shook his head and told Funderburk the bank didn't owe him anything under federal bank rules, and there was nothing he could do. The story has a happy ending. Out of the blue, an American Security lawyer called Funderburk about settling. Funderburk said he just wanted his money back, without interest. Fine, the attorney said. Within hours the money was back in his checking account. But what an ordeal! How had the thief pulled off the thefts? All he needed to get started was the number on Funderburk's debit card, perhaps from a discarded receipt. A phony card could be made, using that number. Still, Funderburk was lucky. Banks will normally assume liability for fraudulent use only if you notify them within two days after you miss your card. In that case your loss is limited to $50--often, you won't be charged at all. But wait any longer, and you could be liable for as much as $500 of your own checking account losses. If you fail to report the fraud within 60 days, the bank doesn't have to give you a cent. Your chances of getting hit are uncomfortably high. Last year Visa and MasterCard issuers shouldered $19 million in fraud-related losses on their debit cards, says the Nilson Report, an industry newsletter in Oxnard, Calif. PIN-related ATM fraud accounts for $100 million to $200 million in annual losses. That is small potatoes compared with the estimated $3 billion in annual credit-card fraud losses (FORBES, Aug. 26). But, says John Wisniewski, a postal inspector in Pittsburgh:"The bad guys are just starting to figure out how to misuse them." One of the more ingenious ATM scams involved a bogus telephone. At an ATM in Miami, Fla. crooks put plastic sleeves into the card slots. When customers saw their cards were swallowed by the machine, they picked up the telephone provided to dial the posted customer service number. But the phone was provided by the thieves, and the posted number put customers in touch with a thief, not a bank employee. The thief then asked customers for their PIN as identification and promised that replacement cards would be mailed out in a matter of days. The crooks then plucked out the stuck ATM cards with tweezers and were off to the races. Our advice is to avoid the ATM-debit card. When your ATM card expires, request a simple replacement instead of the new combo card you'll be mailed. In our view, the risks of the combo far outweigh the potential rewards.

1 0

Re: Provably "Secure" Crypto (was: IPG Algorithm Broken!)
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 7:39 PM 11/25/1996, The Deviant wrote: >> Rigorous proofs of the non-existence of an algorithm are not new. >> Neither are rigorous proofs that any algorithm which can solve a given >> problem requires a minimal running time. Or, in an even stronger sense, >Hrmmm... I seem to see a problem (namely Moore's first law) in assigning >anything a "minimal running time". Perhaps "minimal instruction count" >would be more suited to your example. Because if you're talking about >time, it essentially boils down to "the longer something takes the less >time it takes". "Introduction to Algorithms" by Cormen, Leiserson, and Rivest is a good introduction to Big O notation. The problem you raise is the motivation behind this notation. diGriz

1 0

Re: Provably "Secure" Crypto
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 4:18 AM 11/26/1996, Peter M Allan wrote: >> Which part of this have you failed to understand? Look in section 5.3.1 >> of Volume 3 of "The Art of Computer Programming" by Knuth. You will find >> there a rigorous proof that the "information theoretic lower bound" of >> an algorithm which sorts by comparison of keys is O(nlg(n)). >That is a bound on a _reliable_ algorithm. A faster one is to shuffle >the elements and present it as sorted. Lightning fast, but only with >low probability of correctness. That is what we are up against in a key >search attack. The other guy just might guess my 100 bit key first time, >millionth time or whatever - early enough anyway. >So to get a lower bound you have to show that a lucky guess cannot be >distinguished from an unlucky one - and if you do that without a one >time pad I take my hat off. If the chance of a successful guess is absurdly low, the algorithm can be considered to be secure. It is quite unlikely that you will guess a random 128-bit key. Hence, you could have a secure algorithm in which a successful guess can be distinguished from an unsuccessful one. diGriz

2 1

Provably "Secure" Crypto (was: IPG Algorithm Broken!)
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 12:28 PM 11/25/1996, Dana W. Albrecht wrote: >For an (again, non-cryptographic) example of a proof of the second sort >--- that is, that "any algorithm that solves a given problem requires a >minimal running time" --- consider the proof that the "minimal" number >of key comparisons in the worst case required to sort a random list of >elements for which only an ordering relationship is known is O(nlog(n)). >See Knuth, Volume 3, section 5.3. For a simpler example, a standard >"binary" search which requires O(log(n)) comparisons to find a given >element in the worst case is provably the optimal algorithm for this >task. What is the longest running provably optimal algorithm? Would it be possible to construct a crypto system from it? A relatively weak crypto system which is provably no weaker than it appeared would have its uses. >Comments, anyone? Congratulations on your excellent post. diGriz

1 0

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

Known-plaintext: Unbreakable, since the pad is never reused Chosen-plaintext: Unbreakable, ditto Adaptive-chosen-plaintext: Unbreakable, ditto Correct but for a different reason. Re-using the pad does render the security useless but the other reason is if we know part of the pad AND the ciphertext (and hence the plaintext) or part of the plaintext and the ciphertext and therefore the pad, We cannot solve the rest of the ciphertext as the pad is true random and the next bits are independent of all the previous ones so we cannot predict from what we have. A better definition of unbreakable, IMHO, is that there is no way to determine the plaintext given unlimited ciphertext and computational resources. Sure, this isn`t a complete definition but at least it definites perfect security in an analytic sense. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

5 5

re: sci fi
by Ken Kirksey 17 Dec '03

17 Dec '03

>(Where would this world be without Mark Twain (a nym for >Samuel Clemmens), Maxwell Grant (the nym for Walter B. Gibson and others >for the Shadow pulps), and the thousands of other nyms that appear in the >publishing field?) Heinlein used a few nyms. His best stories were published under the names Robert Heinlein and Anson Macdonald. The Heinlein/Macdonald split came about because John W. Campbell didn't want it to look like _Astounding_ was being dominated by one other, though the quailty of the stories was about the same. (All but a couple of dthe Future History stories were published under one of these names, but I don't remember which). Heinlein used other nyms for stories of lesser quailty, or stories he sold to other markets in genres other than sf. He created one nym to sell off stories that he described as "stinkeroos", and went so far as to get a separate PO Box in the name of this nym so that it couldn't be associated with Robert Heinlein. Ken

1 0

Re: IPG Algorith Broken!
by paul＠fatmans.demon.co.uk 17 Dec '03

17 Dec '03

> > Ahh... an OTP isn't unbreakable. Its just so encredibly breakable that > > you never know which break was the correct one ;) > > Note that Schneier says "perfect", not "unbreakable". yes, Perfect is a better term. Strictly speaking it is because there is no finite unicity distance (the amount of ciphertext with which the cipher can theoretically be broken). So, stricly speaking, for a given message C and a prospective pad, P, out of a set of N pads which may or may not be correct: P(P|C) = N^-1 The length of C and the amount of ciphertexts given have no effect in determining the key, nor is there any prospect of a know plaintext attack as the pad is true random and the next bits are totally independent of any others before them. Of course the reason it is perfect is because there are many different pads which give valid decryptions and there is no way of knowing which one is correct. IPG`s algorithm is definitely NOT an OTP and Don Wood is a snakeoil merchant. Datacomms Technologies web authoring and data security Paul Bradley, Paul(a)fatmans.demon.co.uk Paul(a)crypto.uk.eu.org, Paul(a)cryptography.uk.eu.org Http://www.cryptography.home.ml.org/ Email for PGP public key, ID: 5BBFAEB1 "Don`t forget to mount a scratch monkey"

3 4

Re: market for hardware RNG?
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

> But on thinking about this a little more, I began to wonder if anybody > really wants this. Pessimistically, it occurs to me that: > > 1. Many if not most people don't even understand why a hardware RNG is > desirable. While your potential market is small, it is dedicated. Developers of crypto products are always looking for good random sources. People that really NEED more reliable sources of random bits are willing to pay for them. I dont think your market will be end users. But a little market research should turn up a healthy margin for you. > 2. Users of programs like PGP today already get at least a fairly decent > RNG already. Would they want better? (I'm not suggesting a total > replacement; I assume that the output of any hardware RNG would be hashed > with more "traditional" PC sources, like disk timings, keyboard timings, > etc, which should deter attempts to attack just the hardware part.) Why would you hash good RNG output? I understand your desire to deter hardware only attacks. I just think it might be an overreaction. Of course mine could be an under-reaction 8-) > > 3. Even hardware RNG's aren't "perfect": they could be subverted, > replaced, or perhaps influenced. Would someone who was sufficiently > sophisticated as to recognize the need for it actually accept a real, > functioning device? It would have to go through rigorous testing in the crypto community. RNGs v. PRNGs goes through a yearly debate here on cpunks. There have been some good discussions on the use of white noise and other potential hardware sources. Im not sure if hks is back up or not, but you might look there. If an independant entity could certify the product with a good reputation for dedication to the community, you would get much milage. PGP, Inc. might be interested for instance. I mean I have used PGP for years but have not had the time to go through the code, etc. I trust it because Phil's reputation precedes him. > On the other hand... if this kind of pessimism had infected Phil Zimmermann > before he wrote PGP 1.0, he might have deleted the first 50 lines of code, > erased the file, and said, "fuck it!" Go for it Jim. I would be happy to support you in any way I could. Let me know. It sounds like a good idea. > > Jim Bell > jimbell(a)pacifier.com Matt _________________________________________________________________________ Matthew J. Miszewski | <mjmiski(a)execpc.com> Practice Crypto Civil Disobedience | Export your favorite Cryptosystem ------------------------------------------------------------------------- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Bounty Server, Revisited.
by Ian Grigg 17 Dec '03

17 Dec '03

Hi, Snow, > I have started drafting a proposal statement for the Bounty server. Wow, you've gotta move fast in this game :)) > Bounty Server, The proposal: > Version 0.1 > > Abstract: [chop where agreed or not disagreed] > Background: > It is the "Copylefted" software that interests me at this point. OK, although for my model, I am assuming that all forms are covered. > The proposal: > > What I am going to attempt to do is to set up a "Bounty Server" where > someone can iniate a "bounty" on a peice of technology. The initator > will write up a set of specifications for the technology, and an initial > award to be paid to the developer. They then post it on the server and > send their initial "bid" to the organization. Separate this out, for clarity of model. The initiator (I used Proposer, and called her Alice coz Alice always initiates) proposes the specification, or task. There is no need for Alice to submit an initial bid, although they have that option, as a buyer. BTW, bid to do what? Using market terminology, I have assumed thay bid is to buy, that is provide cash. Offer is to sell, that is provide software. Ah, yes, bid is add to bounty. > This is the "bounty". Other people can add to this bounty, allowing the > totals to add until someone claims that bounty by providing proof of > development to the initiator of the bounty. In software terms they would > upload the software to the server and notify the originator of the bounty, > and the server operators. Other technology will be figured out as it > becomes necessary. This is where I have put most of my efforts, because I need to design the microstructure that is built into our market. > Originally I was going to put the stipulation in that the software written > must be Copylefted. I decided that that wasn't really necessary, but > rather simply desired. To aid in that desire, I am going to build in > an initative to releaseing the software "copylefted". Absolutely - let the market decide. Some of us, for example, do not like copyleft. > To get more specific: [chop] > The first developer to upload a _working_ package to the server will > be awarded the total bounty, ... This worries me. If I, as a junior programmer, am looking to enter the market, I will have the daunting task of beating everyone else. Real life doesn't work that way - there are ways in which I can pick up some newbie tasks for low money, so as to build up experience and/or reputation. I guess the notion of bounty is just that - first one takes all. However, I think that the solution might be a bit limited in the long run. Interesting in that my proposal leads to task distribution by awarding contracts, your proposal leads to task incentives by rewarding speed. > "First" will be soley determined by the time stamp of the server. As soon > as the package is uploaded, the initiator and the server adminstrator > will be notifed, and the bounty marked "claimed". If the package is > accepted by the initiator, the bounty will be marked "closed", the > package moved to an FTP site for distribution (if Copylefted) or > moved offline if not (archived copies will be kept for legal reasons-- > more on that later). At that point a check for the developer will > be cut (or ecash mailed if that works out). OK, my proposals specifically assume no need for a "decision" by Alice. That's not to say either is right, it's just that I prefer to design something that eliminates the individual decision rather than cope with the complexities. I believe it will result, in the end, in a more efficient market. > The Server Adminstrator will also do an cursory check to make sure that > there are no obvious copyright violations. > > In the event that there is a conflict between the initiator and the > developer, the claim will go into adjudication. The server adminstrators > decesion is final, and he will make every effort to settle the claim > fairly. Adjudication will incur an additional fee (see the fees section). Same as above, no adjudication in my system. Although, it is possible to add underwriters, by simply making the task offerers (Bob and Carol) into bond writers who front for programmers. > Status: > > At this point in time I am (obviously) still in the process of developing > the procedures. I have registered a Domain Name (bounty.org) and I have > a couple promises off assistance in certain areas. As well, I have > a server to start off with. Wow, *gotta* move fast. As I say, our stuff is based on a lot of pre-existing software, so we make a lot of assumptions. Given our different approaches we may end up with competing systems rather than one, but that's fine, indeed highly valuable as an experimental approach. What's financing you in this? Or should I say, monetarily enthusing? I have started writing (last night :)) this all up as a paper for presentation to FC97. If you want, we could collaborate, or I will just document your efforts, and concentrate on presenting mine. My efforts are now at http://www.systemics.com/docs/papers/task_market.html TTFN iang.

1 0

Re: [CRYPTO] Bank Cards, Interac, Bank Machines, etc
by Scottauge＠aol.com 17 Dec '03

17 Dec '03

In a message dated 96-11-25 22:17:41 EST, you write: > I also heard that the magnetic stripe on the back contains your card > number (the shiny metallized numbers on the front) encrypted using DES > using your PIN as the key. Way out to lunch? Too close for comfort? This seems to be pretty unlikely, cuz I changed my PIN and was still able to use the same card. This means: 1) They can write to a card (pretty unlikely - but not ruling it out - jus don't know) 2) There are more PINs to a card than one (pretty unlikely cuz I chose my number) What I suspect is: Obtain card number Obtain PIN Send both to computer controlling transactions This computer inputs both to an algorithm that says Yea or Nay to continuing (like the numbers point to a valid check/credit/savings account or GL account)... Perform transaction (data likely encrypted the same way back and forth for defeating listening devices).... There may be a hash to the account, the result is not an account number, or some huge look-up database is in play matching PINs to card numbers to accounts.

1 0

Re: Bounty Server, Revisited.
by Omegaman 17 Dec '03

17 Dec '03

> The objective is to actually bring this system online. "cypherpunks write code." good. > Background: > > There is a lot of software floating around. It basically falls into > 5 catagories: Commercial, Shareware, Freeware, Gnu (and other > "Copyleft" schemes) and Public Domain. > <Need to fill this in, but at this point we all know what the 5 types > are> > > It is the "Copylefted" software that interests me at this point. There > is quite a bit of high quality "Gnu" software, and at least one > operating system based on the GNU mentality (linux) however there > is a dearth of _enduser_ tools such as mail and news readers for > the more popular end user operating systems, word processors and > graphics editing software, easy to use Graphic Design Software (TeX > is NOT easy to use) and easy to use Cryptographic software. many would pay good money for Linux native versions of programs like Wordperfect, Corelpaint & draw, Pagemaker , etc. > 4) Desired "quality" level: Proof of Concept, Alpha, Beta, Release etc. Needs flesh. What defines "alpha" or "beta" for purposes of bounty or is that up to the person initiating the bounty? > 6) Where the initiators money is to go if the bounty is not claimed: > I will provide a short (8 or 10) list of charities that the money > will go to if the bounty is not met. This is to keep the initiator > honest, as well as the server. Each contributor will also get this > choice. Do you have the charities in mind? They should be listed in the abstract, I think. Who will be publicize the initial bounty offer -- the server or bounty initiator? Information about a specific software project will need to be disseminated beyond bounty.org. More details on conflict resolution are needed in a final draft. The process and priorites the server administator will use to make his judgements should be abastractly discussed and possibly 1 or 2 specific hypotheticals detailed. me -------------------------------------------------------------- Omegaman <mailto:omega@bigeasy.com> PGP Key fingerprint = 6D 31 C3 00 77 8C D1 C2 59 0A 01 E3 AF 81 94 63 Send a message with the text "get key" in the "Subject:" field to get a copy of my public key. --------------------------------------------------------------

2 1

Dorthy Denning is a boot-licking fasicist!!!
by William H. Geiger III 17 Dec '03

17 Dec '03

Hi, I don't know if anyone watched the House Subcomitty on Computers & Technology today on C-Span. Phil Zimmerman, Dorthy Denning, William Reinsch & others were disscussing computer security. Dorthy Denning gave the most pro-government speech I have ever heard. Is this clueless bitch on the government payroll?!! William Reinsch is a lying bastard. Fucking politions!! Fucking goverment!! They all deserve a long rope!! Phil Zimmerman was quite good at attacking the government policies. <sigh> We are truly a country of fools to have put these jackbooted facisit bastards back into office. -- ----------------------------------------------------------- "William H. Geiger III" <whgiii(a)amaranth.com> -----------------------------------------------------------

5 5

Re: SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE
by Douglas Barnes 17 Dec '03

17 Dec '03

>> SAFEPASSAGE BRINGS STRONG CRYPTO TO WEB BROWSERS WORLDWIDE > >BTW, this doesn't come with source code. > No, it does not come with source code. Site licenses and OEM bundling packages will come with a source code option. Partners who work with us in internationalizing the product may also receive source code. However, it did not seem to be useful or appropriate for a consumer-level product like this. We are trying to find a happy medium between making sure that the security is well-reviewed, and doing things that make business sense and map onto standard industry practice for selling software products. Note that SafePassage uses SSLeay for its encryption and SSL protocol layer; SSLeay has publicly available source code, and has been extensively reviewed. Douglas Barnes C2Net

4 3

No Subject
by nobody＠replay.com 17 Dec '03

17 Dec '03

oh mindless aga, >> This betrays your ignorance. I.Q. is scaled according to age. One does >> not "improve." Certainly not in your case. > >I have no ignorance, except for being ignorant of stupid people >who call themselves "punks." If you are ignorant of them, then how do you know that they are "stupid"? >Look asshole; it says "LAW DOCTOR" -- that is what "Juris Doctor" >means, stupid. And I am about to stick the motherfucking Laws >right up your cocksucking ASS! How is this possible? It seems that you are possible of rather contemptible contortions! >"Juris" means Law. So Juris Doctor means "Law Doctor." Clinging to technicalities here, aren't we? >that is irrelevant, and you are off-topic. Oooh! Oooh! Point the finger here, aga, at YOURSELF! >Europe is also irrelevant, and you keep missing the point here. >You have added the cypherpunks list again, and that was forbidden. What a wonderful statement: Europe is irrelevant!!! A truly educated mind here. >look asshole, you really want that list killed, do you not? >I have no bounds, as you will soon learn. When one is clapped in irons and thrown into prison for whatever it is that your acts can be classified under, then I am pretty sure they have _some_ bounds. >> > > Be careful who you threaten. It might get you in trouble. One wonders if you ever pay attention to what you actually write, aga? >WRONG! There is NO crime which covers anything that one does >internationally! And mailbombing is NOT "Unauthorized access," >regardless of where it occurs! Uhm...oops, aga, you're wrong here, there are plenty of crimes that are international crimes. War crimes for example, which o against the Geneva convention. Child abduction crimes, which go against the Hague convention. But I am sure they will give you a slight slap on the wrist, after all, you are only a stupid hillbilly with no idea of the law. >Pitt-1975; Dissertation was in 1983 actions. I practiced for >six years, and then became perfect. I currently do not practice for >any parties other than myself, family, corporation or Institutes, >and I need no license for that. And since I do not carry any >license from any State, there is NOTHING that you can do to stop me. Assassination comes to mind... >The State disciplinary board has no jurisdiction, nor does any >Law. A Criminal Lawyer is a specialist in ripping new assholes >on the witness stand, and that must now also be practiced on the net, >it seems. Remember, you are the one who asked for this, "Sadam." You seem to have this absolute _fascination_ with asses, faggots, cocks, and ripping _new_ assholes (as if you weren't a big enough one already. This is obviously some sort of concious repression: you just can't face the truth, can you, aga? >This is a world-wide internet problem that you are about to get >taken care of. You will be among the first locations to be >eliminated. And just remember that your termination is your own >doing. You had your chance to keep the fucking cypherpunks list >OFF of your e-mail to me, and blew it. Do we run and hide now, mommy? >> I suggest a hobby which entails more physical activity. >> > >I pump iron and run three times a week. And as a Tae Kwon Do >black belt holder, I get lots of physical activity. I am in >better physical shape than any other man that you know. He/she/it pumps iron, does he/she/it? Whilst running? No mean feat for a thing without a brain. Assuming that you are better than anyone else you have probably never met, someone who probably has no desire to meet a thing like yourself, is yet another example of your sheer assonance! >And just understand, as far as the internet is concerned, Europe does >not mean SHIT! Of course not...I am sure the European Internet thinks the same as you. After all, an inanimate object seems to think just as much as you! --The Edge

2 1

Re: Bounty Server, Revisited.
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

(snip) > BTW, bid to do what? Using market terminology, I have assumed thay > bid is to buy, that is provide cash. Offer is to sell, that is provide > software. Ah, yes, bid is add to bounty. (snip) Ian and Snow, I think it would be extremely valuable to have the ability to "offer" and to "bid". If Joe Student has much spare time and wants to develop a tool for themselves they should also have the option to "offer" it to the bounty server. If any one is interested, offers could be made. Good luck to you both. This sounds like it is coming along. > TTFN > iang. Matt _________________________________________________________________________ Matthew J. Miszewski | <mjmiski(a)execpc.com> Practice Crypto Civil Disobedience | Export your favorite Cryptosystem ------------------------------------------------------------------------- print pack"C*",split/\D+/,`echo "16iII*o\U@{$/=$z;[(pop,pop,unpack"H*",<> )]}\EsMsKsN0[lN*1lK[d2%Sa2/d0<X+d*lMLa^*lN%0]dsXx++lMlN/dsM0<J]dsJxp"|dc`

1 0

Re: Star Trek: First Contact
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>> Are any of the characters in the new Star Trek gay? >The bold guy who plays Captain Picard is very gay in real life. >(He probably hated all those love episodes with women :-) Actually the opposite is the case, he is a notorious womanizer. He played a gay man in the recent remake of La Cage aux Folles and made the point that he has also played Stjannus in "I Claudius" and nobody asked if he was a homicidal maniac. Yet more proof that nothing Dimitri says is relevant or interesting. Phill

2 1

Re: Provably "Secure" Crypto
by nobody＠cypherpunks.ca 17 Dec '03

17 Dec '03

At 7:03 AM 11/25/1996, Adam Back wrote: >deGriz (sic) wrote: >> At 4:18 AM 11/26/1996, Peter M Allan wrote: >> >That is a bound on a _reliable_ algorithm. A faster one is to shuffle >> >the elements and present it as sorted. Lightning fast, but only with >> >low probability of correctness. That is what we are up against in a key >> >search attack. The other guy just might guess my 100 bit key first time, >> >millionth time or whatever - early enough anyway. >> >> >So to get a lower bound you have to show that a lucky guess cannot be >> >distinguished from an unlucky one - and if you do that without a one >> >time pad I take my hat off. >> >> If the chance of a successful guess is absurdly low, the algorithm can >> be considered to be secure. It is quite unlikely that you will guess >> a random 128-bit key. > >Agreed. However you _can_ instantly verify once you have guessed. >This makes the algorithm cryptographically secure, but _not_ perfectly >secure as is the case with a OTP with a truly random pad. > >I think we agree, it is just a distinction in definitions of terms. We are in agreement. I would add, for the benefit of others, that it is a good idea to keep in mind that the focus of our work is to build physical systems which are secure. For instance, we determine the primality of numbers using probabilistic methods. This is not "perfect" in the sense that a OTP is, but it is certainly good enough to bet somebody else's life on it. ;-) OTPs, for that matter, are engineering problems, too. It is difficult to find a random number generator in which we have complete confidence. If we buy a board from somebody, how do we know there isn't a back door? How do we know they did a good job? Many commercially available hardware random number generators are of shockingly poor quality. Caveat emptor. diGriz

1 0

RE: Re: wealth and property rights
by jc105558＠spruce.hsu.edu 17 Dec '03

17 Dec '03

From: MX%"dave(a)kachina.jetcafe.org" 22-NOV-1996 00:41:58.20 To: MX%"aba(a)dcs.ex.ac.uk" CC: MX%"freedom-knights(a)kachina.jetcafe.org",MX%"cypherpunks(a)toad.com" Subj: Re: wealth and property rights Return-Path: <cypherpunks-errors(a)toad.com> Received: from toad.com by spruce.HSU.EDU (MX V4.1 VAX) with SMTP; Fri, 22 Nov 1996 00:41:55 EST Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id SAA04549 for cypherpunks-outgoing; Thu, 21 Nov 1996 18:36:12 -0800 (PST) Received: from kachina.jetcafe.org (jetcafe.org [207.155.21.2]) by toad.com (8.7.5/8.7.3) with ESMTP id SAA04544 for <cypherpunks(a)toad.com>; Thu, 21 Nov 1996 18:36:08 -0800 (PST) Received: from [127.0.0.1] ([127.0.0.1]) by kachina.jetcafe.org (8.7.5/8.7.3) with SMTP id SAA02028; Thu, 21 Nov 1996 18:35:51 -0800 (PST) Message-ID: <199611220235.SAA02028(a)kachina.jetcafe.org> X-Authentication-Warning: kachina.jetcafe.org: Host [127.0.0.1] didn't use HELO protocol To: Adam Back <aba(a)dcs.ex.ac.uk> CC: freedom-knights(a)kachina.jetcafe.org, cypherpunks(a)toad.com Subject: Re: wealth and property rights Date: Thu, 21 Nov 1996 18:35:49 -0800 From: Dave Hayes <dave(a)kachina.jetcafe.org> Sender: owner-cypherpunks(a)toad.com Precedence: bulk > Btw, people of your mentality (communists/socialists) already make it > very difficult for me to accumulate, due to the exhorbitant tax rates > to support those who chose to blow their money as soon as they have > it I don't necessarily want to support "socialism" nor "capitalism". Both are extremes of a situation which does no one any good to exist. However, I would question the implication that "socialists" are responsible for the higher tax rates you currently experience. For example, I could make a strong case that you really have some clever "capitalists" who have learned how to express their "capitalism" quite effectively across the space of all people in a "country". 8-) ------ Dave Hayes - Altadena CA, USA - dave(a)jetcafe.org Freedom Knight of Usenet - http://www.jetcafe.org/~dave/usenet It is the wise bird who builds his nest in a tree.

4 3

CHANGE: Visa-Free List - How to gain another nationality
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 26 Nov 1996 14:22:07 -0600 Reply-To: sanwar(a)bclimser.demon.co.uk Sender: NEW-LIST - New List Announcements <NEW-LIST(a)LISTSERV.NODAK.EDU> From: Sanwar Ali <sanwar(a)bclimser.demon.co.uk> Organization: BCL Immigration Services Subject: CHANGE: Visa-Free List - How to gain another nationality To: NEW-LIST(a)LISTSERV.NODAK.EDU The VISA-FREE list has now had a change in address for all requests to the server. Instead of it ending with pobox.com after the @ sign it will be majordomo.pobox.com. Below are the new details for the list. VISA-FREE on majordomo(a)majordomo.pobox.com Discussion of how to gain another nationality for visa-free travel VISA-FREE an unmoderated discussion list covering the problems associated with international travel. In particular the issues discussed will cover acquiring a different nationality to overcome these problems. VISA-FREE is open to anyone wanting more information on visa-free travel, or with useful tips about gaining another nationality quickly. It is also open to specialists in nationality law. Documentation covering the relevant laws of countries that grant their citizenship quickly are archived at: http://www.bclimser.demon.co.uk/bclgovnt.htm Also information covering problems that people have experienced when using a new passport will be covered. There are archives of many of the digests at: http://www.bclimser.demon.co.uk/bclarchv.htm There will also be an e-journal called "THE VISA-FREE JOURNAL" sent to subscribers. Anyone wishing to write to the list-owner directly to discuss relevant issues and who does not wish this circulated to the list may do so. The address is s.riley(a)pobox.com. Please also state whether you would mind if your comments are put into the journal. The list-owner will respect any requests for privacy. *IMPORTANT: Anyone offering specialist assistance to VISA-FREE must provide the list owner with the relevant laws applicable to any citizenship programme offered, in the form of plain text to be archived and made available to the list. Also the legal basis of any programme must be fully verified with the list owner before permission is granted for circulation to the list. This is to safeguard the integrity of the list. Permission will not be unreasonably withheld from such people. At the same time the list -owner reserves the right to exclude those people who do not adhere to the purpose of the list, engage in unnecessary flaming or offer services of a dubious nature.* To subscribe to VISA-FREE, please send the message: SUBSCRIBE VISA-FREE (without your name!) or for the digest SUBSCRIBE VISA-FREE-DIGEST to majordomo(a)majordomo.pobox.com To send messages to the full list use visa-free(a)majordomo.pobox.com For messages to the list owner use s.riley(a)pobox.com Home Page: http://www.bclimser.demon.co.uk/bclvisfr.htm Owner: Sam Riley (AKA "Sanwar Ali") s.riley(a)pobox.com The list-owner's public key is: -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi/xbwUAAAEEALZolxs1l/DbYtEOIJV71EdsDepzR+DhLPPATIMwYiYgU9Yc PRIa6aUI4VKrtz23/3Nz4pFP45kCfKUehsJ3oqtXzGWqCqIpPVm4q4d6oV44Csn5 EykR3ujlzYaCopzsYRD9E/EIaxVztnIantfLeN0IwQL0k9XazPkj64yNL1lpAAUR tCRTYW0gUmlsZXkgPHNhbUBiY2xpbXNlci5kZW1vbi5jby51az4= =nj7+ -----END PGP PUBLIC KEY BLOCK----- ------- Use this information at your own risk. For more information and disclaimer send E-mail to LISTSERV(a)LISTSERV.NODAK.EDU with the command INFO NEW-LIST in the body. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

TIA Invites
by John Young 17 Dec '03

17 Dec '03

A rep of the Telecommunications Industry Association telephoned to say that TIA has invited authority to investigate disclosure of TIA's TR45.3 to the unworthy.

2 1

Re: Another Nutty Idea about SPAM
by zerkle＠cs.ucdavis.edu 17 Dec '03

17 Dec '03

(apologies if this appears twice...I'm easily confused) > From: ichudov(a)algebra.com (Igor Chudov @ home) > It is not illegal to make unsolicited phone calls. People must > take an _action_ (request to be removed from call lists) in order > not to be bothered. Yes. However, there is an organization that will send out such a list to a large number of big companies that do telemarketing. If any of those companies call any of the people on the list, they each send a bill for $100. If the bill isn't paid, they sue for the money. They always get the money. The telemarketers really hate these people, which means that they are doing their job. So, for the spammers, what I'm proposing is not that people *need* to take action to avoid getting spammed, but that they *can* take action if they want to get paid for spam. -Dan

1 0

Re: wealth and property rights
by Clay Olbon II 17 Dec '03

17 Dec '03

At 10:54 AM 11/27/96 -0800, Dave Kinchlea wrote: >On Wed, 27 Nov 1996, Clay Olbon II wrote: >> >> This is provably bullshit. Look at the HUGE numbers of people in this >> country who make the economic decision to do nothing and go on welfare vs. >> going to work. Examine carefully the economic performance of the US vs the > >I don't know how much people get on welfare in your country but I >suspect that it is even less than in this country (Canada). Anyone who >truly believes that people make the `economic decision to do nothing and >go on welfare vs. going to work' has, in my opinion, no &^%* idea what >they are talking about. Just try to *live* on a welfare wage for a few >months to see how silly this thought is. While there may well be a few >`welfare-moms' (which is not necessarily a bad thing, taking care of >children is an investment for society), the vast majority of people on >welfare (at least here) would *much* rather get a decent job and work >for their money. There are, perhaps, a few people who would rather not >work for minimum wage (who find it impossible to feed their family on >that) but I suspect that those folks are few and far between. The average welfare benefit (including food stamps, medicaid, and all the other myriad programs) is $10/hr. Compare to a minimum wage of $5/hr. Offer most welfare recipients a minimum wage job and they will laugh in your face. (In fact, here in Michigan most employers are already paying several $$ above minimum wage, and often these jobs are unfilled). >> More bullshit. You don't know what anyones motives are. To ascribe your >> motivations to Bill Gates is unrealistic. > >But you claim to know the motives of those on welfare: pot->kettle->black I don't claim to know the motives. I am examining empirical evidence. As the welfare benefit increases, more go on welfare, as it decreases, less go on welfare. Someone is making economic decisions, consciously or unconsciously. Clay ******************************************************* Clay Olbon olbon(a)ix.netcom.com engineer, programmer, statistitian, etc. **********************************************tanstaafl

3 2

CNET News Dispatch November 26th, 1996
by The CNET newsletter 17 Dec '03

17 Dec '03

*************************************** NEWS.COM DAILY DISPATCH 6:10 p.m. (PT) Tuesday, November 26, 1996 San Francisco, California, USA *************************************** WELCOME! *************************************** The NEWS.COM DAILY DISPATCH highlights the up-to-the minute technology news presented by NEWS.COM. It tempts readers with coverage of today's hottest stories, news in the making, (in)credible rumors, and other indispensable information. For complete versions of the stories updated all day long, head over to: http://www.news.com/?nd *************************************** CONTENTS SCOOPS AND TOP STORIES The legislation that launched thousands of cyberspace ribbons The Nostradamus of the semiconductor market speaketh! Comdex sucks! No, it rules! Sucks! Does not! Does so! Might that be the virogen.asexual virus in your software? ANNOUNCEMENTS An easy way for you to customize NEWS.COM Late-breaking stories just a click away with Desk Top News Send us your questions, comments, flotsam, and jetsam *************************************** SCOOPS AND TOP STORIES THE LEGISLATION THAT LAUNCHED THOUSANDS OF CYBERSPACE RIBBONS It's baaaack... The Supreme Court will decide tomorrow whether it should review the CDA--the legislation cyberspace loves to hate--or simply put it out to pasture. Swirling around inside this legal vortex are issues of free speech, the definition of "obscene," and a potential $250,000 fine for transgressors. Maybe CDA really stands for "Can't download anything..." http://www.news.com/News/Item/0%2C4%2C5743%2C00.html?nd *************************************** THE NOSTRADAMUS OF THE SEMICONDUCTOR MARKET SPEAKETH! Who better than a Robertson, Stephens semiconductor analyst to take you on a guided tour of the volatile world of semiconductor stocks? Dan Niles demystifies the market's plummeting and rising...distinguishes between trends and blips, and pontificates on where semiconductor stocks are going in the long run. [Hint: Can you say $275 billion?...] http://www.news.com/Perspectives/perspectives.html?ntb.pers?nd *************************************** COMDEX SUCKS! NO, IT RULES! SUCKS! DOES NOT! DOES SO! If you've been to Comdex and survived, how did you manage it? NEWS.COM wants your war stories. We will publish the best five, and the winners--picked on a totally subjective basis by our editorial staff--will get supercool CNET T-shirts. Mail suggestions(a)news.com, and include the words 'Comdex stories' in the subject of your message. To paraphrase the Prez, "Let us feel yur paynnne..." http://www.news.com/Comdex/?nd *************************************** MIGHT THAT BE THE VIROGEN.ASEXUAL VIRUS IN YOUR SOFTWARE? Downloaders of PointCast's version 1.2 got a bit of a shock for their trouble, namely a Norton antivirus software-generated message that told them they had contracted a virus with the esoteric moniker "Virogen.asexual." While the scare isn't in league with the benzene-in-the-Perrier snafu of a few years back, there were still ruffled feathers that needed smoothing. http://www.news.com/News/Item/0%2C4%2C5745%2C00.html?nd *************************************** ANNOUNCEMENTS AN EASY WAY FOR YOU TO CUSTOMIZE NEWS.COM So many bits, so little time? Sounds like you need Custom News. Identify the topics, keywords, or sections you're most interested in, and Custom News will a create a page of headlines and summaries for all stories that match your criteria. Check it out at: http://www.news.com/Personalization/Entry/1%2C21%2C%2C00.html?nocache=1 *************************************** LATE-BREAKING STORIES A CLICK AWAY WITH DESK TOP NEWS How would you like having split-second access to the very latest news on the Net? Our Desk Top News feature puts our 20 most recent stories right there on your desktop for you to review at any time. Here's how it works: 1. From any story, click Desk Top News in the top right. 2. A window will open showing our last 20 stories. 3. Click on a headline to display the story. 4. Desk Top News updates itself every 30 minutes. 5. You become known as Ms./Mr. Cyber-Info. It feels good. http://www.news.com/Help/Item/0%2C24%2C12%2C00.html?nd *************************************** SEND US QUESTIONS, COMMENTS, FLOTSAM, AND JETSAM If you have any questions, suggestions or remarks, send us a message: newsdispatch(a)cnet.com *************************************** CNET: The Computer Network http://www.cnet.com/ http://www.news.com/ http://www.gamecenter.com/ http://www.download.com/ http://www.search.com/ http://www.shareware.com/

1 0

Re: Dorthy Denning is a boot-licking fasicist!!!
by Robin Whittle 17 Dec '03

17 Dec '03

William H. Geiger III <whgiii(a)amaranth.com> wrote: > Dorthy Denning is a boot-licking fasicist!!! > Dorthy Denning gave the most pro-government speech I have ever > heard. Is this clueless bitch on the government payroll?!! Spelling please! "Dorothy". She is a US academic. It may be emotionally satisfying to rail against (what for us may be evident as) the wickedness and stupidity of our opponents. I did not see the testimony, so I can't comment on it. However I believe that Dorothy Denning is motivated as much as many of us by the desire for a healthy society. The sharp difference in crypto policy can probably be explained by a differing understanding of: 1 - The likely behaviour of professional criminals, normal people, government officials and criminal government officials in the future with various forms of crypto system. 2 - Different levels of trust and fear regarding crime in general, big-time crime in particular and the use and abuse of law enforcement and other government powers. 3 - Probably other things too. I think that there are different personality types at work here. Adding to that is the tendency for governments to employ people who generally trust governments, their desire to perpetuate their former abilities to detect and deter crime and especially the problem of *groupthink*. Groupthink is the tendency for like minded individuals to reject uncomfortable notions, and so develop a seriously inadequate understanding of reality. JFK admitted they were stupid to commence the Bay of Pigs invasion. Clinton will probably say the same thing about crypto export controls. There is clear evidence that, being surrounded by like minded advisers, both presidents were the victims of groupthink. If we nod our heads to "Dorthy Denning is a boot-licking fasicist!!!" then we too are succumbing to groupthink. See: http://www.ozemail.com.au/~firstpr/crypto/oecd_dr.htm for Dorothy Denning's response to my challenge for justifying costs of key-escrow/recovery against the likely benefit in crime reduction. I don't think it is a very strong response, and while many on this list will know more about her than I do, her response does not strike me as the work of someone who is unintelligent, uninterested in the future of society or a fascist. The net result of various misunderstandings (such as Clinton and Co. must have about the freely available nature of strong crypto) may well be stupidity on a grand scale. There are personality types who lean away from privacy and towards dangerous levels of government control. I think this can be amplified by the circumstances in which these people work - and groupthink is a big part of that. oecd_dr.htm is a recent draft of some OECD crypto work, with my comments, especially concerning the likely behaviour of criminals communicating both with other criminals and with non-criminals. It also has some information on an essay by Irving L. Janis called "Group Think" which I recommend to everyone who is involved in policy debates. - Robin . Robin Whittle . . http://www.ozemail.com.au/~firstpr firstpr(a)ozemail.com.au . . 11 Miller St. Heidelberg Heights 3081 Melbourne Australia . . Ph +61-3-9459-2889 Fax +61-3-9458-1736 . . Consumer advocacy in telecommunications, especially privacy . . . . First Principles - Research and expression - music, . . music industry, telecommunications . . human factors in technology adoption. . . . Real World Interfaces - Hardware and software, especially . . for music .

7 6