December 2003 - cypherpunks-legacy

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

http://www.cnn.com Congressman demonstrates ease of cell phone snooping

2 1

Re: Getting into MIT is impossible
by jim bell 17 Dec '03

17 Dec '03

At 04:50 PM 2/5/97 +0100, P.J. Westerhof wrote: >At 18:12 4-02-97 -0800, you wrote: >>Erland van Lidth de Jeude is a MIT grad. He played the big badass in "Stir >>Crazy." Computer science major, BTW. >> >He is quite a singer too (at least he was some years ago on Dutch TV). >Perhaps that made the difference. ;-) He was on the fourth floor of the west parallel of East Campus, in about 1977 as I recall. I was on the third floor. He was a wrestler; I heard he didn't have to work all that hard, he could just sit on the opponent and he'd win. Jim Bell jimbell(a)pacifier.com

1 0

Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Robert Hettinga 17 Dec '03

17 Dec '03

At 4:05 pm -0500 2/5/97, Mark Voorhees wrote: >I'm almost certain that Murray is a consultant rather than >or in addition to an accountant. He's been saying these things >for years at conferences, in papers, on mailing lists, etc. For the longest time, I've had a couple of people from dtus.com on my e$pam feed. They signed on when I started my own list out of www-buyinfo. About 6 months ago, however, mail to them started bouncing out of e$, the chat list I set up as an adjunct to e$pam. Which makes sense, because that's when they stopped chatting about e$. :-). I expect that the same thing happend to e$pam, though Rachel Wilmer, who is my e$pam listmaster would have seen it, and not I. Actually, e$ has become something of a watering hole, now with about twice as many subscribers as e$pam does. Some cypherpunks among them. Oh. While we're all talking about moderation, e$pam is a sort of filtered superset of cypherpunks. I have filtered cypherpunks posts in it, but I also have stuff from the 50-odd mail lists and 70 news groups I follow. The total feed can reach 300k a day sometimes, mostly because I include the full text of stuff like some of John Young's articles, and the text of the occasional web-page which tickles my fancy. Sort of immoderate moderation. :-). You can subscribe to it on my web page, which is in my .sig, below. I've a bunch of people working with me now on e$pam, who, among other things, are in the process of getting it set up in a searchable archive. Though, to prevent crawlers from seeing all the juicy bits (cf. Mr. Young, above), we're probably going to have some kind of certificate-access scheme when we get it all running. Rodney Thayer, who's doing IPSEC stuff, (among other things :-)), is going to run a quick-and-dirty generic certification authority to make that happen. In the meantime, if you're interested in e$, or financial crypto, or other stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" :-)), you might want to check it. Even though cypherpunks is a lot "cleaner" now, and I did encourage Sandy in his efforts initially, I suppose I'm now weighing in with (horrors!) Tim on the subject of moderation. I think that if Sandy and John want to create a moderated list (like I have done, though e$pam is more specific in content) out of what happens on cypherpunks, they could do it with exactly the traffic they have now in experimental moderation mode. The current machine load doesn't seem to be impacting the throughput to cypherpunks(moderated), modulo Sandy's moderation time, though if toad.com's being used for much else, there might be problems there. Part of the nice thing about cypherpunks 1.0 was that anything could happen there. That it was anarchy in practice. And, maybe because of my periodic altercations with Mr. May on this list (thank god for his kill-file :-)) even the anonymous Tim-slams were occasionally entertaining, in a, ahem, biologically curious sort of way. ;-). So, I guess I think we should put it back the way it was. Including, please Mr. Gilmore, "officially' resubscribing the Wee-vil Dr. V. Then those who've made it so can annouce to the world that cypherpunks is again a proper anarchy. Then we can us deal with miscreants the way we used to, by ignoring them, (and the occasional e-mailbomb...). Finally, I have an analogy for cypherpunks from nature. There are lots of plants, some of them the technically the largest living beings on earth, which, at first glance, look like a bunch of different individual plants. Aspen groves, for instance, are all linked together under the soil to the same system of roots, and are genetically the same individual. Some of these "stands" of trees cover tens of square miles, and one patch of Aspens, in Wyoming? Montana? is the world's largest living thing, massing several million(?) tons, and probably tens of thousands of years old. Fungi do this too. Toadstools (a rather, heh, fecund analog for cypherpunks) tend to create very large "individuals", with each toadstool representing the fruiting body for a huge bunch of mycyillia(sp?) underneath it. Toadstools create structures called, ahem, "fairy rings", where the central mushroom dies, only to be replaced by a ring of other mushrooms, which die, and so on, until they're covering your whole fucking lawn and messing up your lawnmower bag... (well, anyway, you get the idea.) There was the claim a few years ago that the same genetic individual slime mold covered half of Wisconsin (Minnesota?). The king of all the plants which do this, I think, is the cresote bush, which, I believe, in some pieces of the Sonorran(sp?) desert, cover hundreds of square miles. Scientists, using tree-ring dating, have worked back, through various rings of cresote bushes, using their very slow growth rates in the desert environment, to the center of the creosote bush cluster, to estimate the date of these things. I remember claims that these plants may have started from a single individual, there at the long dead (or at least regrown-over) center of the ring, more than a hundred, and maybe several hundred thousand years ago. So, let nature take its course. Most lists die when people stop posting to it. That certainly hasn't happened to cypherpunks. And, when it does, we can all migrate out into the numerous rings of lists that cypherpunks has spawned (I think I can account about putting together 10 or so myself) among them. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

3 2

pgpmail 4.5
by Huge Cajones Remailer 17 Dec '03

17 Dec '03

you wrote: There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b can someone clear this up?

1 0

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

1 0

Re: Cypherpunks FOIA request
by Lucky Green 17 Dec '03

17 Dec '03

At 12:40 AM 2/5/97 -0800, Greg Broiles wrote: >I'm not sure what I think about the response from the SF FBI branch - it >seems unlikely that they'd never have paid any attention to the list, given >the media coverage in Wired and other places. My attorney used to fly planes with nuclear cargo. Another friend of mine has been visited several times by the FBI. In either case, the FBI claimed upon receiving an FOIA request that they have no record on either person. Does anybody here believe that the USAF would let pilots take off with nukes on board without ever conducting a background investigation (which are handled by the FBI)? I didn't think so. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred "I do believe that where there is a choice only between cowardice and violence, I would advise violence." Mahatma Gandhi

2 1

mail list / sequence number & signature
by Corey Minter 17 Dec '03

17 Dec '03

Have the list maintainers ever considered either or both of the following... (Sorry in advance if this has been brought up sometime in the past.) o adding a digital signature from "owner-cypherpunks(a)toad.com", so someone can't mass mail the mailing list and make it appear that the message came from toad.com. I just tried to figure out if the id in the header is in any order but I couldn't tell. I have already deleted many messages so some numbers are missing anyway. o adding a sequence number to every message which comes through toad.com, so recipients can easily notice if mail is be accidentially or intentionally filtered by their service provider or any other forces. At the same time, you could add the current numbers for flame vs. non-flame. This would help end all the bandwidth wasted on people speculating about the numbers. say there are X total messages, Y non-flames, and Z flames then the appearance to subscriber (either in the subject or some header field) could be... list type | all non-flame flame ---- | --- --------- ----- non-flame | X (non-flame Y) Y (all X) flame | X (flame Z) Z (all X) -- Of course... these are my opinions, not my employer's. ______________________________________________________________________ Corey Minter | cminter(a)mipos2.intel.com | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Letter Re: Kahn Supporting GAK
by jim bell 17 Dec '03

17 Dec '03

At 05:16 AM 2/5/97 +0000, Robert Rothenburg 'Walking-Owl' wrote: >My letter to Long Island Newsday regarding David Kahn's pro-GAK >editorial was published today. You can read it at > > http://www.newsday.com/mainnews/rnmi052u.htm > >What's odd (?) is how they editied it. I directed my comments toward >Mr. Kahn's views, which they changed to "Newsday" (odd, since I've >never seen them print an editorial one way or another on GAK; does >this mean they are taking a stand? -- Kahn is an editor at Newsday). > >I wrote "The greatest flaw in the argument is it's very reason, >'criminals... are increasingly using encryption to conceal their plans >and activities'" which they changed to "It reports...". I never >considered an op-ed piece as "reporting", even if it states a fact. But which "criminals," exactly, are "increasingly using encryption to conceal their plans and activities"? Let's not concede this unless it's really true. It would be far more accurate to say that it's likely that many people who are politically hostile to their government are using encryption in anticipation of persecution by the government, persecution that could easily come in the form of criminal charges. Jim Bell jimbell(a)pacifier.com

1 0

Re: Letter Re: Kahn Supporting GAK
by Robert Rothenburg 'Walking-Owl' 17 Dec '03

17 Dec '03

Good point: but I've seen a few refs from LEAs about "Drug Dealer X who we can't talk about" or "Child Pornographer Y who we can't talk about" (in lieu of cases being digested by the court system) so I didn't harp on that point. A point I did leave out was that if they already knew these people were criminals and were building cases against them, monitoring them enough to know they used crypto, then do they really need to bother with listening in to the exact message? I wanted to emphasize the phallacy of the sacrifical lamb of rights in the name of the god of security. Also, they mungled the letter enough, so it's better for LI Newsday (which caters to a reading level of the average 12-year-old) submissions to be kept short and sweet. I'm quite surprised that mine is the only letter they printed. Certainly they would have gotten more than one submission on a controversial subject? --Rob On 5 Feb 97 at 18:22, jim bell wrote: > But which "criminals," exactly, are "increasingly using encryption to > conceal their plans and activities"? Let's not concede this unless it's > really true. > > It would be far more accurate to say that it's likely that many people who > are politically hostile to their government are using encryption in > anticipation of persecution by the government, persecution that could easily > come in the form of criminal charges. > > > Jim Bell > jimbell(a)pacifier.com > > ----- "The word to kill ain't dirty | Robert Rothenburg (WlkngOwl(a)unix.asb.com) I used it in the last line | http://www.asb.com/usr/wlkngowl/ but use a short word for lovin' | Se habla PGP: Reply with the subject and dad you wind up doin' time." | 'send pgp-key' for my public key.

1 0

Re: Deloitte-Touche?
by Bruce M. 17 Dec '03

17 Dec '03

On Wed, 5 Feb 1997, Marshall Clow wrote: > Mr. Murray gave a long, impassioned speech. > > He was very emphatic about not trusting anything > that the government says, and that once they got > their "foot in the door", that they would seek to > expand their abilities to regulate, etc, etc. > > He advocated deployment of strong crypto. He > insisted that there was no way the government > could stop the export of strong crypto. He exhorted > people to refuse to obey the ITAR/EAR regulations, > and to lobby their congresscritters to get the > PRO-CODE bill passed. > > It wasn't really what he said that amazed me, because > I had heard most of it (in bits and pieces) before. It > was presenting it all in a package, in an emotional > manner, by an elderly, conseratively dressed > accountant who was representing a large > corporation whose job it is to help people obey the > government. I was in attendance at an ISSA conference earlier this year where Mr. Murray gave the "keynote" speech on Electronic Commerce. While he did strongly advocate the adoption of strong crypto and various methods of security, he never stepped into the more radical mode of encouraging people to break the law. That was a different audience though. As he is also an ex-25 year IBM veteran it amazes me that he would make such a public outcry against govt. regulations (okay, so it's a stereotype). Deloitte & Touche must really have a big stake in the pro-crypto market or else he actually cares a lot. ____________________________________________________ [ Bruce M. - bkmarsh(a)feist.com - Feist Systems, Inc. ] ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ "We don't want to get our butts kicked by a bunch of long-haired 26-year-olds with earrings." -- General John Sheehan on their reasons for InfoWar involvement

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 04:35 PM 2/5/97 -0800, Sean Roach wrote: >At 09:09 PM 2/4/97 -0800, jim bell wrote: >>However, fortunately I don't think it would make any difference in the >>overall effects. While AP would eliminate the taxation which is commonly >>thought of as the main way a "rich person" loses assets, in practice it >>would also shut down the well-hidden systems that allow some people to get >>rich (or, merely live off somebody else) "unfairly." Government agents >>come to mind, of course. >> >The money doesn't necessarily come from taxation, the owner of a business >takes a cut of whatever money is made even if that person is unproductive. >The tyrant would be the owner of the industry. The kind of effects I'm thinking of are primarily the "military spending" situations, where: 1. Large numbers of potentially competent and useful people get put into useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. (Those people who still think military spending is really necessary obviously haven't read AP.) 2. Large amounts of money are spent on military hardware, money which goes to fund people who would otherwise develop useful products in the non-government private sector. 3. The patent system decreases competition, increases profits and prices in the marketplace due to government actions to allow and enforce monopolies. 4. Government employees are paid more for their activities than they would receive in the private sector. Ironically, in this case an "apples-to-apples" comparison is misleading: It would be wrong to compare a middle level government manager to his counterpart in private industry, because to postulate there is such a government-job assumes that the private-sector would do it post-AP. >If you are right then governments would effectively lose the ability to tax, >with or without representation, as most people do not agree on everything, >like how their money is spent. However, even now, as pointed out in some >recent posts, our tax money is used to foreward the goals of a few, these >few want to eliminate guns, crypto, free speech, ect. Although we are in >oppostition, our money is still used to foreward the goals. Yes, the main effect of AP is the elimination of the ability to tax. Now, nothing would prevents individuals from continuing to fund an organization called a "government" so that it could do those (non-coercive) things that individual wants to see done. But I think it'll be amazing how many of those heretofore-funded-by-govt projects (previously promoted as being wanted by a large fraction of the citizenry) that evaporate when the public is given the option to continue to fund them voluntarily. Let's suppose, hypothetically and for vast simplification, the government engages in two activities, "A" and "B." Further suppose government taxes from two groups, let's call them "Alphas" and "Betas." It is traditionally thought that Alphas like spending on "A", but hate spending on "B". Likewise, it is figured that Betas like spending on "B", don't like spending on "A". Post-AP, one might innocently suspect that maybe the "Alphas" would simply fund only "A", while Betas" would donate money for activity "B". Assuming the amount of funding for those activities was equal, you might think that things could go on as they already do. But no. The reality is that "Alphas" merely like spending on "A" _more_ than they do "B", and they will tolerate their own money being used for both only because the "Betas" are similarly forced. Add volunteerism to the whole mix, and not only would these two groups only fund just what they really wanted, they would soon discover they don't even want the level of spending they previously argued for, pre-AP. In practice, those services people like will continue, but it is highly unlikely that they will be supply by organizations which evolve from those currently called "governments." Jim Bell jimbell(a)pacifier.com

1 0

Re: John's: In anarchy -everyone responsible
by jim bell 17 Dec '03

17 Dec '03

At 02:41 PM 2/5/97 +0000, Attila T. Hun wrote: > >+Put simply, "anarchy is not the lack of order. It is the lack of >+_orders_." > > disagree. pure anarchy is not the lack of "orders" --pure anarchy > implies that everyone is imbued with that perfect sense of > responsibility. >From which hat do you pull this rabbit? > >+> anarchy is only possible in an ideal world where _everyone_ >+> assumes not only responsibility for themselves, but for the common >+> good. no malice, no greed, no need for assassination politics.... > >+No, that's traditional thinking and that's wrong. See AP part 8. >+Freud believed (as "everyone" else believed, even myself, before AP) >+that anarchy was inherently unstable. But it ISN'T, if the tools of >+AP are used to stabilize it. And no, no altruism is necessary for AP >+to work as well; no individuals are being asked to sacrifice >+themselves for the common good. Rather, they are given the >+opportunity to work to achieve a reward offered, cumulatively, by a >+number of citizens. > > aah, but that is the difference between a _pure_ anarchy and a > _popular_ anarchy. A pure _anarchy_ is sufficiently idealistic in > that _noone_ lacks the necessary resonsibility to keep society > moving, each individual in their own niche. Why, exactly, is it "necessary" to "keep society moving"? Isn't that somewhat of a contradiction in terms? (particularly when you are discussing the subject, "anarchy." It seems you don't really understand what the word "anarchy" means. Sigh. > As long as there is > perfect responsibility in a perfect anarchy, then there is no need > for AP. Are you saying that for a world that has ALREADY achieved anarchy, and we presume "perfect responsibility," AP is not necessary to maintain this state? Well, that's a rather limited assertion; some would argue it's practically meaningless. Isn't that somewhat like saying, "A perfectly-balanced inverted pendulum needs no mechanism to keep it pointing straight up."? True, perhaps, but how do you get that "perfectly-balanced" part right? > AP is a negative, or _punative_, influence; I might liken it to the > Catholic Church which is a religion of fear, and an instrument of > political control. Actually, it's quite the opposite: AP is the absolute prohibition on and/or destruction of any "instrument of political control." Now, to a person who thinks that the natural state of the world is a condition of political control (and it wouldn't be hard to understand why a person could come to this conclusion, given the bulk of history), the ABSENSE of political control "looks like" political control. This is, obviously, akin to the optical illusion where you stare intently at a pattern of color on a page (the American flag is often used) for a minute or two, and then you suddenly glance towards a white sheet of paper on which, as I recall, immediately appears a complementary flag of green and black stripes, and black stars on a yellow field. AP destroys the mechanisms that societies use for much political control. Jim Bell jimbell(a)pacifier.com

1 0

Re: mail-to-news fun
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:18 AM 2/6/97 -0000, you wrote: >Unfortunately, you don't really have a choice about what kind of >speech you are supporting if you run a remailer. Don't fall into the >trap of saying, "I want to give people complete freedom of anonymous >speech... EXCEPT...." As abhorrent as we may find the homophobic >hatemongers from the "freedom-knights" list, I guarantee a lot of >politicians would object more strongly to the "Help, I might be gay >and my parents will kill me" post. Once you set up a system for >content-based censorship, don't think you can stay in control of it. The problem isn't homophobic hatemongers who use their own names or nyms or no name, or even get my remailer's name associated with that - I can reply to complaints or file them in the handy bit bucket. The problem is forgers signing _other_ people's names to their hatemonger postings, causing the innocent third party to catch all the flames that the forger was trying to generate. Stewart wrote: >> On the other hand, I don't want to support postings titled >> "ALL FAGS MUST DIE" with a forged signature and email at the bottom, >> and I especially don't want to post that from my remailer without >> indicating that anything posted by a remailer might be forged. >> That's why I shut down my previous remailer - the forger only >> posted one forged message; the person whose name got forged >> got flamed severely by dozens of people who objected to "her" posts. >> Blocking the gay newsgroups cuts down on that kind of trolling, >> but also cuts out the "Help, I might be gay and my parents will kill me" >> traffic that remailers are supposed to help with. Guess I should have been more clear.... >As for forgery, I do add > X-Warning: Sender address is unverified and may not be authentic. >to every article that goest through my mail2news gateway. Does anybody read X-Warning: headers? Not all newsreaders even show all the headers. It's a good start, and that's clearly the place in the system to insert it. >Additionally, I have a fast source-blocking system set up, so anyone >in whose name articles are being forged can immediately stop it by >mailing <srcblk-request(a)nym.alias.net>. (This doesn't source-block >them from the remailers, just the non-anonymizing mail2news gateway.) That helps, at least if the spammer is doing a lot of it (or if the spam is from a broken gateway program or whatever.) But for the troll that killed my remailer, one message was enough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

RE: Fighting the cybercensor
by jim bell 17 Dec '03

17 Dec '03

At 04:35 PM 2/5/97 -0800, Sean Roach wrote: >At 09:09 PM 2/4/97 -0800, jim bell wrote: >>However, fortunately I don't think it would make any difference in the >>overall effects. While AP would eliminate the taxation which is commonly >>thought of as the main way a "rich person" loses assets, in practice it >>would also shut down the well-hidden systems that allow some people to get >>rich (or, merely live off somebody else) "unfairly." Government agents >>come to mind, of course. >> >The money doesn't necessarily come from taxation, the owner of a business >takes a cut of whatever money is made even if that person is unproductive. >The tyrant would be the owner of the industry. The kind of effects I'm thinking of are primarily the "military spending" situations, where: 1. Large numbers of potentially competent and useful people get put into useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. (Those people who still think military spending is really necessary obviously haven't read AP.) 2. Large amounts of money are spent on military hardware, money which goes to fund people who would otherwise develop useful products in the non-government private sector. 3. The patent system decreases competition, increases profits and prices in the marketplace due to government actions to allow and enforce monopolies. 4. Government employees are paid more for their activities than they would receive in the private sector. Ironically, in this case an "apples-to-apples" comparison is misleading: It would be wrong to compare a middle level government manager to his counterpart in private industry, because to postulate there is such a government-job assumes that the private-sector would do it post-AP. >If you are right then governments would effectively lose the ability to tax, >with or without representation, as most people do not agree on everything, >like how their money is spent. However, even now, as pointed out in some >recent posts, our tax money is used to foreward the goals of a few, these >few want to eliminate guns, crypto, free speech, ect. Although we are in >oppostition, our money is still used to foreward the goals. Yes, the main effect of AP is the elimination of the ability to tax. Now, nothing would prevents individuals from continuing to fund an organization called a "government" so that it could do those (non-coercive) things that individual wants to see done. But I think it'll be amazing how many of those heretofore-funded-by-govt projects (previously promoted as being wanted by a large fraction of the citizenry) that evaporate when the public is given the option to continue to fund them voluntarily. Let's suppose, hypothetically and for vast simplification, the government engages in two activities, "A" and "B." Further suppose government taxes from two groups, let's call them "Alphas" and "Betas." It is traditionally thought that Alphas like spending on "A", but hate spending on "B". Likewise, it is figured that Betas like spending on "B", don't like spending on "A". Post-AP, one might innocently suspect that maybe the "Alphas" would simply fund only "A", while Betas" would donate money for activity "B". Assuming the amount of funding for those activities was equal, you might think that things could go on as they already do. But no. The reality is that "Alphas" merely like spending on "A" _more_ than they do "B", and they will tolerate their own money being used for both only because the "Betas" are similarly forced. Add volunteerism to the whole mix, and not only would these two groups only fund just what they really wanted, they would soon discover they don't even want the level of spending they previously argued for, pre-AP. In practice, those services people like will continue, but it is highly unlikely that they will be supply by organizations which evolve from those currently called "governments." Jim Bell jimbell(a)pacifier.com

1 0

Re: your mail
by Declan McCullagh 17 Dec '03

17 Dec '03

Heh. On the ISP-TV show that Brock Meeks and I co-host, two weeks ago we not only described how easy it was to modify a handheld radio, we had a guest who demo'd cell-snooping on the air. -Declan On Wed, 5 Feb 1997, Bovine Remailer wrote: > http://www.cnn.com > > Congressman demonstrates > ease of cell phone snooping > > > > >

1 0

Re: mail-to-news fun
by Bill Stewart 17 Dec '03

17 Dec '03

At 02:18 AM 2/6/97 -0000, you wrote: >Unfortunately, you don't really have a choice about what kind of >speech you are supporting if you run a remailer. Don't fall into the >trap of saying, "I want to give people complete freedom of anonymous >speech... EXCEPT...." As abhorrent as we may find the homophobic >hatemongers from the "freedom-knights" list, I guarantee a lot of >politicians would object more strongly to the "Help, I might be gay >and my parents will kill me" post. Once you set up a system for >content-based censorship, don't think you can stay in control of it. The problem isn't homophobic hatemongers who use their own names or nyms or no name, or even get my remailer's name associated with that - I can reply to complaints or file them in the handy bit bucket. The problem is forgers signing _other_ people's names to their hatemonger postings, causing the innocent third party to catch all the flames that the forger was trying to generate. Stewart wrote: >> On the other hand, I don't want to support postings titled >> "ALL FAGS MUST DIE" with a forged signature and email at the bottom, >> and I especially don't want to post that from my remailer without >> indicating that anything posted by a remailer might be forged. >> That's why I shut down my previous remailer - the forger only >> posted one forged message; the person whose name got forged >> got flamed severely by dozens of people who objected to "her" posts. >> Blocking the gay newsgroups cuts down on that kind of trolling, >> but also cuts out the "Help, I might be gay and my parents will kill me" >> traffic that remailers are supposed to help with. Guess I should have been more clear.... >As for forgery, I do add > X-Warning: Sender address is unverified and may not be authentic. >to every article that goest through my mail2news gateway. Does anybody read X-Warning: headers? Not all newsreaders even show all the headers. It's a good start, and that's clearly the place in the system to insert it. >Additionally, I have a fast source-blocking system set up, so anyone >in whose name articles are being forged can immediately stop it by >mailing <srcblk-request(a)nym.alias.net>. (This doesn't source-block >them from the remailers, just the non-anonymizing mail2news gateway.) That helps, at least if the spammer is doing a lot of it (or if the spam is from a broken gateway program or whatever.) But for the troll that killed my remailer, one message was enough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

1 0

Re: John's: In anarchy -everyone responsible
by jim bell 17 Dec '03

17 Dec '03

At 02:41 PM 2/5/97 +0000, Attila T. Hun wrote: > >+Put simply, "anarchy is not the lack of order. It is the lack of >+_orders_." > > disagree. pure anarchy is not the lack of "orders" --pure anarchy > implies that everyone is imbued with that perfect sense of > responsibility. >From which hat do you pull this rabbit? > >+> anarchy is only possible in an ideal world where _everyone_ >+> assumes not only responsibility for themselves, but for the common >+> good. no malice, no greed, no need for assassination politics.... > >+No, that's traditional thinking and that's wrong. See AP part 8. >+Freud believed (as "everyone" else believed, even myself, before AP) >+that anarchy was inherently unstable. But it ISN'T, if the tools of >+AP are used to stabilize it. And no, no altruism is necessary for AP >+to work as well; no individuals are being asked to sacrifice >+themselves for the common good. Rather, they are given the >+opportunity to work to achieve a reward offered, cumulatively, by a >+number of citizens. > > aah, but that is the difference between a _pure_ anarchy and a > _popular_ anarchy. A pure _anarchy_ is sufficiently idealistic in > that _noone_ lacks the necessary resonsibility to keep society > moving, each individual in their own niche. Why, exactly, is it "necessary" to "keep society moving"? Isn't that somewhat of a contradiction in terms? (particularly when you are discussing the subject, "anarchy." It seems you don't really understand what the word "anarchy" means. Sigh. > As long as there is > perfect responsibility in a perfect anarchy, then there is no need > for AP. Are you saying that for a world that has ALREADY achieved anarchy, and we presume "perfect responsibility," AP is not necessary to maintain this state? Well, that's a rather limited assertion; some would argue it's practically meaningless. Isn't that somewhat like saying, "A perfectly-balanced inverted pendulum needs no mechanism to keep it pointing straight up."? True, perhaps, but how do you get that "perfectly-balanced" part right? > AP is a negative, or _punative_, influence; I might liken it to the > Catholic Church which is a religion of fear, and an instrument of > political control. Actually, it's quite the opposite: AP is the absolute prohibition on and/or destruction of any "instrument of political control." Now, to a person who thinks that the natural state of the world is a condition of political control (and it wouldn't be hard to understand why a person could come to this conclusion, given the bulk of history), the ABSENSE of political control "looks like" political control. This is, obviously, akin to the optical illusion where you stare intently at a pattern of color on a page (the American flag is often used) for a minute or two, and then you suddenly glance towards a white sheet of paper on which, as I recall, immediately appears a complementary flag of green and black stripes, and black stars on a yellow field. AP destroys the mechanisms that societies use for much political control. Jim Bell jimbell(a)pacifier.com

1 0

[RRE FWD] PKI: 10 Public Policy Questions
by Rick Osborne 17 Dec '03

17 Dec '03

C'punks- Got this off of the Red Rock Eater list, <http://communication.ucsd.edu/pagre/rre.html>, and figured those of you not on it might like a read. _________________________________________________ From: Phil Agre <pagre(a)weber.ucsd.edu> To: rre(a)weber.ucsd.edu Subject: PKI: 10 Public Policy Questions X-Url: http://communication.ucsd.edu/pagre/rre.html [The bottom line: State legislation on digital signatures presupposes an overly centralized architecture and is weighted against victims of fraud. Pursuing inherently national or global issues on the state level permits interested parties to shop for a friendly legislature, who will then set a precedent that other jurisdictions are likely to follow. This system is biased against less politically mobilized constituencies and favors older technologies and more centralized business models.] =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= This message was forwarded through the Red Rock Eater News Service (RRE). Send any replies to the original author, listed in the From: field below. You are welcome to send the message along to others but please do not use the "redirect" command. For information on RRE, including instructions for (un)subscribing, send an empty message to rre-help(a)weber.ucsd.edu =-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Date: Wed, 05 Feb 1997 09:48:01 -0800 From: Bradford Biddle <BIDDLECB(a)COOLEY.COM> Subject: PKI: 10 Public Policy Questions [...] * * * * * * * * * [Copyright 1997 C. Bradford Biddle; permission granted for non-commercial electronic redistribution] CFP '97: LUNCHTIME WORKSHOP, WED. MARCH 12 1997 12:30PM -2:00PM PUBLIC KEY INFRASTRUCTURES AND "DIGITAL SIGNATURE" LEGISLATION: 10 PUBLIC POLICY QUESTIONS BRAD BIDDLE* Following the lead of the state of Utah, numerous states and several foreign countries have enacted "digital signature" legislation aimed at promoting the development of a public key infrastructure (PKI). While PKI legislation has acquired significant momentum, it is not clear that lawmakers have carefully considered the public policy implications and long-term consequences of these laws. This luncheon session will explore certain policy questions related to a PKI, in an informal "open discussion" format. Ten questions we hope to address are: 1. Is legislation necessary at all? Proponents of digital signature legislation start with the premise that the need for a PKI is clear: public key cryptography and verifiable certificates offer the best hope for sending secure, authentic electronic messages over open networks, thereby facilitating electronic commerce. They argue that the reason that the commercial marketplace has not produced a viable certification authority (CA) industry is because of legal uncertainty (CAs are unable to determine their potential liability exposure because of a confusing array of applicable background law) or because existing law imposes too much liability on CAs. Thus, proponents argue, legislation is necessary in order to provide certainty in the marketplace and allow a much-needed industry to emerge, as well as to address other issues such as the legal status of digitally signed documents. Opponents of this view assert that it is far too soon to conclude that the market will not produce commercial CAs, and point to the increasing numbers of commercial CAs emerging even in the absence of legislation. Time is solving the "uncertainty" problem, opponents argue, and the "too much liability" problem is the product of flawed business models, not a flawed legal system. Opponents of legislation argue that the real danger is that a group of lawyers will impose a set of flawed rules that will fundamentally skew a dynamic infant marketplace and "lock in" a set of business models that the market would otherwise reject. The time for legislation and regulation is after identifiable problems exist in a mature industry, opponents say, not before an industry even exists. Opponents of legislation further argue that existing legal mechanisms can address the issue of the legal status of digitally signed documents. 2. Where should PKI legislation occur? Debate also occurs over the appropriate jurisdictional level for digital signature legislation. Some observers cringe at the thought of 50 inconsistent state digital signature laws; others believe that CAs and consumers will opt-in to the most sensible legislative scheme, and thus believe that competition between the states is helpful. Proponents of uniformity and consistency argue for PKI legislation at the federal or international level; opponents of this view point out that general commercial law has long been the province of state legislatures. 3. Is licensing of Certification Authorities the right approach? Under the Utah Digital Signature Act ("Utah Act") and much of the subsequent PKI-related legislation CAs are licensed by the state. The Utah Act makes licensing optional: CAs that obtain licenses are treated with favorable liability rules, but non-licensed CAs may exist in Utah. Licensing is a highly intrusive form of government regulation (other, less intrusive methods of regulation include mandatory disclosure requirements, altering liability rules to avoid externalized costs, bonding or insurance requirements, etc.). Typically, licensing as a form of regulation is reserved for circumstances where a market flaw cannot be addressed by other, less intrusive means. Does this sort of dynamic exist with CAs? Would consumers be able to make informed, rational choices between CAs? Could an incompetent CA cause irreparable harm? Could other types of regulation address any relevant market flaws? If unlicensed practitioners are allowed to exist, subject to different liability rules, how will this affect the CA market? 4. Should legislation endorse public key cryptography, or be "technology neutral"? Most of the digital signature legislation to date has focused specifically on digital signatures created using public key cryptography. Some legislation has also addressed the issue of "electronic signatures" -- other, non-public key methods of authenticating digital transmissions. Proponents of biometric authentication methods argue that it is foolish to legislatively enshrine public key cryptography as the only technology capable of authenticating an electronic document. They argue that biometric methods can currently accomplish many of the same goals as digital signatures; they further argue that by precluding other technologies future innovations will be discouraged. They also note that public key cryptography can only be implemented using patents owned by a limited number of commercial entities, and question whether it is wise public policy to legislatively tie electronic commerce so closely to the interests of a few private sector actors. 5. Should legislation endorse the X.509 paradigm? When the Utah Act was enacted, it explicitly endorsed the X.509 infrastructure model. Subsequent laws have dropped the explicit endorsement of X.509, but nonetheless remain true to the X.509 paradigm. Under most digital signature legislation, certificates serve to bind an individual's *identity* to a particular public key. This binding is accomplished in the context of a rigid, hierarchical CA infrastructure. This model has been criticized for two main reasons: global CA hierarchies are almost certainly unworkable, and identity certificates often provide too much information -- frequently an "attribute" or "authority" certificate will do. Alternative certificate formats, such as SDSI and SPKI, have emerged in response to these and other perceived flaws with the X.509 model. However, it is not clear that these alternative certificate formats can be accommodated under current digital signature legislation. 6. How should liability and risk be allocated in a PKI? Liability allocation promises to be a vexing problem in a PKI. The liability issue is most dramatic in the context of fraud. An impostor can obtain the private encryption key associated with a particular party and create electronic documents purporting to be from that party. A second party may enter into an electronic contract relying on these ostensibly valid documents, and a loss may occur. Who should bear this loss? In the paper world, generally one cannot be bound by a fraudulent signature. This principle may not be entirely appropriate in an electronic context, however. In a PKI, the integrity of the infrastructure depends upon the security of private encryption keys. If a key holder bears no liability for fraudulent use of that private key, perhaps he or she may not have adequate incentive to keep the private key secure. How much liability should the private key holder bear? Under the Utah Act and its progeny, an individual who negligently loses control of their private key will bear unlimited liability. This risk allocation scheme raises the specter of consumers facing immense losses -- as one commentator puts it: "Grandma chooses a poor password and loses her house." In contrast, consumer liability for negligent disclosure of a credit card number is generally limited to $50. If consumer liability were similarly limited in a PKI, where would the risk of loss fall? If CAs had to act as an insurer in all transactions, the price of certificates would likely be extraordinarily high. If relying third parties faced the risk that ostensibly valid documents may in fact be forgeries and bear any resulting loss, then some benefits of a PKI are lost. 7. What mechanisms should be used to allocate risk? Currently at least one commercial certification authority, VeriSign, is attempting to allocate risk to both certificate subjects and relying third parties by contract. VeriSign includes significant warranty disclaimers, liability limitations, and indemnification provisions in its Certification Practices Statement (CPS). Certificate applicants agree to be bound by the CPS when obtaining a certificate. VeriSign's web page informs relying third parties that the act of verifying a certificate or checking a certificate revocation list indicates agreement to the terms of the CPS. However, it is not clear that a binding contract can be formed with relying third parties in this fashion. Thus the relationship between VeriSign and relying parties may not be governed by the CPS at all, but instead be subject to default contract and tort rules (which would be less favorable to VeriSign). As a policy matter, should CAs be able to form contracts with relying third parties, despite their rather attenuated connection? If relying parties will be bound by unilateral contracts imposed by CAs, they face significant transaction costs involved with determining the contract terms offered by potentially numerous CAs. If CAs cannot scale their potential liability exposure to third parties by contract, however, it may be impossible for CAs to compete on warranty terms -- and presumably such terms would otherwise be the subject of significant competition. 8. Should digitally-signed documents be considered "writings" for all legal purposes? The Utah Act and most other digital signature laws provide that digitally signed documents have the same legal effect as writings. Critics have noted that while most of the functions or goals of writing requirements may be served by electronic documents, this may not be true in all instances. For example, the law often requires a written instrument to effect notice -- i.e., to alert an individual that a lien has been filed on their property. It is not clear that a digitally signed electronic message would achieve the same effect. Additionally, there are other contexts -- such as wills or adoption papers -- where paper documents may prove more effective than electronic documents. Moreover some paper documents (such as bank drafts or warehouse receipts) are negotiable instruments, and this negotiable character depends upon the existence of a single, irreproducible copy of the document. Thus, critics say, digital signature legislation should not override all writing requirements without separately considering the extent to which sound policy might require retention in specific circumstances. 9. How much evidentiary weight should a digitally-signed document carry? Evidentiary issues, though seemingly arcane and procedural, can raise important public policy concerns. For example, the Utah Act creates a presumption that the person who owns a particular key pair used to sign a document in fact did sign the document. Holding an individual presumptively bound by obligations entered into under their digital signature could be inequitable if the individual is the victim of the fraudulent use of such a signature. This potential problem can be compounded by the evidentiary weight assigned to digitally-signed documents. Under the Utah Act digitally-signed documents are accorded the same evidentiary weight as notarized documents, and someone challenging the authenticity of such a document can overcome the presumption of authenticity only with "clear and convincing evidence" (in contrast, one can overcome the presumption of validity of a paper signature simply by denying that it is one's signature). Critics of the Utah Act's approach argue that providing digitally-signed documents with this status creates unreasonable evidentiary burdens for victims of fraud challenging the validity of electronic documents signed with the victim's private key. 10. Should governments act as CAs? Much of the currently enacted digital signature legislation envisions state government agencies acting as "top level" certification authorities who in turn certify a second tier of private sector CAs. At the federal level, the U.S. Postal Service has declared its intention to act as a CA on a nationwide basis. Should governments be acting in this sort of role? Critics say no, arguing that government involvement will skew an emerging private sector CA marketplace. Government actors may face very different liability rules than private sector market participants -- governments can choose to scale their potential liability exposure through the doctrine of sovereign immunity. Thus, critics argue, government CAs may "win" in the marketplace not because they are more efficient or provide better service, but rather because they can stack the rules in their favor. Proponents of government involvement argue that governments can play an important role precisely because they can create sensible ground rules for all PKI participants. Additionally, they note that governments have existing relationships with all of their citizens, making the process of identification and public key binding that much easier. ---------------------------------------------------------------------------- -------------- * Brad Biddle is the author of "Misplaced Priorities: The Utah Digital Signature Act and Liability Allocation in a Public Key Infrastructure," which appears in Volume 33 of the San Diego Law Review, and serves as Vice Chair of the Electronic Commerce Subcommittee of the American Bar Association's Committee on the Law of Commerce in Cyberspace. He is a third-year law student at the University of San Diego and is a law clerk in Cooley Godward LLP's San Diego office, where he served on the legal team advising the Internet Law and Policy Forum's Working Group on Certification Authority Practices. He can be contacted by phone at (619) 550-6301 or by e-mail at biddlecb(a)cooley.com. _________________________________________________ _________ o s b o r n e @ g a t e w a y . g r u m m a n . c o m _________ Most obscure warning: If you fork() without ever waiting on your children, you will accumulate zombies. -PERLFUNC man page

2 1

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

RE: Fighting the cybercensor
by Sean Roach 17 Dec '03

17 Dec '03

This time I have opted for a point by point. At 07:59 PM 2/5/97 -0800, jim bell wrote: ... >The kind of effects I'm thinking of are primarily the "military spending" >situations, where: > >1. Large numbers of potentially competent and useful people get put into >useless jobs: "Army, Navy, and Marines, and Air Force" spring to mind. >(Those people who still think military spending is really necessary >obviously haven't read AP.) This point I can not argue with, at least not directly. I do believe that the military way is wasteful of resources. However, this is one area that has actually benefitted the lower-income bracket in that it gives them "inexpensive" (off-chance of death) access to good training. >2. Large amounts of money are spent on military hardware, money which goes >to fund people who would otherwise develop useful products in the >non-government private sector. Three things that promote technological growth, expansion, war, threat of war. As for expansion. we really have no where else to go. As for war and threat of war, the computer was invented during a war, atomic energy was harnessed during war, the internet was created during threat of war. Many advancements, though not all, come to benefit society later. For that matter, steel was probably invented during a war as well, but I can't prove it. >3. The patent system decreases competition, increases profits and prices in >the marketplace due to government actions to allow and enforce monopolies. The patent system gives the innovator a reward for ingenuity, that person can decide what to do with the invention for a short period of time, after which it becomes available to all. (BTW I really think that computer code should be copyrighted and not patented, this allows others to reproduce the work independantly without repercussions, gives the necessary protection, makes it more obviously a form of speech.) >4. Government employees are paid more for their activities than they would >receive in the private sector. Ironically, in this case an >"apples-to-apples" comparison is misleading: It would be wrong to compare a >middle level government manager to his counterpart in private industry, >because to postulate there is such a government-job assumes that the >private-sector would do it post-AP. To this I can't argue, business is certainly leaner than government. Of course most desert plants are more robust than their resource-wasteful wetland counterpart. Where there is a near-bottomless supply of material, as in taxes, true streamlining really doesn't happen. Remember, the automobile really didn't become anywhere near fuel-efficient until after the energy crisis. > >>If you are right then governments would effectively lose the ability to tax, >>with or without representation, as most people do not agree on everything, >>like how their money is spent. However, even now, as pointed out in some >>recent posts, our tax money is used to foreward the goals of a few, these >>few want to eliminate guns, crypto, free speech, ect. Although we are in >>oppostition, our money is still used to foreward the goals. > >Yes, the main effect of AP is the elimination of the ability to tax. Now, >nothing would prevents individuals from continuing to fund an organization >called a "government" so that it could do those (non-coercive) things that >individual wants to see done. But I think it'll be amazing how many of >those heretofore-funded-by-govt projects (previously promoted as being >wanted by a large fraction of the citizenry) that evaporate when the public >is given the option to continue to fund them voluntarily. > > >Let's suppose, hypothetically and for vast simplification, the government >engages in two activities, "A" and "B." Further suppose government taxes >from two groups, let's call them "Alphas" and "Betas." It is traditionally >thought that Alphas like spending on "A", but hate spending on "B". >Likewise, it is figured that Betas like spending on "B", don't like spending >on "A". > >Post-AP, one might innocently suspect that maybe the "Alphas" would simply >fund only "A", while Betas" would donate money for activity "B". Assuming >the amount of funding for those activities was equal, you might think that >things could go on as they already do. But no. The reality is that >"Alphas" merely like spending on "A" _more_ than they do "B", and they will >tolerate their own money being used for both only because the "Betas" are >similarly forced. Add volunteerism to the whole mix, and not only would >these two groups only fund just what they really wanted, they would soon >discover they don't even want the level of spending they previously argued >for, pre-AP. As it is, the "A" group, that's not us, is being promoted with virtually all of the capitol, the "B" group, us, is being attacked in policy and attempts are being made to keep us from getting any bigger. ...

1 0

Re: ITAR and Paper ROM
by jim bell 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >>Given that high-density inkjet printers can do 600x600 dpi resolution, it >>should be possible to achieve the equivalent of 100x100 bpi of >>easily-recoverable data on ordinary paper. That's about 800 kilobits, or >>100 kilobytes. What does ITAR say about this? > >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. In these investigations I used matricies of >small (1-3 mm) squares of gray (16 levels) or color (64 levels) with a mind >to replace diskettes for inexpensive mass data distribution. I was able to >reliably get 100-200 KB/page side using standard offset printing. With >modern ink-jet/laser printers you should be able to reliably get at least >10-50KB/page side. Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a few >years earlier. It seems to me that the main impediment to doing this in the middle 1980's was the lack of inexpensive scanners. But the utility of a system like this has, unfortunately (?) or perhaps fortunately, probably been killed by the Internet. Today, a magazine or newspaper can merely post a short pointer to a website including an FTP, or something similar. True, that doesn't guarantee the availability of the data years later, but... Jim Bell jimbell(a)pacifier.com

1 0

[NOISE] Sphere packing
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dimwit Virus K[rust]OfTheMonth styles his facial hair to look more like pubic hair. (___) (o o)_____/ @@ ` \ Dimwit Virus K[rust]OfTheMonth \ ____, / // // ^^ ^^

1 0

[PGP] Cats out of bags
by winsock＠rigel.cyberpass.net 17 Dec '03

17 Dec '03

Dr.Destitute Violent K[arcinogen]OTM is so in love with himself, he cries out his own name when orgasming. Then again, no one else is ever around. /\ /\ + \______/ + / . . \ < / > Dr.Destitute Violent K[arcinogen]OTM \ \--/ / ------

1 0

Tapping these resources.
by WIZZYH2H＠aol.com 17 Dec '03

17 Dec '03

I noticed that there are several programs that will let anyone send encrypted email. What about encrypted messages over a chat system like irc, chat rooms(aol, BBS) and systemwide messages (IM, whisper, private message)? The server wouldn't have to do anything except send the messages, the users software could handel all the protocols and message identification. Dialup and logon features aren't needed either, allmost all cilents will let you shell. I have been looking for, and tring to write a program to do this, but Im a rookie programmer and my attempts have yet to produce a functional send/receive utility. Where are programs like this.. are there any to be found? wizzyh2h(a)aol.com OR wizzy(a)juno.com

1 0

Re: Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:09 PM 2/5/97 -0500, Robert Hettinga wrote: >In the meantime, if you're interested in e$, or financial crypto, or other >stuff I'm interested ("it don't say e$pam until Bob says it says e$pam" >:-)), you might want to check it. I think that Bob's e$ list should be considered a viable alternative to the other two filtered cpunks lists; I recommend it to people looking for a moderated alternative to the list. (I get e$, but use Eudora and procmail to suck out the duplicates where messages are copied from lists I already get.) He also finds a lot of the stuff that used to show up on cpunks but doesn't any more because people have wandered away. I've been meaning to write up a long message explaining why I think I'm about to drop off of the list. It's peculiar to spend a lot of time discussing things with a group of people over the course of several years and then disappear without saying why. But I'm having trouble coming up with anything more profound than "it's not interesting any more." Philosophically, I agree with Lucky - it looks to me like it's time to kill the list and move on to other things. But that's not my choice to make, and perhaps other people can still extract something useful from this. More power to them if they can. I'm starting to think that cpunks may be similar to college, in that it's a good thing for a few years, but if you stick around too long you just get bitter and cranky and frustrated because the new people keep talking about the same old problems. Don't they know we've already talked about that? -----BEGIN PGP SIGNATURE----- Version: 4.5 iQEVAgUBMvmSHP37pMWUJFlhAQGu3Qf/WTpImfcNb4883V2h/JHKsZh1hWR+hrSH e7hgtUAujphktzteZi6NqC47QEQHRIbgT/SRHelDB4lJLPv3TtIN09ZUwK6GWb/F QfmoyPXBVfM5Pt/FqPqtPpXnehC7r71SO0jQ2qKqTrhcuSDYNmOjtCrjK/BIEJ7l mMYcxY7JKBq0H8u1BNzZaMfCkEvDytUejgsevusWGGfkwodUSTon81Kbxmy7Yg2w 3vOmESgMz2Vm2av2bHTYBy3CSy3JzB8m2OPQo+Wang6WJDfvJaDaALGuHgem8PH8 0jCjBww2vEOJ0xj62oQ/mD2heEe+TZZnDZ5ZRynID1wOOm7SOOOeAg== =+SRl -----END PGP SIGNATURE----- -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

2 1

Re: pgpmail 4.5
by Alex de Joode 17 Dec '03

17 Dec '03

Huge Cajones Remailer sez: : you wrote: : There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. : The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. : i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b : can someone clear this up? [usura@basement]:/pub/ftp/pub/crypto/incoming {22}$ md5 pgpmail45.exe 5ea438501d0133f0849c2fe8f9125b6b pgpmail45.exe -- -AJ-

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

bite your penis. /_/\/\ \_\ / Tim C[reep] May /_/ \ \_\/\ \ \_\/

1 0

Re: About: My Departure, Moderation, and "Ownership of the List"
by Ben 17 Dec '03

17 Dec '03

> > > User of the list, has no place to talk. His type, to me, > > > Characterate those who quit something and complain later, > > > Knowing that some people will listen to them. > > > > > > So what, if he decided to leave? It was his own choice > > > And he can't just come back and say everyone who stayed is > > > Now impelled to listen to him, just because he used to > > > Do a bunch of posts. I don't think that hardly any of > > > You would listened to me later if I left the list. > > I write good englich, but I write it verticaly, not horizontaly. > Try reading the above up-to-down, just the first letters of > each line. > It may be kindegarten crypto, but it made it onto the censored > list. Ahh...Sorry for the flame. You're obviously not a native English speaker(the Canadian address belies your origins). Native English speakers however have no right to poor English. PS: The word you want is STILL characterize. Ben. ____ Ben Samman..................................................ben(a)edelweb.fr Paris, France Illudium Q36 Explosive Space Modulator

2 1

[NOISE] Sphere packing
by WinSock Remailer 17 Dec '03

17 Dec '03

Dimwit Virus K[rust]OfTheMonth styles his facial hair to look more like pubic hair. (___) (o o)_____/ @@ ` \ Dimwit Virus K[rust]OfTheMonth \ ____, / // // ^^ ^^

1 0

[PGP] Cats out of bags
by WinSock Remailer 17 Dec '03

17 Dec '03

Dr.Destitute Violent K[arcinogen]OTM is so in love with himself, he cries out his own name when orgasming. Then again, no one else is ever around. /\ /\ + \______/ + / . . \ < / > Dr.Destitute Violent K[arcinogen]OTM \ \--/ / ------

1 0

Tapping these resources.
by WIZZYH2H＠aol.com 17 Dec '03

17 Dec '03

I noticed that there are several programs that will let anyone send encrypted email. What about encrypted messages over a chat system like irc, chat rooms(aol, BBS) and systemwide messages (IM, whisper, private message)? The server wouldn't have to do anything except send the messages, the users software could handel all the protocols and message identification. Dialup and logon features aren't needed either, allmost all cilents will let you shell. I have been looking for, and tring to write a program to do this, but Im a rookie programmer and my attempts have yet to produce a functional send/receive utility. Where are programs like this.. are there any to be found? wizzyh2h(a)aol.com OR wizzy(a)juno.com

1 0

Re: ITAR and Paper ROM
by Bill Stewart 17 Dec '03

17 Dec '03

At 09:26 AM 2/5/97 -0800, Steve Schear wrote: >I'm not sure if what I did in the 80s, trying to create what I called >'paper ROM, is applicable. [....] >to replace diskettes for inexpensive mass data distribution. > Although a technical success, I abandoned the effort >when I discovered someone had patented (4,488,679) something similar a >few years earlier. Yeah, our patent office is so helpful - granting a patent for "Storage of Information By Making Marks On Paper" :-) You'd think they'd recognize a few thousand years of prior art..... Xerox also has a similar patent; their method uses little diagonals to encode data in. ///\\\/// It really _isn't_ called "cuneform". More practically, sort of, there was the Cauzin Softstrip Reader, which cost about $200 and held enough data to distribute programs back when computers and programs were much smaller; a few PC magazines tried distributing programs by printing them in the back that way. Cute, but not cute enough to stick around very long. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk/pub/crypto/pgp # (If this is a mailing list, please Cc: me on replies. Thanks.)

2 1

Re: Moderation [Tim,Sandy]
by Dale Thorn 17 Dec '03

17 Dec '03

Dr.Dimitri Vulis KOTM wrote: > Dale Thorn <dthorn(a)gte.net> writes: > > > > The drunk can be excluded, but when someone wants to use the drunk as > > > > an example to escalate the exclusion to other persons who are not in > > > > fact drunk, watch out! > > > If I get really really drunk, which happens very seldom, then I'm > > > too drunk to post. I don't mind an occasional beer, though. > > > Oksas, have you ever tried beer? :-) > > I had my first beer(s) in three years at one of those industrial > > parties last night. It made the craps table action seem a bit > > merrier, and the girls were friendlier too. > I like an occasional Coors Lite. BTW I think Limey Faggots are right about > one think: I like room-temperature beer better than cold beer. YMMV. Interesting coincidence for people on opposite coasts - the bar at the hotel had two choices: Bud regular and Coors light. I took the Coors.

1 0

Re: John's: In anarchy -everyone responsible
by Dale Thorn 17 Dec '03

17 Dec '03

Attila T. Hun wrote: > on or about 970204:2343 jim bell <jimbell(a)pacifier.com> said: > +At 09:05 PM 2/4/97 +0000, Attila T. Hun wrote: > +> In a "popular" anarchy, Jim Bell's assassination politics make > +> perfectly good sense; but, a "popular" anarchy is not an _anarchy_. > +I guess I don't understand the distinction you are trying to make, > +between a "popular anarchy" and an "anarchy." Maybe you were trying > +to distinguish between "dictatorship of the few (or one)" and > +"dictatorship of the many (perhaps a majority)" but it didn't come out > +very understandably. Put simply, "anarchy is not the lack of order. > +It is the lack of _orders_." > disagree. pure anarchy is not the lack of "orders" --pure anarchy > implies that everyone is imbued with that perfect sense of responsibility. I don't know where these implications come from. Start with a primitive example, such as animals in the wild. Is that a perfect anarchy? Where do the differences come in for humans? Are they neo-religious perceptions, which could never find universal agreement? Or are they set in stone, in immutable, universal laws?

1 0

Re: John's: In anarchy -everyone responsible
by snow 17 Dec '03

17 Dec '03

> At 09:05 PM 2/4/97 +0000, Attila T. Hun wrote: > >on or about 970204:0312 Greg Broiles <gbroiles(a)netbox.com> said: > >+ Is the desire for an anarchic community at odds with a desire for > >+ good use of resources? > Actually, it is quite possible that an "anarchic community" is _more_ > efficient in the use of resources than some sort of organized community. > It is explained, for example, that the reason there are so many different > kinds of life on earth is that there are so many ecological niches to fill. Good does not necessarily mean efficient, and efficient does not necessarily mean good. Picture--if you can--the "perfect" centrally planned economy where all possible market conditions, wants and needs are taken into account. Factories are placed optimally for access to natural resources and distribution to consumers etc. Also assume that the people running this society _are_ intersted in efficient production methods, and activly look for new and better ways of getting things done--benign facism/socialism if you will. This would (assuming perfect people, but bear with me) be the _most efficient_ method of producing and delivering goods, but it would introduce certain "choke points", one natural disaster or war could cripple production of necessary items. Picture anarchy, massively redundant, and resistent to this problem, while probably not anywhere _near_ as efficient, this "system" would have the ability to absorb damage and adapt more rapidly to changing enviroments. > No, that's traditional thinking and that's wrong. See AP part 8. Freud > believed (as "everyone" else believed, even myself, before AP) that anarchy > was inherently unstable. But it ISN'T, if the tools of AP are used to Stable is a relative thing. Are things stable now? If you think so, you either aren't looking very hard, or you are giving "stable" a wide range.

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

bite your penis. /_/\/\ \_\ / Tim C[reep] May /_/ \ \_\/\ \ \_\/

1 0

Re: pgpmail 4.5
by Alex de Joode 17 Dec '03

17 Dec '03

Huge Cajones Remailer sez: : you wrote: : There is a pgpmail45.exe at ftp.hacktic.nl/pub/replay/pub/incoming. : The file has an md5 sum of 'ffd56d7647c30152a5c9fe7616a3d9ef'. : i downloaded the same. md5 5ea438501d0133f0849c2fe8f9125b6b : can someone clear this up? [usura@basement]:/pub/ftp/pub/crypto/incoming {22}$ md5 pgpmail45.exe 5ea438501d0133f0849c2fe8f9125b6b pgpmail45.exe -- -AJ-

1 0

Re: "alt.cypherpunks" people?
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

"Dr.Dimitri Vulis KOTM" <dlv(a)bwalk.dm.com> writes: > Anil Das <das(a)sgi.com> writes: > > > Dr.Dimitri Vulis KOTM wrote: > > > > > > Learn to use an anonymous remailer. > > > > Thanks for the hint, Dr. Vulis. I have registered for a course, but > > seats are available only in fall. > > Toilet seats in the state of free fall? > > The stego on Sandy's moderated list blows my mind... And Sandy blows Sameer, and Greg blows John... --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: About: My Departure, Moderation, and "Ownership of the List"
by Ben 17 Dec '03

17 Dec '03

> > > User of the list, has no place to talk. His type, to me, > > > Characterate those who quit something and complain later, > > > Knowing that some people will listen to them. > > > > > > So what, if he decided to leave? It was his own choice > > > And he can't just come back and say everyone who stayed is > > > Now impelled to listen to him, just because he used to > > > Do a bunch of posts. I don't think that hardly any of > > > You would listened to me later if I left the list. > > I write good englich, but I write it verticaly, not horizontaly. > Try reading the above up-to-down, just the first letters of > each line. > It may be kindegarten crypto, but it made it onto the censored > list. Ahh...Sorry for the flame. You're obviously not a native English speaker(the Canadian address belies your origins). Native English speakers however have no right to poor English. PS: The word you want is STILL characterize. Ben. ____ Ben Samman..................................................ben(a)edelweb.fr Paris, France Illudium Q36 Explosive Space Modulator

1 0

Re: Moderation [Tim,Sandy]
by Dr.Dimitri Vulis KOTM 17 Dec '03

17 Dec '03

Dale Thorn <dthorn(a)gte.net> writes: > Dr.Dimitri Vulis KOTM wrote: > > Dale Thorn <dthorn(a)gte.net> writes: > > > > > > The drunk can be excluded, but when someone wants to use the drunk as > > > > > an example to escalate the exclusion to other persons who are not in > > > > > fact drunk, watch out! > > > > > If I get really really drunk, which happens very seldom, then I'm > > > > too drunk to post. I don't mind an occasional beer, though. > > > > > Oksas, have you ever tried beer? :-) > > > > I had my first beer(s) in three years at one of those industrial > > > parties last night. It made the craps table action seem a bit > > > merrier, and the girls were friendlier too. > > > I like an occasional Coors Lite. BTW I think Limey Faggots are right about > > one think: I like room-temperature beer better than cold beer. YMMV. > > Interesting coincidence for people on opposite coasts - the bar at > the hotel had two choices: Bud regular and Coors light. I took the > Coors. I remember when one had trouble getting Coors in NY: had something to do with their giving $$ to the Nicaragua contras and upsetting the politically correct distributors. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: About: My Departure, Moderation, and "Ownership of the List"
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, On Thu, 6 Feb 1997, Ben wrote: > > > > User of the list, has no place to talk. His type, to me, > > > > Characterate those who quit something and complain later, > > > > Knowing that some people will listen to them. > > > > > > > > So what, if he decided to leave? It was his own choice > > > > And he can't just come back and say everyone who stayed is > > > > Now impelled to listen to him, just because he used to > > > > Do a bunch of posts. I don't think that hardly any of > > > > You would listened to me later if I left the list. > > > > I write good englich, but I write it verticaly, not horizontaly. > > Try reading the above up-to-down, just the first letters of > > each line. > > It may be kindegarten crypto, but it made it onto the censored > > list. Touche! S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: Deloitte-Touche, e$pam plug, Moderation, Cypherpunks as a cresote bush
by Dale Thorn 17 Dec '03

17 Dec '03

Greg Broiles wrote: > At 09:09 PM 2/5/97 -0500, Robert Hettinga wrote: > I've been meaning to write up a long message explaining why I think I'm about > to drop off of the list. It's peculiar to spend a lot of time discussing > things with a group of people over the course of several years and then > disappear without saying why. But I'm having trouble coming up with anything > more profound than "it's not interesting any more." Philosophically, I agree > with Lucky - it looks to me like it's time to kill the list and move on to > other things. But that's not my choice to make, and perhaps other people can > still extract something useful from this. More power to them if they can. > I'm starting to think that cpunks may be similar to college, in that it's a > good thing for a few years, but if you stick around too long you just get > bitter and cranky and frustrated because the new people keep talking about > the same old problems. Don't they know we've already talked about that? But college continues because it wasn't designed for just one group of people of one time period. It was designed for everyone, and to evolve to meet future need. If the c-punks list were to survive, it too would have to evolve to meet future needs, and that evolution would be sure to disappoint a lot of the older crowd. The big difference here is that college is far from cutting edge in anything, and the list is (or could be) cutting edge. But nearly everyone so far has acknowledged that, despite improvement in signal- to-noise on the moderated list, the factor of external control has also removed much of what was interesting. Remove the control and incorporate the best of the suggestions that have been made so far, and some of that interest may return. Perhaps more importantly, if the principals could see their way to mend some fences along the way, that would restore even more confidence in the list.

1 0

Re: [RRE FWD] PKI: 10 Public Policy Questions
by Michael Froomkin - U.Miami School of Law 17 Dec '03

17 Dec '03

For a more, um, nuanced view see http://www.law.miami.edu/~froomkin/articles/trusted.htm == The above may have been dictated via Dragon Dictate 2.51 voice recognition. Please be alert for unintentional word substitutions. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

NOW_ire
by John Young 17 Dec '03

17 Dec '03

2-5-97: "FCC Bandwidth Forum Panelist Says Wireless Is Potential 'Wild Card' in Planning for Future Broadband Access" Suggests that wireless is the better than wire, cable, or satellite for future communications by bypassing their technological and environmental limitations. "GTE Wireless Launches Long-Anticipated CS-CDPD Service; Other Cellular Carriers Continue to Reject Hybrid Approach" A variation from CDMA and TDMA. ----- NOW_ire And the FCC Broadband Forum report cited in the first article at: http://jya.com/fcc970123.htm (322K)

1 0

Cypherpunks spread chain letters
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Now the punks are sending me "good luck" letters... What a bunch of losers. No wonder they bend over for Gilmore. > St. Jude > > Kiss someone you love when you get this letter and make magic. This > paper was sent to you for good luck. The original copy is in New England. I > has been around the world nine times. The Luck has been sent to you. You > will receive good luck in four days. This is no joke. You will receive it i > the mail. send copies to people that you think need good luck. Don't send > money as fate has no price. Do not keep this letter. It must leave your > hands in 96 hours. An Air Force officer received $70,000 in four days. Joe > Elliot received $40,000 and lost it because he broke the chain. While in the > Philippines, Gene Wolf lost his wife six days after receiving this letter. H > failed to circulate the letter. However, before he death, she won $50,000 in > a lottery. The money was transferred to him four days after he decided to > mail this letter. Please make twenty copies of this letter and see what > happens in four days. The chain comes from South Venezuela and was written b > Saint Anthony Decroc, a missionary from South America. Since the copy must > make a tour of the world, you must make twenty copies and send them to your > friends and associates. After a few days you will get a surprise. This is > true even though you are not superstitious. So note the following: > Constantine Dens received the chain in 1958. He asked his secretary to make > twenty copies and send them out. A few days later he won the lottery of 2 > million dollars. Andy Doddit, and office employee, received a letter and > forgot it had to leave his hands within 96 hours, he lost his job. Later, > after finding the letter again, he mailed out twenty copies. A few days late > he got a better job. > Please send no money. Please don't ignore this. IT DOES WORK. > > > > St. Jude > > Kiss someone you love when you get this letter and make magic. This > paper was sent to you for good luck. The original copy is in New England. I > has been around the world nine times. The Luck has been sent to you. You > will receive good luck in four days. This is no joke. You will receive it i > the mail. send copies to people that you think need good luck. Don't send > money as fate has no price. Do not keep this letter. It must leave your > hands in 96 hours. An Air Force officer received $70,000 in four days. Joe > Elliot received $40,000 and lost it because he broke the chain. While in the > Philippines, Gene Wolf lost his wife six days after receiving this letter. H > failed to circulate the letter. However, before he death, she won $50,000 in > a lottery. The money was transferred to him four days after he decided to > mail this letter. Please make twenty copies of this letter and see what > happens in four days. The chain comes from South Venezuela and was written b > Saint Anthony Decroc, a missionary from South America. Since the copy must > make a tour of the world, you must make twenty copies and send them to your > friends and associates. After a few days you will get a surprise. This is > true even though you are not superstitious. So note the following: > Constantine Dens received the chain in 1958. He asked his secretary to make > twenty copies and send them out. A few days later he won the lottery of 2 > million dollars. Andy Doddit, and office employee, received a letter and > forgot it had to leave his hands within 96 hours, he lost his job. Later, > after finding the letter again, he mailed out twenty copies. A few days late > he got a better job. > Please send no money. Please don't ignore this. IT DOES WORK. > > > > --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

True story, Fly the Obsfucted Skies (fwd)
by Ray Arachelian 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Thu, 6 Feb 1997 00:18:18 -0500 From: Salvatore Denaro <sal(a)panix.com> To: 'Ray Arachelian' <ray(a)earthweb.com> Subject: True story, Fly the Obsfucted Skies I was at the airport, checking in at the gate. An airport employee asked me (and I quote) "Has anyone put anything in your baggage without your knowledge?" I thought about it. I scratched my goatee. I said: "If it was without *my* knowledge... how would *I* know about it?" He smiled. He nodded his head, knowingly. He then gave me this cryptic reply, "That's why we ask." -- Salvatore Denaro "The only difference between me and a madman sal(a)panix.com is that I am not mad." -- Salvador Dali

1 0

FinCEN hates cybercash, who 'da thunk it...
by Derrick Storren 17 Dec '03

17 Dec '03

Big brother, Morris, at FinCEN sees a criminal behind every cyber dollar. The sky is falling, the sky is falling, it's raining cyber cash! Artilce follows :) ****************** _G7 groups frets over electronic money laundering_ Copyright © 1997 Nando.net Copyright © 1997 Agence France-Presse PARIS (Feb 6, 1997 11:30 a.m. EST) - Money-laundering fighters from key industrial countries and leading Asian financial centers are looking into ways of countering use of the Internet and "smart cards" to clear proceeds from criminal activities, officials said Thursday. The Financial Action Task Force (FATF), set up following a Group of Seven initiative at their l989 summit, called in a lengthy report for closer cooperation and coordinated efforts to fight money laundering, especially in regard to new electronic payments technologies. The report noted that these technologies were still "in their infancy" and said it was "premature to consider prescriptive solutions to theoretical problems." But Stanley Morris of the United States Treasury, who chaired a FAFT working group which drafted the report, told a news conference that law enforcement agencies would face 'very major new challenges' if new technology moves the world "to a cashless society, beyond banks, cash and borders." He said the group's meeting, held in Paris last November, was the first time an international organization has examined "the implications of e-money - electronic money - or cyber payments." The group had for the first time examined "not only criminal activity as we see it" at present, but "what kind of crominal activites might occur as we approach the new payments technologies relying on the revolution in microchips and .. changes in payments services generally." Morris, who heads the U.S. Treasury's Financial Crimes Enforcement Network (FinCEN), said cash had become "a significant problem" for criminal groups, which find it increasingly difficult to channel their criminal proceeds into the banking system, at least in FATF countries. "We find a clear move away from direct dealing with banks to non-bank institutions, including bureaux de change money order sellers, and even professional services like lawyers and accountants," he said. The group had also seen "the realities of economic globalization," he said, adding that financial activities are "poorly controlled by the nation states." Morris said the working group had therefore invited representatives of the high technology industry now working on the new payments technology which was still "in the prototype stage" without any clear indication as to the direction they might take. "We wanted to sit down with the industry as experts on money laundering enforcement.... to let them know now what kinds of systems would cause us problems and give the bad guys new opportunities," he said. The purpose was to seek to encourage development of these technologies "in ways that do not provide a new forum for money laundering," he said. The FATF was essentially a preventive business, Morris added. "We do not measure our success simply on arrests and (money) seizures." FATF chairman Fernando Carpentieri, the Director General of the Italian Treasury, said drug trafficking remained a key source of criminal proceeds which crime groups were seeking to "legalize." He said the Task Force, consisting mainly of OECD member countries, as well as Hongkong, Singapore, the Gulf Cooperation Council and the European Commission, was not at present considering admitting further members to preserve its efficiency. But it was working with the authorities of countries throughout the world to secure the broadest possible implementation of the anti-money laundering measures it has recommended.> G7 groups frets over electronic money laundering

1 0

Blessing in Disguise? (H.R. 98, the "Consumer Internet PrivacyProtection Act of 1997")
by Robert Hettinga 17 Dec '03

17 Dec '03

This attempted legislation (see forward, below) is a blessing in disguise. It's just more proof that book-entry commerce isn't going to work on the net in the long run. SET looks like it's having problems with Japanese commerce rules, which is another example of this problem. Cash settlement between blinded pseudonyms fixes all of these problems. I like to joke that if digital commerce is flight, then book entry settlement is Boyle's Law, and cryptography is Bernoulli's law, viz, + Sending a credit card in the clear is jumping off a cliff. The height of the cliff you jump off is related to the number of times you send an unencrypted credit card number and the amount you charge. Credit card companies aren't going to be guaranteeing all those trades much longer if they lose too much money. + First Virtual is a tethered balloon. You're up in the air, but you don't know what for, because all the action is happening on the ground. ;-). + SET, Cybercash/coin, SSL, and other encrypted-channel book entry methods, is a derigeble. You're flying, but you're using minimally strong crypto like little aerodynamic fins to push the giant gas bag of book-entry settlement around. + Digital bearer certificate technology, like ecash, or MicroMint, or Millicent, is an airplane. It "flys" with "wings" of strong cryptography, which gives us reputation capital and enforcement, and instantly settled microintermediated transactions. Thus, like aerodynamic flight, it will be faster, cheaper, and easier to use than book-entry "derigible" transaction methods. Cheers, Bob Hettinga --- begin forwarded text Date: Thu, 6 Feb 1997 11:24:09 EST Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: "Jonathan I. Ezor" <jezor(a)NEWMEDIALAW.COM> Subject: Congressional Bill worse for 'Net than CDA? (crosspost) Comments: To: wwwac(a)echonyc.com, noend(a)laguna.taos.com, isales(a)mmgco.com, imarcom(a)internet.com To: CYBERIA-L(a)LISTSERV.AOL.COM Sorry for the crossposting, but I felt this one might be important enough to do it. The following is a shortened version of an article I've written for my firm's client newsletter about H.R. 98, the "Consumer Internet Privacy Protection Act of 1997", introduced by Rep. Bruce Vento (D. MN) on January 7, 1997. As the article describes, if the bill were enacted as drafted, Internet commerce could conceivably be stopped dead in its tracks, along with most of the reduced-fee-for-demographics online services. Privacy is quite important, and many of us have worked and are working extremely hard to protect privacy appropriately while still providing convenient services to users, but this bill is way beyond a reasonable approach. I haven't seen much discussion about this bill, but it's now in committee, and the time to act may be upon us. Feel free to e-mail/call/fax/talk to me with any further questions. I look forward to your feedback. {Jonathan} Jonathan I. Ezor New Media Attorney, Davis & Gilbert, 1740 Broadway, New York, NY 10019 Tel: 212-468-4989 Fax: 212-468-4888 E-mail: jezor(a)newmedialaw.com -----------------------------Cut here------------------------------- Congress Tackles Internet Privacy Recently, there has been significant press coverage over real and rumored revelations of personal information such as Social Security numbers by online services, including the alleged availability (later shown to be untrue) of mothers' maiden names and Social Security numbers on LEXIS' P-Trak database, and various governmental bodies have held hearings on issues of online privacy. On January 7, 1997, Representative Bruce F. Vento (D. MN) introduced the "Consumer Internet Privacy Protection Act of 1997," (H.R. 98) This bill provides that "an interactive computer service shall not disclose to a third party any personally identifiable information provided by a subscriber to such service without the subscriber's prior informed written consent." It requires online services to provide an express opt-out for subscribers at any time, prohibits services from knowingly distributing false information about users, and also mandates giving subscribers access to the information maintained about them for review, updates and corrections, as well as the identity of the party receiving the information, at no charge. The bill authorizes the Federal Trade Commission to "to examine and investigate an interactive computer service to determine whether such service has been or is engaged in any act or practice prohibited by this Act," and to issue a cease and desist order. Notably, it also provides that an individual may sue the violator directly without having to go through the FTC. As a general matter, this bill enacts the practice of many online services and sites, and the position of most self-regulatory industry groups, by asking consent before revealing personally-identifiable information. But the bill goes well beyond the ordinary industry practice by requiring "prior informed written consent," which is defined in this bill as "a statement-- (A) in writing and freely signed by a subscriber; (B) consenting to the disclosures such service will make of the information provided; and (C) describing the rights of the subscriber under this Act." What this could conceivably mean is that services which have all of their registration online may be unable to fulfill this requirement. Additionally, the bill is unclear about which online services will be subject to its provisions. It defines "interactive computer service" as "any information service that provides computer access to multiple users via modem to the Internet." This certainly covers dedicated Internet service providers (ISP's) and combination proprietary/Internet services like America Online and MSN. The bill may also cover services which depend on their ability to reveal certain information to advertisers in exchange for offering free Internet e-mail to their users. Beyond that, purely Web-based services may fall into the purview of this bill, depending on whether providing access via modem requires that the modem dial directly into the service in question or not. Theoretically, this bill could even prevent online purchases absent a signed authorization form from each purchaser, because a service would have to reveal the name and address of the purchaser to the seller in order for the goods to be delivered. Even more troubling, the bill does not even provide an exception for information shared between a service owner and the company owning the computer hosting the service, regardless of whether there is a contractual obligation for confidentiality, since the hosting company has access to the information collected by the service about its users. As with other bills of this type, it is important for any company intending to offer Internet-related services to individuals to follow and perhaps attempt to affect the path of the Consumer Internet Privacy Protection Act of 1997, since it could have significant impact on planned services, revenue sources and per-subscriber costs. For those interested in forestalling this type of governmental action, the best response may be to accelerate self-regulatory initiatives to deal with the valid concerns of consumers who may be providing information about themselves and their buying habits, either in the process of registration or while using the service. At the same time, the self-regulatory bodies can create rules based on the actual business practices and realities of their members, rather than drafting with a broad brush as Congress does in so many instances. If companies are going to be able to take the greatest economic advantage of the interactivity of the Internet as opposed to traditional broadcast and print media, there needs to be some way of legally and ethically utilizing information provided by subscribers in order both to enhance the subscribers' experience and to gain revenue through appropriate business relationships with advertisers, retailers, and others who may wish access to consumers. Copyright 1997 Jonathan I. Ezor, Davis & Gilbert. All rights reserved. Jonathan I. Ezor is an attorney with Davis & Gilbert in New York City, practicing new media and computer law, focusing on the advertising industry. Mr. Ezor can be reached at jezor(a)newmedialaw.com. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "Never attribute to conspiracy what can be explained by stupidity." -- Jerry Pournelle The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/

1 0

revised FC97 program
by R.Hirschfeld＠cwi.nl 17 Dec '03

17 Dec '03

Financial Cryptography '97 February 24-28 1997, Anguilla, BWI PRELIMINARY PROGRAM (Revised 6 February 1997) General Information: Financial Cryptography '97 (FC97) is a new conference on the security of digital financial transactions. The first meeting will be held on the island of Anguilla in the British West Indies on February 24-28, 1997. FC97 aims to bring together persons involved in both the financial and data security fields to foster cooperation and exchange of ideas. Original papers were solicited on all aspects of financial data security and digital commerce in general. Program Committee: Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Rafael Hirschfeld (Program Chair), CWI, Amsterdam, The Netherlands Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Preliminary Conference Program for FC97: Monday 24 February 1997 800 -- 820 Breakfast 820 -- 830 Welcome 830 -- 905 Anonymity Control in E-Cash Systems George Davida (University of Wisconsin, Milwaukee, WI, USA), Yair Frankel (Sandia National Laboratories, Albuquerque, NM, USA), Yiannis Tsiounis (Northeastern University, Boston, MA, USA), Moti Yung (CertCo, New York, NY, USA) 905 -- 940 How to Make Personalized Web Browsing Simple, Secure, and Anonymous Eran Gabber, Phil Gibbons, Yossi Matias, Alain Mayer (Bell Laboratories, Lucent Technologies) 940 -- 1015 Anonymous Networking and Virtual Intranets: Tools for Anonymous Corporations Jim McCoy (Electric Communities, Cupertino, CA, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Unlinkable Serial Transactions Paul F. Syverson (Naval Research Laboratory, Washington, DC, USA), Stuart G. Stubblebine (AT&T Labs--Research, Murray Hill, NJ, USA), David M. Goldschlag (Naval Research Laboratory, Washington, DC, USA) 1120 -- 1155 Efficient Electronic Cash with Restricted Privacy Cristian Radu, Rene Govaerts, Joos Vandewalle (Katholieke Universiteit Leuven, Leuven, Belgium) 1155 -- 1230 The SPEED Cipher Yuliang Zheng (Monash University, Melbourne, Australia) 1230 -- 1330 Lunch 1800 -- 1930 Cocktail Reception (at Mariners Hotel) Tuesday 25 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Evaluating the security of electronic money; the view of a European central bank Simon L. Lelieveldt (De Nederlandsche Bank, Amsterdam, Netherlands) 930 -- 1005 Smart Cards and Superhighways The technology-driven denationalisation of money David G.W. Birch, Neil A. McEvoy (Hyperion, Surrey, England) 1005 -- 1045 Coffee Break 1045 -- 1120 Fault Induction Attacks, Tamper Resistance, and Hostile Reverse Engineering in Perspective David P. Maher (AT&T Labs--Research, Murray Hill, NJ, USA) 1120 -- 1155 Some Critical Remarks on "Dynamic Data Authentication" as specified in EMV '96 Louis C. Guillou (CCETT, Cesson-Sevigne, France) 1155 -- 1230 Single-chip implementation of a cryptosystem for financial applications Nikolaus Lange (SICAN Braunschweig GmbH, Braunschweig, Germany) 1230 -- 1330 Lunch Wednesday 26 February 1997 800 -- 830 Breakfast 830 -- 930 Invited Speaker Ronald Rivest (MIT Lab for Computer Science, Cambridge, MA, USA) 930 -- 1005 Auditable Metering with Lightweight Security Matthew K. Franklin, Dahlia Malkhi (AT&T Labs--Research, Murray Hill, NJ, USA) 1005 -- 1045 Coffee Break 1045 -- 1120 SVP: a Flexible Micropayment Scheme Jacques Stern, Serge Vaudenay (Ecole Normale Superieure, Paris, France) 1120 -- 1155 An efficient micropayment system based on probabilistic polling Stanislaw Jarecki (MIT Lab for Computer Science, Cambridge, MA, USA), Andrew Odlyzko (AT&T Labs--Research, Murray Hill, NJ, USA) 1155 -- 1230 On the continuum between on-line and off-line e-cash systems - I Yacov Yacobi (Microsoft, Redmond, WA, USA) 1230 -- 1330 Lunch Thursday 27 February 1997 800 -- 830 Breakfast 830 -- 905 Towards Multiple-payment Schemes for Digital Money H. Pagnia, R. Jansen (University of Darmstadt, Darmstadt, Germany) 905 -- 940 Applying Anti-Trust Policies to Increase Trust in a Versatile E-Money System Markus Jakobsson (UCSD, La Jolla, CA, USA), Moti Yung (BTEC/CertCo, New York, NY, USA) 940 -- 1015 Cyberbanking and Privacy: The Contracts Model Peter P. Swire (Ohio State University, Columbus, OH, USA) 1015 -- 1045 Coffee Break 1045 -- 1120 Legal Issues in Cryptography Edward J. Radlo (Fenwick & West LLP, Palo Alto, CA, USA) 1120 -- 1230 Panel Discussion Legal Issues of Digital Signatures Michael Froomkin (U. of Miami School of Law, Coral Gables, FL, USA), Charles Merrill (McCarter & English, Newark, NJ, USA), Benjamin Wright (Dallas, TX, USA) 1230 -- 1330 Lunch 1930 -- 2015 Invited Speaker Money Laundering: Yesterday, Today and Tomorrow Peter Wayner (Baltimore, MD, USA) 2015 -- 2200 Rump Session Friday 28 February 1997 800 -- 830 Breakfast 830 -- 905 The Strategic Role of Government in Electronic Commerce Paul Lampru (Verifone, Atlanta, GA, USA) 905 -- 940 Using Markets to Achieve Efficient Task Distribution Ian Grigg, Christopher C. Petro (Systemics, Amsterdam, Netherlands) 940 -- 1015 The Gateway Security Model in the Java Electronic Commerce Framework Theodore Goldstein (Sun Microsystems Laboratories/Javasoft) 1015 -- 1045 Coffee Break 1045 -- 1120 Highly Scalable On-line Payments Via Task Decoupling David William Kravitz (CertCo LLC, Albuquerque, NM, USA) 1120 -- 1155 GUMP; Grand Unified Meta-Protocols Recipes for Simple, Standards-based Financial Cryptography Barbara Fox, Brian Beckman (Microsoft, Redmond, WA, USA) 1155 -- 1230 Secure Network Communications and Secure Store&Forward Mechanisms with SAP R/3 Bernhard Esslinger (SAP AG, Walldorf, Germany) 1230 -- 1330 Lunch Updates of the conference schedule will be available at the URL http://www.cwi.nl/conferences/FC97/. The conference will run from 8:30 AM to 12:30 PM for five days, February 24-28 1997. Breakfast and lunch are provided at the conference. The conference organizers have left the afternoons and evenings open for corporate sponsored events, for networking, and for recreational activities on the resort island of Anguilla. Participants are encouraged to bring their families. Workshop: A 40-hour workshop, intended for anyone with commercial software development experience who wants hands-on familiarity with the issues and technology of financial cryptography, is planned in conjunction with FC97, to be held during the week preceding the conference. For more information on the workshop, please see the URL http://www.cs.berkeley.edu/~iang/fc97/workshop.html. For workshop registration, see the URL http://www.offshore.com.ai/fc97/. Venue: The InterIsland Hotel is a small 14-room guest house and a large, comfortable 150 seat conference facility with additional space for a small 10-booth exhibition. The Inter-Island is on Road Bay, near Sandy Ground Village, in the South Hill section of Anguilla. The conference, workshop, and exhibition will have TCP/IP internet access. The rooms at the InterIsland itself have sold out, but there are many other hotels and guest houses on Anguilla, and shuttle service to the conference will be available. Air Transportation and Hotels: Air travel to Anguilla is typically done through either San Juan or St. Thomas for US flights, or St. Maarten/Martin for flights from Europe and the US. Anguillan import duties are not imposed on hardware or software which will leave the island again. There are no other taxes--or cryptography import/export restrictions--on Anguilla. Hotels range from spartan to luxurious, and more information about hotels on Anguilla can be obtained from your travel agent, or at the URL http://www.offshore.com.ai/fc97/. General Chairs: Robert Hettinga, Shipwright/e$, Boston, MA, USA; rah(a)shipwright.com Vincent Cate, Offshore Information Services, Anguilla, BWI; vince(a)offshore.com.ai Conference, Exhibits, and Sponsorship Manager: Julie Rackliffe, Boston, MA, USA; rackliffe(a)tcm.org Workshop Leader: Ian Goldberg, Berkeley, CA, USA; iang(a)cs.berkeley.edu Registration: You can register and pay for conference admission via the World Wide Web at the URL http://www.offshore.com.ai/fc97/. The cost of the FC97 Conference is US$1,000. Booths for the exhibition start at US$5,000 and include two conference tickets. For more information about exhibit space, contact Julie Rackliffe, rackliffe(a)tcm.org. Sponsorship opportunities for FC97 are still available. The cost of the workshop is US$5000, and includes meals but not lodging. You can register for the workshop, which runs the week prior to the conference, at the URL http://www.offshore.com.ai/fc97. Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. It is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.shipwright.com/rah/> C2NET <http://www.c2.net/> See Your Name Here <mailto: rackliffe(a)tcm.org>

1 0