December 2003 - cypherpunks-legacy

Re: more FUD!
by HaB 17 Dec '03

17 Dec '03

Hello. First time poster. Been reading for awhile now and I feel like a goof for having to ask, but what does FUD stand for anyway? Thanks... HaB

3 2

Sternbot on RSA
by Eric Cordian 17 Dec '03

17 Dec '03

Vin has now cloned his vigorous defense of the RSA patent to several Usenet newsgroups, posting his "summary" of the discussion. Sternlight now leaps in, to add his two cents worth. In talk.politics.crypto David Sternlight <david(a)sternlight.com> wrote: > I simply cannot believe the post by Cordian below. His argument seem to > be: Good morning, David. We've missed you on the Cypherpunks List. > 1. I am right and the court is wrong. No, David. Vin's argument is that since the patents were upheld in court, no knowlege of the specific algorithms or methods used to construct the patented entity pre-dated the work which led to the patent. In point of fact, such things do not automatically invalidate patents. Certainly the concept of trapdoor functions, their cryptographic utility, and that multiplication of primes was such a function, were known prior to the development of the RSA Public Key Cryptosystem. I vaguely recall that encipherment by modular exponentiation has also been published as an algorithm, albeit prior to the recognition that it had utility in constructing public key systems. > 2. I vaguely recall a paper that might have been prior art. Certainly the notion that the difficulty of factoring composites could be employed in the construction of cryptographically useful things was prior art. The description of encryption by modular exponentiation I recall would have been additional prior art. > 3. It is disingenuous to say there has been no invalidating prior art > even though the court has found the patent valid. There is a huge difference between "prior art" and "invalidating prior art" under patent law. Indeed, to invalidate the patent, it would have been necessary not only to find a description of the mathematical methods used in the construction of the RSA algorithm, but also a claim for the specific use for secure communication over insecure data links. > 4. Cylink's arguments must be right even though they lost in court. Some of Cylink's points were factually accurate. A system which permits the patenting of applied mathematics, which many engineers could have independently derived, is hardly likely to stun us with a brilliant interpretation of the various shades of meaning surrounding such claims and counterclaims. Again, losing in court does not equate to ones facts being in error, any more than it equates to the mathematics being patented being unknown prior to their incarnation in the patented application. > 5. RSA won because nobody could afford to litigate against them, even > though Cylink did. RSADSI's aggressive litigation posture discouraged people from ignoring their patent, and given that the patent could be licensed for much less than a lengthy court fight, kept litigation to a minimum. Cylink was pretty much the sole exception to this, and that was a legal fight internal to PKP. > 6. Anyone can patent anything and nobody could afford to oppose them > (N.B. Presumably not IBM, not DEC, not DuPont, ..oh well, you get the > idea) Yes, David. Practically anything can be patented. The power of patents is in defending them, not in applying for them, or in receiving them. > 7. Rich, smart companies with big legal departments license bogus > patents rather than litigating. Well, that depends on how you define bogus. I consider patenting applied math to be bogus. Your mileage may vary. > 8. Someone who opposes me is a troll. Someone who responds to a one line comment about the mathematical underpinnings of RSA being previously known, with several multipage essays whose central thesis is that such a claim cannot possible be true, because the patent would have been invalidated by the courts, is a troll who either understands nothing about how patents work, or is blowing a foghorn on behalf of the patent holder. > 9. If someone takes the time to oppose me, someone must be funding him. Vin has already outed himself as someone who has done work for RSADSI. He has vociferously defended various key recovery schemes implemented in their products against critics. This, combined with his rabid insistance that the RSA patent is something novel and unique, does equate to what some of us might describe as a "vested interest" in the matter, directly funded or not. > 10. The patent office never refuses patents on "method and apparatus" > except in the case of perpetual motion machines. Patent examiners generally rely only upon the material presented with the patent application when reviewing it, and expect people to do their own searches, and correctly cite related patents. Litigation is generally the means by which patents are challenged, not by the patent office refusing them, except in extrordinary circumstances, perpetual motion machines being one well-known example. > 11. Security Dynamics is paying for those who oppose me. I merely asked if Vin intended to bill them for the time he spent writing his rants. A rhetorical question. > 12. Such opposition is "a tirade". Suggesting that I would have to retire my nym after criticizing the RSA patent and taking several pages to say a paragraph of material certainly qualifies as a tirade in my book, especially when combined with a lot of irrelevent innuendo unrelated to the topic being discussed. > 13. No corporations are buying products with GAK, key recovery, etc. > (N.B. in That is what "no corporate demand" means). To an economist, perhaps. It would be more accurate to say that demand as a function of whether such features are included is a pretty flat function. > 14. Someone who opposes stronger escrow/GAK/key recovery than RSA is > offering must be suspect. Your point here eludes me. > I could go on ... And you usually do, and on, and on, and on... > but it seems to me, knowing nothing about the parties involved and > having no views on their personalities, that on the basis of the post > below Cordian is uh, um, er, a few clauses short of a syllogism. I simply believe that patents on applied math are inappropriate. Given that they are allowed, it seems silly to cite the fact that the courts uphold them as evidence for anything, particularly claims that they are new, novel, and non-obvious. -- Sponsor the DES Analytic Crack Project http://www.cyberspace.org/~enoch/crakfaq.html

1 0

MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM
by Marita N�sman-Repo 17 Dec '03

17 Dec '03

Press Release For immediate release DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN SERVICES FOR THE NEXT MILLENIUM Espoo, Finland, December 1, 1998 -- Data Fellows, the leading global security solutions vendor, and Sonera, the leading Finnish telecommunications service provider, have announced a partnership to create next-generation Intranet and extranet services. The scope of the partnership is to develop a secure IP service platform by combining Sonera's leading-edge telecommunications services with Data Fellows' award-winning secure VPN and anti-virus products. "Security is not a simple issue. We see leading telecommunications service providers in a key position to help corporate customers reap the benefits of the Internet without the inherent risks," says Risto Siilasmaa, CEO of Data Fellows. "Over the years, Sonera has always paved the way with innovative telecommunications services. Well-managed strong security is the logical next step." "Our key challenges are the increasing demand for mobility and the increasing use of extranets between companies," says Jukka T Leinonen, Managing Director of Sonera Solutions. "Managed IP-based virtual private networks with a functioning Public Key Infrastructure (PKI) and strong security constitute the foundation for future corporate information systems. Data Fellows can provide us with standards-based, proven security with globally available strong encryption." The first products and services will be announced early next year. Data Fellows' groundbreaking F-Secure products provide a unique combination of globally available strong encryption, revolutionary anti-virus software and policy based management. Data Fellows products are relied on by the world's largest industrial corporations, best-known telecommunications companies and major airlines, several European governments, post offices and defence forces as well as several of the world's largest banks. Data Fellows was selected one of the Top 100 Technology companies in the world by Red Herring magazine in September 1998. Sonera Ltd is Finland's leading telecommunications company, with subsidiaries and associated companies in 14 countries. Internationally, Sonera is a forerunner in the rapidly growing field of mobile, data, and media communications. In 1997, Sonera's net sales amounted to FIM 8 billion, and operating profit was FIM 1.7 billion. The Group employs 8,200 people. For more information, please contact USA: Data Fellows Inc. Mr. Pirkka Palomaki, Product Manager Tel. +1 408 938 6700, fax +1 408 938 6701 E-mail: Pirkka.Palomaki(a)DataFellows.com Europe: Data Fellows Oy Mr. Jukka Kotovirta, Director, Service Provider Business Unit PL 24 FIN-02231 ESPOO Tel. +358 9 859 900, fax. +358 9 8599 0599 E-mail: Jukka.Kotovirta(a)DataFellows.com or visit our web site at http://www.DataFellows.com Sonera Solutions Ltd. Mr. Timo Korpela, Head of Product Development Tel. +358 2040 63296, fax. +358 2040 64652 E-mail: Timo.Korpela(a)sonera.net -- Marita.Nasman-Repo(a)DataFellows.com, World-Wide Web http://www.DataFellows.com

1 0

Re: more FUD!
by Marcel Popescu 17 Dec '03

17 Dec '03

-----Original Message----- From: HaB <hab(a)gamegirlz.com> To: <cypherpunks(a)toad.com> Date: marþi, 01 decembrie 1998 01:46 Subject: Re: more FUD! >First time poster. Been reading for awhile now and I feel like a goof >for having to ask, but what does FUD stand for anyway? Fear, Uncertainty, Doubt. Alleged technique of large companies to make people think twice before buying products from lesser companies by casting doubt over the reliability of the product and its creator. Thinking twice is known to be a Bad Thing. <g> Mark

1 0

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by Opencity＠aol.com 17 Dec '03

17 Dec '03

Hi Mimmi Okay...this can be distributed as of today? Thanks phil

2 1

bonjour
by Thierry Roch 17 Dec '03

17 Dec '03

Ici tout va bien, merci. On espère qu'une version fiable pour windows sortira un jour Salut ________________________________________ roch(a)liberation.fr Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 Informatique Libération http://www.liberation.fr

2 1

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by eschuman＠cmp.com 17 Dec '03

17 Dec '03

Same request. May I be removed from this list as well? falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: bcc: Evan Schuman/MHS/CMPNotes Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Please remove my name from your email list. Opencity(a)aol.com wrote: > Hi Mimmi > > Okay...this can be distributed as of today? > > Thanks > phil

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

Please do not click on REPLY ALL, click on REPLY only, otherwise EVERYBODY on the mailing list receives a copy of your message. -----Original Message----- From: falcon falcon [mailto:falconinc@earthlink.net] Sent: Tuesday, December 01, 1998 11:19 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On espère qu'une version fiable pour windows sortira un jour > Salut > ________________________________________ > roch(a)liberation.fr > Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 > Informatique Libération http://www.liberation.fr

1 0

RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S...
by Mark Denny 17 Dec '03

17 Dec '03

===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:21 >Same request. May I be removed from this list as well? > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: >bcc: Evan Schuman/MHS/CMPNotes >Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE > SECURE VPN S... > > > > >Please remove my name from your email list. > > >Opencity(a)aol.com wrote: > >> Hi Mimmi >> >> Okay...this can be distributed as of today? >> >> Thanks >> phil ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:27 Could you please stop sending me your emails. I think that some thing has gone wrong with your server. Thanks. Mark.

1 0

Re: Old Hat 2
by Anonymous 17 Dec '03

17 Dec '03

Here's what is likely going on right now, though its availability to LE is questionable: NSA probably maintains surveillance of all or nearly all encrypted remailers. They log and archive the content of all traffic. First arrivals of messages in the remailer "cloud" provide source identification in many cases, so a database is gradually built of all the originating email addresses and IP addresses that have ever sent messages to a remailer. The same is true for the messages exiting the cloud, although many of those go to public lists or newsgroups. Sometimes, perhaps even often, the remailer cloud is so little utilised that one-hop or even multi-hop chained remalings are easily identified as to source and final destination. All goes into the database. Spook-style stylometers develop profiles of the users. Over time, more and more of the unidentified profiles become linked to known users. All it takes is one slip, or one piece of bad luck of low traffic levels. Linkage is also done on a probabilistic basis, many-to-many. Little human intervention is used except to develop and tune the correlation mechanisms. Filters aimed at content that might help correlate messages with senders is more important to the spooks than Echelon Dictionary filters. The priorities in getting a handle on something like the remailer cloud are quite different than the priorities in scanning ordinary traffic for content. Ultimately, though, the regular content filters come into play, but in this ongoing exercise of cat and mouse, the bulk of the effort is directed at developing the combination of surveillance and intelligent processing that can provide the basis for identifying, at least to some knowable probability, the sources and destinations of given remailer messages. Source and destination correlation can benefit greatly from knowledge of conventional email correspondent relationships. Most nonprofessional-spook people who send encrypted remailed email to a non-public destination are also likely to correspond with that destination in the clear. Archival logging of traffic is like a time machine - even if one ceases conventional correspondence with another, any past traffic can reveal the correspondence relationship. Mathematical correlation, given a very large amount of raw data consisting of timestamped message events, can reveal quite a lot about likely correspondence relationships. Even given a remailer network full of chaff, with reordered message pools and such, just running correlations on the end point data - who sent and when, and who received and when - can develop likely correspondent pairs. Be assured that the manipulation of such data relies heavily on probablistic clustering supported by database mechanisms not seen much in business environments. Instead of having firm relationships within an order or two of magnitude of the terminal node population, I would want something that allows having very large numbers of fuzzy relationships numbering many orders of magnitude greater than the node population. Nodes A, B, C and D send and receive remailer traffic. Everything that A has ever sent is clearly related to A, but each item can and likely would also have a probabilistic relationship to B, C, and D. The probability assignments would be updated as later analysis and later data more clearly identify who may have received which messages. Content comes into play here, too. At any time it is possible to query the database for the likely correspondents of A, and the likely messages A may have sent to B, C, or D, and get a result ordered by confidence. Similarly, it is possible to query for the likely sender(s) and recipient(s) of a given message. Occasionally, data may be firmed up - meaning achieving higher confidence levels of the relationships - by access to someone's PC, by whatever means, by stylometry, by specific content of public messages, and by fortuitous traffic analysis successes owing to the paucity of remailer traffic. It's also certain that to provide realistic cases that can be fully revealed to measure the efficacy of the various algorithms and methods involved, spooks use the remailer network themselves. That's the only way they can be sure to have any traffic that can be fully analyzed as a yardstick for the guessing games played by their software. A few rules of thumb result from even cursory examination of the likely environment: 1. Do not send clear messages through the remailers except to public lists and newsgroups. Sending clear messages to private correspondents provides the watchers with rich style and content material linked to a correspondent. It is usually easy then to link it back to you, and a firm correspondent pair is then established in their database. 2. Do not switch between clear and encrypted, remailed communication with the same correspondent. If your correspondent relationships are mapped via clear, conventional mail, those mappings can be applied to your encrypted, remailed mail to greatly narrow down the possible recipients, and quite likely combine with traffic analysis to correlate your outgoing message with one arriving at your correspondent. If the only communications you have with your deep contacts is by encrypted, chained remailer, only fortuitous or statistical correlation analysis or access to your or your correspondent's host machines will tie the two of you together. 3. Do not send traffic to significant correspondents when traffic levels are likely to be low. Good luck at guessing this. Probably the best way to get a handle on traffic levels is to run a remailer yourself. 4. Send lots of chaff. Chain some messages through the remailer cloud every day. If you have time and the ability, write and release something that will allow large numbers of people to send lots of chaff. 5. Ultimately, the only way the remailers will provide what might be described as Pretty Good Security will be when we have software that maintains a regular or random rate of messages to and from the remailer cloud, a stream into which the meaningful messages can be inserted with no visible change in traffic. Until then, the best we can do is try to keep traffic levels up, and to send and receive frequently enough to frustrate end-to-end traffic analysis. 6. Don't send anything that can have grave consequences. 7. Take names. Always take names. Some day... FUDBusterMonger It Ain't FUD til I SAY it's FUD!

2 1

Re: bonjour
by dan_verton＠fcw.com 17 Dec '03

17 Dec '03

this is not my list and I want off as well. falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On esp ère qu'une version fiable pour windows sortira un jour > Salut > ________________________________________ > roch(a)liberation.fr > Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 > Informatique Libération http://www.liberation.fr

1 0

RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S...
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: Mark Denny [mailto:mad@mm-croy.mottmac.com] Sent: Tuesday, December 01, 1998 11:28 AM To: press-english-technical(a)lists.datafellows.com Subject: RE: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATESECURE VPN S... ===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:21 >Same request. May I be removed from this list as well? > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: >bcc: Evan Schuman/MHS/CMPNotes >Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE > SECURE VPN S... > > > > >Please remove my name from your email list. > > >Opencity(a)aol.com wrote: > >> Hi Mimmi >> >> Okay...this can be distributed as of today? >> >> Thanks >> phil ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:27 Could you please stop sending me your emails. I think that some thing has gone wrong with your server. Thanks. Mark.

1 0

Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S...
by dan_verton＠fcw.com 17 Dec '03

17 Dec '03

please remove my name from the cc address when you send this... I'm on this thing as well eschuman(a)cmp.com on 12/01/98 11:21:21 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Same request. May I be removed from this list as well? falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:20:14 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: bcc: Evan Schuman/MHS/CMPNotes Subject: Re: MEDIA RELEASE: DATA FELLOWS AND SONERA JOIN FORCES TO CREATE SECURE VPN S... Please remove my name from your email list. Opencity(a)aol.com wrote: > Hi Mimmi > > Okay...this can be distributed as of today? > > Thanks > phil

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: SimpleNet Informatica LTDA [mailto:dalmo@simp.net] Sent: Tuesday, December 01, 1998 11:35 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour Remove me too !!!!!!!!!!!!!! At 08:19 AM 12/1/98 -0800, you wrote: >please remove my name from your email list. > >Thierry Roch wrote: > >> Ici tout va bien, merci. >> >> On espère qu'une version fiable pour windows sortira un jour >> Salut >> ________________________________________ >> roch(a)liberation.fr >> Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 >> Informatique Libération http://www.liberation.fr > > >Content-Type: application/x-pkcs7-signature; name="smime.p7s" >Content-Disposition: attachment; filename="smime.p7s" >Content-Description: S/MIME Cryptographic Signature > >Attachment Converted: c:\internet\eudora\attach\smime10.p7s > +===================================================+ SimpleNet Informatica LTDA - mailto:simp@simp.net Tel/Fax : (+55-21)509-0944 http://www.simp.net/ Rio de Janeiro - Brazil 3com Partner - Cyclades Reseller - Wingate Reseller Attachmate Premium Partner Medallion - SCO Reseller +===================================================+ Visite o Rio de Janeiro : http://www.guiario.com.br Sinalizando o Brasil em : http://www.signbrazil.com

1 0

RE: bonjour
by Ayoub, Mark (CAP, FLEET) 17 Dec '03

17 Dec '03

DO NOT HIT REPLY ALL, if you need to send an email send it to mailto:Marita.Nasman-Repo@DataFellows.com. Otherwise everybody on the mailing list receive your message. Mark Ayoub GECFS PC Support -----Original Message----- From: "dan_verton"@fcw.com [mailto:"dan_verton"@fcw.com] Sent: Tuesday, December 01, 1998 11:39 AM To: press-english-technical(a)lists.datafellows.com Subject: Re: bonjour this is not my list and I want off as well. falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM Please respond to press-english-technical(a)lists.datafellows.com To: press-english-technical(a)lists.datafellows.com cc: (bcc: Dan Verton/FCW) Subject: Re: bonjour please remove my name from your email list. Thierry Roch wrote: > Ici tout va bien, merci. > > On esp

1 0

RE: bonjour
by Mark Denny 17 Dec '03

17 Dec '03

===== Original Message from PRESS-EN @ INTERNET {press-english-technical(a)lists.datafellows.com} at 1/12/98 16:38 >this is not my list and I want off as well. > > > > >falcon falcon <falconinc(a)earthlink.net> on 12/01/98 11:19:07 AM > >Please respond to press-english-technical(a)lists.datafellows.com > >To: press-english-technical(a)lists.datafellows.com >cc: (bcc: Dan Verton/FCW) >Subject: Re: bonjour > > > > >please remove my name from your email list. > >Thierry Roch wrote: > >> Ici tout va bien, merci. >> >> On esp >ère qu'une version fiable pour windows sortira un jour >> Salut >> ________________________________________ >> roch(a)liberation.fr >> Tel : +33 (0) 1 42 76 17 68 - Fax: +33 (0) 1 42 76 02 24 >> Informatique Libération http://www.liberation.fr ===== Comments by MAD@MM-CROY (Mark Denny) at 1/12/98 16:43 Please remove me. Mark. Mott MacDonald Limited, Registered in England No. 1243967 Registered office St. Anne House, 20-26 Wellesley road, Croydon CR9 2UL Tel: +44 (0) 181-774 2000 Fax: +44 (0) 181-681 5706 Email Mad(a)mm-croy.mottmac.com

1 0

somebody clue this person in please!
by Ken Williams 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- i'm laughing too damned hard to do it myself. Regards, Ken Williams Packet Storm Security http://www.Genocide2600.com/~tattooman/ E.H.A.P. Head of Operations http://www.ehap.org/ ehap(a)ehap.org NC State CS Dept http://www.csc.ncsu.edu/ jkwilli2(a)unity.ncsu.edu PGP DSS/DH/RSA Keys http://www4.ncsu.edu/~jkwilli2/pgpkey/ _____________________________________________________________ Get Your Private, Free, Encrypted Email at http://www.nsa.gov - ---------- Forwarded message ---------- Received: from cc02mh.unity.ncsu.edu (cc02mh.unity.ncsu.edu [152.1.1.144]) by cc01mh.unity.ncsu.edu (8.8.7/8.8.7) with ESMTP id TAA00863 for <jkwilli2(a)cc01mh.unity.ncsu.edu>; Mon, 30 Nov 1998 19:04:29 -0500 (EST) From: ILovToHack(a)aol.com Received: from imo22.mx.aol.com (imo22.mx.aol.com [198.81.17.66]) by cc02mh.unity.ncsu.edu (8.8.7/8.8.7) with ESMTP id TAA05341 for <jkwilli2(a)unity.ncsu.edu>; Mon, 30 Nov 1998 19:04:39 -0500 (EST) Received: from ILovToHack(a)aol.com by imo22.mx.aol.com (IMOv16.10) id QVOZa08724 for <jkwilli2(a)unity.ncsu.edu>; Mon, 30 Nov 1998 19:01:47 +1900 (EST) Message-ID: <f7e063e.366331eb(a)aol.com> Date: Mon, 30 Nov 1998 19:01:47 EST To: jkwilli2(a)unity.ncsu.edu Mime-Version: 1.0 Subject: Re: more FUD! Content-type: text/plain; charset=US-ASCII Content-transfer-encoding: 7bit X-Mailer: Casablanca - Windows sub 224 In a message dated 11/30/98 10:15:50 AM EST, jkwilli2(a)unity.ncsu.edu writes: > Get Your Private, Free, Encrypted Email at http://www.nsa.gov I looked around there site and couldnt find anything about geting a e-mail could you please be more specific. -----BEGIN PGP SIGNATURE----- Version: PGPfreeware 5.0i for non-commercial use Charset: noconv iQEVAwUBNmM9eZDw1ZsNz1IXAQGp2ggAyiZR2yTdawgv5Dcrh4dOxpK1RCZD3+rL YgQEf9JlvhG43KpK5ZXJNwG46gLZ/G1utg1Ux3DfsotBgce8Y5xO1GdXm+SmSw3S fXlPSeeY93B+NQ5xaRHyLmMzV/YLMspNYKPZYuA+AI5XIWyL2fcWR8TcOpISWQ5r UQphc7KBhZfDIObJ5nJzkv8gIDHn4qvlBqhNcjukw3GvJ9Edm8vS/P3Jlm9wiuXW +kXWEVTX21xdBnG3iYdnQOyG69cmSQWKVN64Hetbi1tf0um2BJXQj82VOJtwbTp/ KFF650etU6OhrCnhV/Z/LYYNBYbG5r4/en2TbPyumIWd1DgujU8oNg== =ed5P -----END PGP SIGNATURE-----

1 0

student project suggestion; PGP trap and trace
by Anonymous 17 Dec '03

17 Dec '03

Given: if the adversary captures your PGP keyring, he will know your contacts. Your secure contacts. Therefore: it would be mighty nice if access to your keyring's address list required a passphrase (which perhaps was valid for several hours, it being a pain to retype a decent passphrase). You will note that the PGP plugins for Eudora allow any buffoon with access to your machine to discover who you talk to securely. --Laced aliens fried my pugs

1 0

Freedom & AnonymousIP network
by Austin Hill 17 Dec '03

17 Dec '03

This may be of interest to members of this list or people that you may all know. If you have any questions, or know of ISPs who support privacy on the Internet, please forward this to their attention. Thanks. -Austin --------------------------------------------------------------- Freedom Partnership Program: Value-Added Service For ISPs Zero-Knowledge Systems is currently in seeking ISPs to join as "Founding Members" in the Freedom Network. Freedom is revolutionary software that provides the first complete privacy solution to Internet users, including email, web-browsing, chat, telnet and Usenet. By allowing users to create and manage multiple authenticated identities and using full-strength cryptography, Internet users can also block SPAM and manage their person information. See http://www.zks.net for full details. Being a member of the Freedom Network will allow an ISP to differentiate itself from the competition while fighting for on-line privacy. The Freedom Partnership Program has been designed to be revenue generating and cost reducing for ISPs. Freedom software is provided free of charge to all ISPs. Internal beta-testing of the Freedom network will begin in mid-December, 1998 and the "Founding Members" of the Freedom Network should be prepared to begin working with our technical staff at that time. Beta testing should last 4-8 weeks. The Freedom server software runs on a Linux or Solaris operating system and needs to run on a dedicated machine. Server participants should be able to contribute a T-1 during the beta testing period. Members will also be entitled to proceeds from the revenue sharing program (after the beta testing period). The revenue sharing program is designed to provide ISPs with 110% - 130% of bandwidth costs. Participation has its advantages. Founding Member ISPs will receive "Preferred Member" status on our web-site and software. When users of the Freedom client do a search for an ISP by telephone area code, Founding Members will be the recommended ISP in a given geographical area. All Founding Members will be listed in relevant press releases made by Zero-Knowledge Systems. Founding Members will also be guaranteed to earn 10% on all click-thru sales (web-link program) for the next two years. Participating ISPs will also get "Prominent Placement" - have their company name/logo displayed on a high-traffic area of our web-site. Distinctive buttons and banners will be given to all founding members receive to put on their web-site. Initially, the Freedom Network will be comprised of 15 Founding Member ISPs which will be located around the world. We plan to have an ISP in each of the following areas: Canada(3) - east coast, central, west coast; U.S.A.(7) - northeast, northwest, southeast, southwest, west coast, silicon valley, Midwest; United Kingdom(1); Holland(1); Germany(1); Australia(1); and, the Caribbean(1). If you are interested in becoming a "Founding Member" or simply joining the Freedom Network or know of an ISP that would be interested, please contact Greg Adelstein, Director of Business Development, Zero-Knowledge Systems, greg(a)zks.net or 514-286-2636. -------------------------------------------------------- _________________________________________________________________________ Austin Hill Zero-Knowledge Systems Inc. President Montreal, Quebec Phone: 514.286.2636 Ext. 226 Fax: 514.286.2755 E-mail: austin(a)zks.net http://www.zks.net Zero Knowledge Systems Inc. - Nothing Personal PGP Fingerprints 2.6.3i = 3F 42 A2 0D AF 78 20 ED A2 BB AD BE 8B 40 5E 64 5.5.3i = 77 1E 62 21 B3 F0 EB C0 AA 6C 65 30 56 CA BA C4 94 26 EC 00 keys available at http://www.nai.com/products/security/public_keys/pub_key_default.asp _________________________________________________________________________

1 0

NYT (online only?) article on DigiCash Chapt. 11
by Robert Hettinga 17 Dec '03

17 Dec '03

...Wherein I get quoted in the NYT, for the first time in my life, using "bummed out". Oh, well. At least they spelled my name right... :-). Cheers, Bob Hettinga --- begin forwarded text Mime-Version: 1.0 X-Sender: rah(a)pop.sneaker.net Date: Mon, 30 Nov 1998 20:35:32 -0500 To: Digital Bearer Settlement List <dbs(a)philodox.com> From: Robert Hettinga <rah(a)shipwright.com> Subject: Electronic Cash for the Net Fails to Catch On Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ --- begin forwarded text Date: Mon, 30 Nov 1998 20:28:03 -0500 From: "Robert A. Hettinga" <rah(a)philodox.com> Reply-To: rah(a)philodox.com MIME-Version: 1.0 To: rah(a)shipwright.com Subject: Electronic Cash for the Net Fails to Catch On http://www.nytimes.com/library/tech/98/11/cyber/articles/28cash.html <fair use snippage> November 28, 1998 Electronic Cash for the Net Fails to Catch On By PETER WAYNER here are two conflicting epigrams that rule the computer industry. The first is that the pioneer gets all of the gold, and the second is that the pioneer gets all of the arrows in the back. Several recent high-profile failures in the electronic payment industry suggest that efforts to develop versions of electronic cash for the Internet are so far reaping more arrows than riches. Christine M. Thompson The most recent signal came as <http://www.nytimes.com/library/tech/98/11/cyber/articles/#1>Digicash, a closely watched electronic payment company based in Palo Alto, Calif., filed for bankruptcy protection. The company was known for a collection of tools that made it possible for people to spend small amounts of money over the Internet using what is known as a digital wallet, software that handles transactions in a manner similar to cash. One advantage of the Digicash system is that, unlike credit cards, it allowed consumers to make purchases anonymously. While several major banks expressed interest in the Digicash system and a few actually began offering accounts, the company was unable to generate enough mass interest among merchants or consumers. Consumers were reluctant to use Digicash because there weren't many merchants who accepted it, and merchants didn't sign up to participate because consumers weren't demanding it as a payment option. Other companies that have tried to develop digital cash systems haven't fared much better. Last August, another pioneer, First Virtual, shut down its system for processing electronic cash transactions and began to focus on a new business, interactive messaging, according to a company spokeswoman, Cindy Alvarez. Another company, CyberCash, still offers a system called CyberCoin, but most of the company's revenue comes from processing credit card transactions. Industry observers suggest that one reason electronic payment systems haven't taken off is that consumers have become more comfortable using credit cards to make purchases online. Bill Curry, a spokesman for Amazon.com, said credit cards are used for "the overwhelming majority" of transactions on the company's site. "I think the reason is that we do have an encrypted secure server, and we guarantee the transaction. If there are unauthorized charges on your account as a result of shopping at Amazon.com, we'll pay the $50 that's not covered by your credit-card issuers." Bill Trevor, director of customer service at CDNow, said most of CDNow's customers enter their credit-card numbers on the site. "Our experience is showing that in the month of October, roughly four fifths of our customers felt secure enough to put their credit card in our online form. Almost all of the rest are checks or money order. There are a couple of percentage points for people who call us, fax us or e-mail their credit-card number, but it's less than 3 percent." Companies that process credit card transactions have found more success than the wallet-based businesses. CDNow allows customers to send a separate e-mail message with the credit card number encrypted with PGP, a significantly higher-grade of encryption than is normally used to protect most browser-based transactions. Companies that process credit card transactions for e-commerce Web sites have found more success than the wallet-based businesses, like Digicash. Keith Miller is an executive vice president of Ibill, a company that processes credit card transactions for Web merchants. "We looked into that whole thing when we started a couple of years ago," he said, referring to companies that were building separate software packages for processing payments. "Back then, our biggest competitors were the wallet companies. We went after the market saying, why do we need to reinvent something when we have something that works and is simple, easy and quick?" In the end, Ibill chose to make it simple for people to buy something online by typing a credit card number into a browser. The browser uses a security method known as SSL (Secure Socket Layers) to protect the data. This doesn't offer the same protection as the carefully designed wallets, but has so far been acceptable to consumers. This approach has become so popular that one of the wallet pioneers, Cybercash, has developed a similar system and now derives more profits from simple SSL-based credit card transactions than through the wallets the company continues to develop. What remains to be seen is whether digital cash systems will ever find a market. Paul Kocher, an expert on cryptography who has analyzed many digital payment mechanisms, said it would take the support of a major player for an electronic cash system to be successful. "If someone like Visa or IBM threw their weight behind a system and got a lot of backers, it might take off. I don't see how a small company like Digicash could ever get a system deployed and working." Digicash's plans for the future are uncertain, in part because the company must pay off past debts by holding what amounts to an auction of its technology. But the fact that some companies are interested in Digicash's patents indicates that there may still be hope for some sort of electronic payment system. In particular, industry observers say that these systems' ability to allow consumers to make purchases online anonymously may yet prove valuable. <more fair use snippage...> Related Articles <http://www.nytimes.com/library/tech/98/11/biztech/articles/04card.html>Got a Dime? Citibank and Chase End Test of Electronic Cash (November 11, 1998) <http://www.nytimes.com/library/tech/98/06/biztech/articles/22card.1.jpg>Code Br eaker Cracks Smart Cards' Digital Safe (June 22, 1998) Scott Loftesness, the interim chief executive of Digicash, said the company is exploring many different options and has already received one offer for some of its patents. One of the patents provides an easy way for someone to sign or authorize a document without reading it, a process that is often called a "blind signature." This is the foundation for the anonymity Digicash offers its customers and may also have a variety of other untapped applications. Robert Hettinga, a digital cash consultant and one of the organizers of the Financial Cryptography conference held annually in Anguilla, said, "I would like to try to get a syndicate together to buy the [blind signature] patent. We would hold it and license it in a way that everyone could use it. I would be really bummed out if they took that patent and locked it away for another eight years." Others are more cynical about the possibility that any micropayment model will ever become dominant. William Powar, a former Visa executive who is now a venture capitalist in Silicon Valley, said one problem with digital wallet systems is that they are designed for small one-time purchases. "There's no market where pay per use is significant," he said. "Look at the cable model." Powar points out that while newspapers, magazines and cable operators offer one-time consumption options through newsstands or special cable subscriptions, the bulk of their revenue comes from subscriptions and advertising. This suggests to him that micropayment systems won't be a crucial part of the future of the Internet, which would diminish the need for digital cash systems. In the near future, the electronic digital transaction industry is focusing on another goal: processing bills for utilities, credit card companies, telephone companies and others who normally bill customers via postal mail. Several new ventures, like Ibill, as well as established companies like Netscape Communications Corp., are working on technologies to allow consumers to pay their bills online. Netscape's system, called BillerXpert, will let consumers pay bills over the Web using, among other options, the payment mechanism designed by CyberCash. The bill presentment industry hopes to save money on postage while also providing additional services, like personalized content. Related Sites These sites are not part of The New York Times on the Web, and The Times has no control over their content or availability. <http://www.digicash.com>Digicash <http://www.cybercash.com>CyberCash <http://www.amazon.com>Amazon.com <http://www.cdnow.com>CDNow <http://www.ibill.com>Ibill <http://www.netscape.com>Netscape Communications Corp. Peter Wayner at <mailto:pwayner@nytimes.com>pwayner(a)nytimes.com welcomes your comments and suggestions. <final bit of fair use snippage> --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Subject: naughty bits At 12:25 AM 12/1/98 +0100, Anonymous wrote: >NSA probably maintains surveillance of all or nearly all >encrypted remailers. They log and archive the content of Well shit yes, I pay enough taxes, you bet they do, or I'm not getting my fucking dollars worth. I only send via anon when I care only about the honest readers' opinion. Like I'd send dangerous shit over the IP. May as well fax it plaintext to the Ukraine. Bwah hah hah. If you were really going to pull a prank, you'd create a one-shot yahoo/hotmail/etc account from a cafe then wipe that platter clean (both FAT and lean). ---If your Correlators have pegged me, well, hello. Nice game.

1 0

SternFUD on RSA
by Eric Cordian 17 Dec '03

17 Dec '03

:) David Sternlight <david(a)sternlight.com> opines: > I am not on the Cypherpunks list. Given the tone of some posters I > don't' see that as a useful list. I wonder who won the pool on how long you would last before departing in a tiff. :) But I digress. > You already made this argument. It could have been (and perhaps was) > made in court. Despite that the patent was upheld. That is "I am > right and the court is wrong." I think that regulations which permit applied math to be patented are counterproductive, as do many other countries. Given that such regulations are in place in the United States, one would expect them to be upheld by the courts. Whether any of this is "wrong" in some abstract sense is a religious debate, in which I am uninterested. Let us examine the two statements: I. Certainly, given what was known at the time widespread data communications created a commercial demand for secure communication over insecure lines, a person setting out to create a software solution to the problem, knowing what was then known about cryptography, trapdoor functions, and other techniques, would almost certainly have employed modular exponentiation or discrete logs to solve the problem. If RSA hadn't been patented at the time it was, it most certainly would have been independently discovered by multiple individuals and widely employed, without the present licensing restrictions. Prior published works on cryptographic trapdoor functions involving the factoring of composites and possibly even encryption by modular exponentiation existed long before the RSA patent. II. Obvious prior art sufficient [in the current regulatory environment surrounding patents in the US] to invalidate the RSA patent in court has never been published. Now, given that these two statements are not opposites of each other, one is not going to refute the first by stating the second, no matter how big a bullhorn one employs. >> There is a huge difference between "prior art" and "invalidating prior >> art" under patent law. Indeed, to invalidate the patent, it would >> have been necessary not only to find a description of the mathematical >> methods used in the construction of the RSA algorithm, but also a >> claim for the specific use for secure communication over insecure data >> links. > It seems to me you are agreeing with my comment here. I have only argued that obvious prior art exists. I have also stated that I would favor a regulatory climate in which such obvious prior art would preclude a patent being granted. I have never stated that we currently live in such a regulatory climate. In fact, we do not. > Pretty far-fetched response. They tried to overturn the patent on > grounds of prior art. They failed. End of story. Many words, like "prior art," have specific legal meanings which differ from their common English usage. Kind of like economists arguing that there is no "demand" for food by poor people, because they have no money with which to purchase it. I use the term "obvious prior art" to mean prior publication of the essential methods and techniques with which a technically skilled person, given the same problem to solve, would arrive at the same or a similar solution. Put two graduate students at opposite ends of a wire, with the world's prior-to-1977 writings on cryptography, trapdoor functions, the intractablity of factoring the product of primes, and the modular exponentiation problem. I suspect the RSA Public Key Cryptosystem would not be long in emerging, even if one employed particularly dense graduate students. That is what I mean when I use the term "obvious prior art." > Again, it seems you've conceded my point here. What part of "nobody" > don't you understand? I was proceeding upon the assumption that the enumerated "points" you claimed I was making were ones with which you disagreed. If that is not the case, I am prepared to declare early victory. "Nobody could afford to litigate [against RSADSI]" is misleading, as even the wealthy don't employ the expensive option, when a cheap one is available. Besides, I have never contested that the current regulatory climate supports the patenting of things like RSA even in the presence of prior publication of the essential mathematical elements. >>> 6. Anyone can patent anything and nobody could afford to oppose them >>> (N.B. Presumably not IBM, not DEC, not DuPont, ..oh well, you get the >>> idea) >> Yes, David. Practically anything can be patented. The power of >> patents is in defending them, not in applying for them, or in >> receiving them. > Again you concede my point by ignoring the operative clause. What > part of "nobody" don't you understand? There were plenty of companies who had the financial power to squash RSADSI like a grape, and probably change the regulatory climate as well. There was no incentive for them to do so, and they probably have applied mathematical patents of their own which they are fond of. Had RSADSI sat on the patent, and refused to license it to others, both they and their patent would probably have had a very short life span. >>> 7. Rich, smart companies with big legal departments license bogus >>> patents rather than litigating. >> Well, that depends on how you define bogus. I consider patenting >> applied math to be bogus. Your mileage may vary. > RSA didn't patent applied math. They patented processes which may > use, or be described in part with applied math. Yes, the "method and apparatus" transformation. > The facts are that rich, smart companies litigate patents all the > time so your contention is false on its face. They rarely litigate patents where the cost to litigate is enormous, the technology may be cheaply licensed, and the chances of success, or of even trying to explain the topic to the average layman, are minimal. >> Someone who responds to a one line comment about the mathematical >> underpinnings of RSA being previously known, with several multipage >> essays whose central thesis is that such a claim cannot possible be >> true, because the patent would have been invalidated by the courts, is >> a troll who either understands nothing about how patents work, or is >> blowing a foghorn on behalf of the patent holder. > Another guilty plea. Well, I suppose Vin could just be a bored essayist in need of something to practice on. (Snicker) >>> 9. If someone takes the time to oppose me, someone must be funding him. >> Vin has already outed himself as someone who has done work for >> RSADSI. He has vociferously defended various key recovery schemes >> implemented in their products against critics. This, combined with >> his rabid insistance that the RSA patent is something novel and >> unique, does equate to what some of us might describe as a "vested >> interest" in the matter, directly funded or not. > Another failed refutation. Your words were unequivocal. I think you are having some difficulty separating out the sarcasm here. Besides, the suggestion that Vin has a vested interest in defending the RSA patent hardly translates into an assertion that everyone who disagrees with me on some subject is someone's paid agent. Abstraction from the specific to the general is not an accepted tool of inference. You, for instance, are probably quibbling for entirely different reasons. > I think the problem with most of your post is that you have taken the > odd exception or the odd passing issue and tried to make them out to > be the general case; in short your post was highly overblown as well > as redolent of personal attack. Had you discussed the issue more > temperately in terms of your factual claims it might have been more > useful. That sometimes happens when one party "summarizes" a flame war, and posts it elsewhere. Deal. >>> 10. The patent office never refuses patents on "method and apparatus" >>> except in the case of perpetual motion machines. >> Patent examiners generally rely only upon the material presented with >> the patent application when reviewing it, and expect people to do >> their own searches, and correctly cite related patents. Litigation is >> generally the means by which patents are challenged, not by the patent >> office refusing them, except in extrordinary circumstances, perpetual >> motion machines being one well-known example. > See above. You were unequivocal. "Practically anything" is not unequivocal, and is a correct description of the current patent review climate. > There may be cases of the sort you refer to, but it is not a general > argument which can then be applied to the case of the RSA patent. You > have repeatedly make the logical error of claiming that a specific > proved a general, and then applying the claimed general to a different > specific. Vin alleged that RSA being granted a patent proffered compelling evidence of the unique worth of the thing being patented. It is correct to apply general comments about the patent-granting climate to this specific case. For a better example of confusing generals and specifics, you may re-read your own comments on "if someone opposes me, someone must be funding them" above, incorrectly abstracting my comments about Vin to the general population. :) >>> 11. Security Dynamics is paying for those who oppose me. >> I merely asked if Vin intended to bill them for the time he spent >> writing his rants. A rhetorical question. > GIven the rest of your post, the inference was direct. If you did not > intend to imply that, you should not have used that languaging. Bzzzzzzzz. Wrong Answer. And we will have to deduct additional points for abstracting again from Vin to the general population vis a vis "Security Dynamics is paying for those who opppose me." The best you can get on this mid-term is now a C. :) >>> 12. Such opposition is "a tirade". >> Suggesting that I would have to retire my nym after criticizing the >> RSA patent and taking several pages to say a paragraph of material >> certainly qualifies as a tirade in my book, especially when combined >> with a lot of irrelevent innuendo unrelated to the topic being >> discussed. > Since most of his post was factual, it was not a tirade. Most of the factual material refuted nothing I was claiming, and refuted things I wasn't claiming, such as Jevon's book containing a complete description of PKC, as opposed to being the earliest known work which contained something related to the topic. Again, an attempt to impress people with the volume of the evidence, rather than with its quality, which when combined with the occasional snide remark, meets my definition of "tirade." > You are trying to discredit the bulk of his post with a > characterization of a small portion that doesn't apply to the whole, > and may not even apply to the portion. His post is discredited because it fails to address any of my points about the RSA patent, and instead argues forcibly for a collection of self-evident surrogate issues, carefully selected for their ability to be easily confused with the real ones. >>> 13. No corporations are buying products with GAK, key recovery, etc. >>> (N.B. in That is what "no corporate demand" means). >> To an economist, perhaps. It would be more accurate to say that >> demand as a function of whether such features are included is a >> pretty flat function. > You didn't say that. You said "no corporate demand". I understand the > word "no" because English is my mother tongue. "Demand" in common English usage means that something is being clamored for. In Economic terms, it means half of the phrase "supply and demand" which is something entirely different, said economic demand existing for anything which is purchased. > that the demand curve has a particular (flat) shape, did you make that > up or did you rely on empirical evidence? I believe that surveys by privacy groups long ago showed that GAK/Key Escrow/Key Recovery was not being clamored for by corporate America, although attempts were being made to incentivize it by the intelligence and law enforcement communities. > Your statement that "demand as a function of" X is a pretty flat > function is also nonsense economics. Perhaps you meant to say that the > _quantity demanded_ is invariant over whether these features are > included or not. I was using "demand" in its ordinary English usage. You were using it as an economic term, in an attempt to call the mere fact that GAK/Key Escrow/Key Recovery-enabled software was purchased at all "demand" for it. Which, to use one of Clinton's favorite phrases, was "technically accurate, although misleading." :) > Or perhaps you meant to say that the demand curve as a function of X > was 'one-to-one onto' itself. Uh, no. That was definitely not what I was saying. I don't think it is what you are trying to say either, but thanks for using "1-1" and "onto" in a sentence about functions. > To test your hypothesis, you'd have to show that if two versions were > offered simultaneously, one with and one without X, no corporate buyer > would prefer the version with X. That would kind of depend on how "X" was priced, would it not? If you give things away for free, people will probably take one in case they need it someday, as it costs them nothing. This does not equate to "demand," or "clamoring." > I leave the reason that would the the dispositive experiment as an > exercise. Hint: It's utility economics. Hint: It's not quite English. >>> 14. Someone who opposes stronger escrow/GAK/key recovery than RSA is >>> offering must be suspect. >> Your point here eludes me. > You said that he opposed escrow/GAK/key recovery except up to the > point offered by RSA. That translates as he opposes such things if > they were stronger than those offered by RSA. Nothing suspect about > that--he simply agrees with the decision point RSA chose as to how > strong to make such things. That's one possible explanation. To test your hypothesis, we should see how well Vin's agreement tracks RSA's inclusion of additional encrow/GAK/recovery features in the future. He may have to change the name of "The Privacy Guild" to something less impressive. >>> I could go on ... >> And you usually do, and on, and on, and on... > And now you're diverging from the facts and logic of the matter to > personal attack. It reveals the same flaw that invalidated your > original post. I'm sure you've been attacked before, by people a lot less nice than myself. :) >> I simply believe that patents on applied math are inappropriate. >> Given that they are allowed, it seems silly to cite the fact that the >> courts uphold them as evidence for anything, particularly claims that >> they are new, novel, and non-obvious. > Had you said that we could have had a rational discussion. Points in > the discussion would have included: > 1. Even patent law agrees with you; the RSA patent is a process > patent and not a patent on applied math. Hmmm. Well, patents on pure math are not allowed, ergo, math must be suitably transformed in order to be patented. > 2. Patents purely on applied math, are, as far as anyone here knows > not allowed. You may exponentiate to your heart's content as long as > you don't practice the RSA algorithm as part of a crypto system. There is a fundamental difference between telling me I cannot practice modular exponentiation to communicate with people without licensing it, and telling me I cannot make RDRAMs without licensing that. I am unlikely to replicate the RDRAM design by accident. I am quite likely to derive a given bit of mathematics given the application for it. If RSA can be patented, why not something like Householder transforms, or cluster analysis, or the quadratic formula? Sounds like the slippery slope to me. > 3. The court didn't uphold a patent on applied math; it upheld a > process patent on a crypto system that, among other things, uses > applied math. So does almost any engineering design. There is a fundamental difference between a physical machine whose design required the use of mathematics, and an abstract mathematical transformation, which may exist only in an instance of some computer program performing a certain task. > 4. The particular process patent was found to be new, novel, and > non-obvious. There was ample opportunity for Cylink to try to refute > that. They failed. End of story. Again, returning to the top of our discussion, the existence of "obvious prior art" for RSA in the common English sense meaning of "obvious prior art" has little to do with whether patents are upheld in the current regulatory climate in the United States. It would be simple to test your hypothesis, by simply giving trapdoor functions replete with useful identities to two people, and telling they have to construct a common secret unknown to a third party monitoring their communication. I cannot imagine a technically skilled person taking very long to make the transition from some "one-way" functions, to a practical implementation of D-H, RSA, or whatever. That would be my definition of "obvious." > Now we've discussed all the above substance before, and my purpose in > reciting the four points isn't to re-open the topic, but to show that > your definition of what the topic is is simply incorrect. My posts. My topic. Your posts. Your topic. Works for me. :) > Given that, I don't propose to discuss the above four points yet > again. They aren't there to reopen the discussion, but to show that > your statement of the issue is inaccurate. My statement is point "I" at the beginning of this message. Please re-read it and tell me whether or not you agree with it. -- Sponsor the DES Analytic Crack Project http://www.cyberspace.org/~enoch/crakfaq.html

2 1

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Perhaps of interest to locals... EE380 Computer Systems Colloquium Fall Quarter 1998-1999 Lecture #10 Date: Wednesday, Dec 2, 1998 Time: 4:15-5:30 pm Location: NEC Auditorium (B03) Gates Computer Science Building Internet: Live on the Net! See instructions on the Web page http://www-leland.stanford.edu/class/ee380 ********************************************************************** Title: Cracking the Data Encryption Standard: Technology, Design, and Politics Speaker: John Gilmore The Electronic Frontier Foundation About the talk: Sometimes it takes good engineering to straighten out twisted politics. In 1997, working in conjunction with the Electronic Frontier Foundation, John Gilmore decided to demonstrate this by building a custom computer that would be able to solve the Data Encryption Standard, an encoding scheme the United States Government had been promoting for "secure" business and financial communications since the 1970s. It had long been suspected the Government was pressing citizens to use this standard because its intelligence agencies were secretly able to decode DES-encrypted messages. It appears this theory was right. DES *was* crackable -- easily and affordably -- which Mr. Gilmore demonstrated in July, 1998 by using his "DES Cracker" system to solve in less than three days a coded message that had been produced as part of a DES-decryption contest. In this presentation Mr. Gilmore will discuss the design of the DES Cracker system and explain some of the politics surrounding the DES controversy. Note: A full description of the DES Cracker system, including complete hardware and software design details, appears in the book, "Cracking DES: Secrets of Encryption Research, Wiretap Politics, & Chip Design," published by O'Reilly. Further details can also be found at: http://www.eff.org/descracker/ About the speaker: John Gilmore is an entrepreneur and civil libertarian. He was an early employee of Sun Microsystems, and co-founded Cygnus Solutions, the Electronic Frontier Foundation (EFF), the Cypherpunks, and the Internet's "alt" newsgroups. He has twenty-five years of experience in the computer industry, including programming, hardware and software design, management, and investment, and is a significant contributor to the worldwide open source (free software) development effort. Mr. Gilmore's advocacy efforts on encryption policy aim to improve public understanding of this fundamental technology for privacy and accountability in open societies. He led the team that built, in conjunction with the EFF, the world's first published DES Cracker. He is a board member of the Internet Society and the Electronic Frontier Foundation. Further background information may be found at: http://www.cygnus.com/~gnu/ Contact information: John Gilmore gnu(a)toad.com

1 0

RE: "Export" controls
by Trei, Peter 17 Dec '03

17 Dec '03

"Anonymous" wrote: > >Can you give me an example of a commercial vendor who has suffered > >because someone bought a "dangerous" product ( Windows, for example ) at > >retail and carried it out of the country in a suitcase? My guess would > > I cannot give such example because hard crypto products are not available > to > the general public. > > I am unaware that microshit OS has hard crypto built-in. The only hard > crypto > package I have ever seen for sale at mail-order (and thus not anonymous) > is > NAI's PGP (and I have never seen any hard crypto available in a store for > cash > - but that can only mean that there is no perceived demand). > [Trei, Peter] Huh? I got my copy of NAI PGP 5.0 off of the shelf at CompUSA, a major retail chain (I did pay with plastic, but am 99.999...% certain that cash would have been accepted). The box *is* marked 'Not for export', but I don't recall seeing any other restrictions. Either 'anonymous' hasn't looked hard enough, or he/she/it's in another country. Peter Trei ptrei(a)securitydynamics.com [I apologize for the lousy formatting. I'm using a Microsoft product to sent this message.]

1 0

Sternlight on Cypherpunks
by Eric Cordian 17 Dec '03

17 Dec '03

Sternlight has denied us! David Sternlight <david(a)sternlight.com> writes: > I am not on the Cypherpunks list. Given the tone of some posters I > don't' see that as a useful list. > I never participated in that list. It was suggested to me by a very > senior member of the list that all the wrangling typical of that list > meant it wasn't worth the time, and I took his advice. I never had sex with that woman. -Bill Clinton I never participated in that list. -David Sternlight Correct me if I'm wrong, but didn't David join the list some time ago, and depart with a giant PLONK when someone called him a "statist"? -- Eric Michael Cordian 0+ O:.T:.O:. Mathematical Munitions Division "Do What Thou Wilt Shall Be The Whole Of The Law"

1 0

somebody clue this person in please!
by HyperReal-Anon 17 Dec '03

17 Dec '03

Ken Williams <jkwilli2(a)unity.ncsu.edu> wrote: >i'm laughing too damned hard to do it myself. >In a message dated 11/30/98 10:15:50 AM EST, jkwilli2(a)unity.ncsu.edu writes: > >> Get Your Private, Free, Encrypted Email at http://www.nsa.gov > >I looked around there site and couldnt find anything about geting a e-mail >could you please be more specific. Why do you find this such a surprise? This is typical behavior for AOLholes. We've all tried for years to clue such lamers in, and all we've ever gotten in return are more "solicited" spam, and more unsolicited spam, and it's worse because they're no longer concentrated at one site.

1 0

New Brady Bill Implications
by Carol Anne Cypherpunk 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I'm watching Headline News, and they are reporting that "now", under new provisions in the Brady Bill, and 'instant' background check is being made. This even is for simple rifles and shotguns. Just think, soon there might be 'instant' background checks, even just to use simple 56 bit DES. Or somewhere lurking around in your browser code, a teeny tiny program that sends a cookie to the NSA, FBI, etc every time you use crypto. Who knows, it's probably there already. Or a realtime NCIS check to buy a copy of PGP! Wild! cab8 -----BEGIN PGP SIGNATURE----- Version: PGP Personal Privacy 6.0 Comment: PGP 6.0 is the "The Living End". iQA/AwUBNmOomDiM2656VXArEQLQRQCgg3l0PO8DOzkj/7McAUI8gQSC03cAnRhk AybC39FkOKoV7ZQUvJcuFTT8 =9sxR -----END PGP SIGNATURE----- Member Internet Society - Certified Mining Co. Guide - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.165.50.96 http://www.primenet.com/~carolab http://www.ozones.com/~drozone - The Cyberdoc *********************************************************************** Will lobby Congress for Food & Expenses!!!

6 8

Jim Bell Update
by John Young 17 Dec '03

17 Dec '03

Forward No. 1 (11/30/98): Jim has been back in the Seattle/Tacoma jail for about a week & 1/2, after a stop-over in Oklahoma City. Not doing much, but is glad to be back because he likes the food better and he has things to do, unlike in Springfield. He doesn't know what the schedule is for his stay at this point, except that there is an attempt to impose more time to his sentence, which he says by the time they accomplish anything in court he will have fulfilled anyway. He requests once again that anyone who would like to help him research the names/addresses of people he thinks are involved in the surveillance efforts against him, to please contact him. His address again is: James Bell #26906086 Federal Detention Center P.O. Box 68976 Seattle WA 98168 ---------- Forward No. 2 (11/30/98): After spending several weeks in Oklahoma, then several more in Springfield, MO, a shrink interviewed Jim for a total of six hours, and said he could find nothing wrong that they could help with. After several more weeks in Springfield, it was back to Oklahoma, for a couple more weeks, and now he is finally back at Sea-Tac. He reports that the prosecutor is asking for 9 months for violation of parole, which would mean Jim might be released in 3 months. He is on Prozac and seems in pretty good spirits. Opinions seem unchanged. ----------

1 0

CJ Update
by John Young 17 Dec '03

17 Dec '03

Forward (11/26/98): They moved CJ from Springfield on the 18th. He is in Oklahoma City awaiting movement supposedly next week. I talked with him and he sounded okay. He would like to receive copies of what has been written and posted about him. He doen't know where he is going. His lawyer should find out next week.

1 0

Process Serving Court Filing Searches
by Bill 17 Dec '03

17 Dec '03

http://www.select-document.com /////////////////////////////////////////////////// To be removed from future mailings, please send an email to mailto:4lemy@lycosmail.com?subject=remove ///////////////////////////////////////////////////

1 0

Build Your Own Cable TV Descrambler for less than $9.99.
by cabgirly333＠hotmail.com 17 Dec '03

17 Dec '03

Cable Television Descrambler - Easy To Make ! Build your own Cable Television Descrambler with ONLY 7 parts from Radio Shack for UNDER $10.00. (don't hit reply, please check bottom of message for more references) --------------------- (Last minute update: "I've seen my letter and instructions sent by individuals that besides violating copy-right laws, are neither responding to the customer nor providing the original, complete set of plans and instructions. Please be advised you are risking your money and patience by ordering from individuals who know nothing regarding this tech/electrical matter" --Raul Mendez) Build your own Cable Television Descrambler with ONLY 7 parts from Radio Shack for UNDER $10.00. REQUIRED SUPPLIES: ================== 1 - Radio Shack mini-box (part #270-235) 1 - < watt resistor. 2.2k-2.4k ohm (part #271-1325) 1 - 75pf-100pf variable capacitor (special order) 2 - F61A chassis-type connectors (part #278-212) 12" - No. 12 solid copper wire 12" - RG59 coaxial cable Tools required: screwdriver & drill. Soldering gun & solder (optional). Get ALL the Premium Movie Channels, Pay per View and Adult Entertainment Channels for... FREE, FREE, FREE !!! Now, if I have your attention... let me tell you how this fantastic opportunity came about. My name is Raul. I live in New York City, New York. I have season tickets to our citys hockey team. I invited a friend of mine to one of the games this last October. He said, "Id love to go if you can have me back home by 10:00 p.m." I told him that some games run just past 10:00 p.m. and would he mind we stay if the game was close. His response was, "No, tonight is the Mike Tyson - Evander Holyfield boxing match and I have it on pay per view" I said, "do you mind if I watch the fight with you"? He said, "sure, no problem". So we go watch this great fight on cable pay per view and we are the only two guys at my friends house. After the fight (since it was so good) I offered to pay half of the cost for the fight. My friends answer was, "no, no, thats not necessary... I got the fight for FREE!". I said to him, "for free, dont those fights cost around $40.00 a pop?" He told me, "yes, they do, but I bought a cable descrambler box from an acquaintance of mine for $300.00". He further explained that this "little black box" gets ALL the pay per view events available! It also tunes in ALL the premium movie channels and ALL the adult entertainment channels. My response (without hesitation) was, "I gotta have one!" "$300.00, no problem where do I pay !!!" Im serious, I was excited. Lifetime premium movie channels, pay per view and adult entertainment all for a one-time fee of $300.00... no way!!! "No way" was right. The guy that sold my buddy the box was no where to be found. I was really disappointed. It was now time for desperate measures. I begged and pleaded with my friend until he agreed to let me take his box apart piece by piece to see how to make one for myself. Luckily it was very easy, if it wasnt simple I knew their was a slight chance it was not going back together so pretty. Now the rest is history... Ive got my own box which I built with my own two hands. Would you like to build one yourself ?!?! If so, would you pay $300.00. Maybe so, maybe not. Probably not, unless you saw one work first. But since that is not possible, I will sell you a complete set of instructions on how to build one yourself for a measly $9.99. However, at that price YOU MUST ALSO ENCLOSE A #10 SELF ADDRESSED STAMPED ENVELOPE WITH 55 CENTS POSTAGE AFFIXED. You might ask, is this some type of rip-off scam deal. The answer is NO! Everything has specific mechanics of how and why they do what they do. We are just used to flipping a switch or pushing a button or moving the mouse across our computer pads. It all happens because of a certain set of processes. The cable television descrambler is no different. However, for legal purposes I must add to this letter that this offer and set of instructions shall be void where prohibited by law and the assembling of parts necessary to make this "little jewel" work is for educational purposes only. To order a set of the instructions send $9.99 by cash, check or money order payable to: Raul Mendez Enterprises, 50 Lexington Av suite 209, New York city, NY 10010 I will mail your order out within 24 hours of receiving it. Further, I will give you a refund upon written request if you are unsatisfied for any reason. Happy Holidays !!! Sincerely, Raul Mendez P.S.: The use of this mini-box if you choose to go on and see if your creation works requires no alteration of your existing cable system. You simply screw it in, right behind your television. P.P.S.: Without the instructions its like figuring out how to set the clock on your VCR. With the instructions, you are guaranteed success.

1 0

NZ or LA in Y2K
by Anonymous 17 Dec '03

17 Dec '03

At 07:54 PM 11/30/98 -3000, Igor Chudov @ home wrote: > >But objectively, there is a large category of people who are bored >with their current lifestyle and gleefully expect a "total breakdown" >of the society so that they could shoot live man sized targets instead >of boring paper targets. > >They are likely to be disappointed by Y2K, or so I expect. (again, >my expectation that social breakdown is not likely to happen does >not preclude me from reasonable preparations) When the power goes out, the rioting and looting starts in the cities. (This isn't New Zealand, baby, this is LA) When the rioters get bored, they'll get into cars. When they run out of gas, they'll stay where they are stranded as the gas pumps don't work. Some fine huntin' then, bubba. Mr. Moisin-Nagant

2 1

y2k+oil refineries
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

a disturbing post on the idea that maybe embedded systems in refineries are so "embedded" they can't even be reached/ isolated. also hugely ubiquitous.... ------- Forwarded Message > > Gary North's Y2K Links and Forums > > 1998-11-30 13:28:22 > Subject: > Fuel Production Plants > Comment: > Let's hope this informant is wrong. If you have counter-evidence, contact me > at P. O. Box 8000, Tyler, TX 75711. > > * * * * * * * * > > I have one very, very reliable source within that industry who tells me that > the oil refining industry can't cope with the task. I am told that the problem > of embedded systems can NOT be fixed EVER, no matter how much time were > allowed. WHY? Because the refineries themselves would have to be dismantled to > uncover these embedded systems. Essentially, the refineries would have to be > destroyed and rebuilt!!! These embedded systems are buried within enclosed > systems. Identifying, testing and replacing these systems is too impractical. > It is financially unsound to do so. The better option is to build new ones. > There is no time to do this with less than 400 days left and the time to build > a new refinery is 3 to 5 years. > > So, what does this mean? My sources, especially the most reliable source tell > me that it means that on January 1, 2000... the oil and gas refineries will > cease operations. These facilities also have converted their inventory > management control systems to small inventory levels so that inventory levels > are running about 1 to 2 days capacity. A few years ago, the industry averaged > a 1 to 6 month supply in storage tanks. Not so today. > > The results: By 1/5/2000 there will be no gasoline, no diesel fuel, no natural > gas, no heating oil, no fuel oil products at all. This means trains will have > no fuel. Trucks will have no fuel. Cars will have no fuel. Electric Power > Plants will have no oil for fuel, nor coal... because there will be no fuel to > power the vehicles to get it to them. So, there will be no electricity. And > you know the remaining domino schematic from that point.

1 0

I Got Mine
by Blanc 17 Dec '03

17 Dec '03

I received my visit from the friendly IRS guys tonight, asking about CJ/Toto. It seems that they had a copy of two emails (which they took from his confiscated computer) with my name on them - one of them the one in which I chastized him for sending a threatening letter to Billg. According to the headers in the message which they showed to me, Toto forwarded my reply through remailer(a)replay.com, Anon-To: billg. They wanted to know about my associations with Toto (I still think of him by that name), of course, of which I had none except through email. In our conversation, I discovered things that I didn't know about Toto's situation: that he had sent threatening letters to the Mounties, and that he had threated to kill the judge trying Jim's case. This is why he will be held and tried in the local jail - because the potential victims (besides the Mounties) are in this area. (sigh) I'm afraid CJ really went over the edge here and backed himself up in a corner. I should have chastized him more severely and counseled him against rash acts of unkindness (not that I hold myself responsible for what he did, but he did pay attention to me). Kind of amusingly, one of them asked if CJ had ever asked me to join the Circle of Eunuchs! heh. I explained that it was Toto's Art imitating Life, creating stories about a revolutionary group based on the list discussions, and that I suspected he called it the Circle of Eunuchs because of the accusations ( by *some people* )that cpunks are ineffectual. We had a bit of discussion on a number of things, including the subject of free speech and how close one can get to it before being subject to arrest. I asked them what that crucial point was when this would happen, since there is no crime until action is actually taken. They said this would be when a direct threat is made and a specific name is mentioned. I referenced as an example the web site which some group put up containing a list of the names of abortion-performing doctors, mentioned in the press as a 'hit list'. They said that a web site with a list of names is not a problem. It is when statements are made about killing the individuals on the list that a person would have "crossed the line". One of the investigators also brought up the issue of the conflict between free speech vs life & liberty, of when one infringes on the other (as in threatening to take away someone's life). I remarked that one must always be prepared for the unexpected, and they made some points about taking threats seriously and the necessity of government agents looking out for their personal safety. I asked if cypherpunks would actually be subpoenaed to appear at CJ's trial. They said it depends on CJ: if he accepts a deal, he would likely get a reduced sentence, but if he takes them to trial then there could be quite a number of Cpunks called forth. I suggested if that happens we could all go out to dinner : ) and they thought this would be quite interesting. One of the investigators expressed a great interest in the cpunk dicussions and concepts; I described something of what the list is about and the flow of subscribers through it, and referred him to the archives, saying '94-'95 were some good years. I'm sure given a little time and several dinners we could convert him to the Dark Side. <g> .. Blanc

12 33

Fwd: FC: Gun groups take aim at new FBI database
by Declan McCullagh 17 Dec '03

17 Dec '03

>Date: Tue, 01 Dec 1998 21:50:05 -0500 >To: politech(a)vorlon.mit.edu >From: Declan McCullagh <declan(a)well.com> >Subject: FC: Gun groups take aim at new FBI database >Sender: owner-politech(a)vorlon.mit.edu >X-URL: Politech is at http://www.well.com/~declan/politech/ > > > >http://www.wired.com/news/news/politics/story/16561.html > > Gun Groups Take Aim at Database > by Declan McCullagh (declan(a)wired.com) > > 4:45 p.m. 1.Dec.98.PST > WASHINGTON -- A controversial FBI > database that records gun buyers' > names, addresses, and Social Security > numbers is "a national surveillance > system" that violates the law. > > So says the National Rifle Association in a > motion for a preliminary injunction filed > Monday in US District Court. > > [...] > > > >-------------------------------------------------------------------------- >POLITECH -- the moderated mailing list of politics and technology >To subscribe: send a message to majordomo(a)vorlon.mit.edu with this text: >subscribe politech >More information is at http://www.well.com/~declan/politech/ >-------------------------------------------------------------------------- >

3 3

Re: NZ or LA in Y2K
by Anonymous 17 Dec '03

17 Dec '03

At 10:51 AM 12/1/98 -0600, Igor Chudov @ home wrote: >I am now considering another possibility: what happens if the power DOES >NOT go out? What would the gunnuts do? Um, start shooting the insulators and pole-transformers? :-P Or, if the power does go out but >looting does not start, would the gunnuts shoot some blacks that they >mistake for "looters" but who are just walking down the streets? Now you're confusing arms fanciers and survivalists with violent racists. Get a grip.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

I know this is a little off topic, but has anyone verified the integrity of a web site called "Spy & CounterSpy" located at http://www.spycounterspy.com/? The site is basically a citizens' guide to counterintelligence, and covers topics ranging from anonymous email and encryption to evading FBI surveillance. The author, Lee Adams, claims to have years of experience in these areas but I'm wondering if this site isn't quite what it appears to be -- a site put up by some freedom-loving guy who wants to help everyone enjoy their privacy.

3 3

Matt Blaze arrested???
by jim finder 17 Dec '03

17 Dec '03

I heard a shocking thing on the radio a few minutes ago. I'm <*really*> sorry I didn't hear the whole report but I'm hoping someone here can shed some light, According to the report a Bell Labs mathematician named Blaze was arrested at the O'Hare airport today, in some kind of FBI sting operation. I didn't hear the whole segment, but it sounded like it had something to do with passing classified (crypto?) information to a foreign government. The part of the report that I heard didn't say what kind of info or what he was charged with, but I got the impression that it was either some kind of ITAR thing or maybe espionage. They did say it was part of a long term sting operation and mentioned something (that I didn't hear clearly) about "other arrests" that either already happened or were likely to happen soon. Was this Matt Blaze? It sure sounds like it must be. Is there a crackdown going on? Has anyone else been busted? Does anyone have more complete information about this? Jim ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

7 6

SASMF, Part 2
by Anonymous 17 Dec '03

17 Dec '03

Space Aliens Stole My Freedom, Part 2 Know Your Spineless SheepleNeighbor(TM) If the banks can be required to Know Their Customers, maybe you can be required to Know Your Neighbor. This is already an established system in Cuba, so importing it should be cheap, fast and easy. ----- "Know Your Neighbor" Requirements AGENCY: Federal Bureau of Investigation ACTION: Notice of proposed rulemaking. SUMMARY: The FBI is proposing to issue regulations requiring FBI-supervised citizen-residents to develop and maintain "Know Your Neighbor" programs. As proposed, the regulations would require each citizen-resident to develop a program designed to determine the identity of its neighbors; determine its neighbors' sources of gossip and political views; determine the normal and expected comings and goings of its neighbors; monitor household activity for things that are inconsistent with those normal and expected activities; and report any activities of its customers that are determined to be suspicious, in accordance with the FBI's existing suspicious activity reporting regulations. By requiring citizen- residents to determine the identity of their neighbors, as well as to obtain knowledge regarding the legitimate activities of their neighbors, the proposed regulations will reduce the likelihood that citizen- residents will become unwitting participants in illicit activities conducted or attempted by their neighbors. It also will level the playing field between citizen-residents that already have adopted formal Know Your Neighbor programs and those that have not. --- Minimum steps to take to comply with the Know Your Customer rule. Identify the neighbor. Paragraph (d)(2)(i) requires that the Know Your Neighbor program provide a system for determining the true identity of prospective neighbors. If a citizen-resident has reasonable cause to believe that it lacks sufficient information to know the identity of an existing neighbor, paragraph (d)(4)(ii)(A) also requires that the program provide a system for determining the identity of that neighbor. --- Determine the source of people and property. Paragraph (d)(2)(ii) requires that the Know Your Neighbor program provide a system for determining the source of a neighbor's possessions and household members. The amount of information needed to do this can depend on the type of neighbor in question. Determine normal and expected comings and goings. Paragraph (d)(2)(iii) requires that the Know Your Neighbor program provide a system for determining a neighbor's normal and expected comings and goings involving the citizen-resident. A citizen-resident's understanding of a neighbor's normal and expected comings and goings should be based on information obtained both when a neighbor relationship is established and during a reasonable period of time thereafter. It also should be based on normal comings and goings for similarly situated neighbors. Without this information, a citizen- resident is unable to identify suspicious comings and goings. Determine if activity should be reported. Once an activity is identified as inconsistent with normal and expected behavior, paragraph (d)(2)(v) requires that a citizen-resident determine if the activity warrants the filing of a Suspicious Activity Report. This is consistent with a citizen-resident's existing obligations under 12 CFR 353.3(a). --- A. Reasons for and objectives of the proposed rule. The proposed Know Your Neighbor rule is designed to deter and detect neighborhood crimes, such as plots to establish "Constitutional government," gathering of information about alleged "crimes" committed by government agents, and meeting to discuss subversive literature such as the Constitution. B. Requirements of the proposed rule. The proposed rule would require citizen-residents to identify their neighbors, determine their neighbors' normal and expected activities, determine their neighbors' sources of possessions and household members, monitor neighbors' activities to find those that are not normal and expected, and, for activities that are not normal and expected, identify which are suspicious. Know Your Neighbor monitoring would be similar to monitoring that citizen-residents already do. For example, citizen-residents monitor neighbor activities to ensure that comings and goings exceeding 100 per month are reported under the Neighborhood Secrecy Act, to ensure that neighbors do not overuse their driveways and sidewalks, and to ensure that required comings and goings accurate and timely. ----- Editor's Note: The worst part of this parody is that it's true. Cuba, like most communist dictatorships, has a highly developed system of block watchers. They are responsible for all of the foregoing, making their reports to the secret police. The U.S. government is instituting a system of "bank account watchers," toadies in the supine, excruciatingly closely regulated banking industry, who will have to "know you," get to know your normal and expected bank account activity, and watch your bank account activity to detect and report "Suspicious Transactions." Welkomm to Orwell's 1984. Welkomm to Nazi Amerika. Hold your arm out straight... there... this will just sting a bit... Does anyone not get it yet? There is _nothing_ in the Constitution that gives the federal government any power to subject the American people to financial surveillance, to restrict or require reporting of cash transactions in any quantities, to restrict or encumber firearms ownership to anyone not actually serving time in a prison, or to do _any_ of the onerous abominations being thrust upon us in new and terrible forms almost daily. Does anyone not get it yet? The federal government is forfeiting, just as fast as its android minions can think up new ways to do it, its last shreds of any claim to legitimacy. They may as well fly the skull and crossbones over government buildings. Their occupation army of marauding thugs is _here_, bringing to ghastly life the very words of the bill of particulars laid against King George III of England by the Founders of this now-decayed, now-corrupt, hollow Republic, in the Declaration of Independence. Do they _never_ learn? (Obviously not) Will we _have_ to go through it all again? (Obviously yes) Has the line been crossed? (Obviously yes) Has force been initiated? (Obviously yes) Has the federal government placed itself outside the law? (Obviously yes) So be it. Cry "Havoc!" and let loose the dogs of war. The Revolution is upon us. We have nothing to lose but our imminent slavery. Sam Adams has a piece of advice: Keep your own counsel. Translation: Do your own thing and don't look to prop up your courage with the flawed courage and lack of trustworthiness of others. Don't be a groupie -- be a commando. Required re-reading: http://www.dhc.net/~toarms/henry.htm FuckingFedUpMonger

1 0

Check out the New ZDNet and ZDTV Forums!
by ZDNet Announce 17 Dec '03

17 Dec '03

Dear Forum Member: If you are reading this message, you are a participant in the ZDNet or ZDTV message boards (a.k.a. ZDNet Forums or Community). I would like to take this opportunity to tell you about some changes that will affect you on December 8. We are moving from our current forum software, called Podium, to version 1.0 of new forum software created by Deja News. On Dec. 8, when you follow a link or bookmark to one of our forums, you will be directed to the new software automatically. You don't have to download or install anything -- our forums remain entirely Web-based -- but the apearance and functions of the forums will be different. All your messages posted in Podium are being brought over, so your conversations won't miss a beat. We have been testing the Deja News software in three of our current forums for several months, and we have also created a test forum so you can try out the software and give us your feedback. We know that any change is disruptive; you will have to re-learn some forum functions and get used to a new interface. We apologize in advance for the hassle. We felt the switch to the Deja News software was the only way to improve the performance and reliability of the forums, plus the new software has a better search engine and great possibilities for integrating Usenet newsgroups into our offerings. If you have not yet had a chance to try out the new software, you can do so at any one or all of the forums listed below: Test Forum http://chkpt.zdnet.com/chkpt/zdn11202/f5.dejanews.com/frames/test.html Help Channel General Discussion http://chkpt.zdnet.com/chkpt/zdn11202/f5.dejanews.com/frames/generaldiscuss… Microsoft Office http://chkpt.zdnet.com/chkpt/zdn11202/f5.dejanews.com/frames/msoffice.html Gadget Gab http://chkpt.zdnet.com/chkpt/zdn11202/f5.dejanews.com/frames/gadget.html Please give us your feedback about the new software in the Test Forum. We are using your comments to make the software work better, so we appreciate as much of participation as possible. In addition to the new software, we will be merging several forums. Over the months, ZDNet and ZDTV have created a number of overlapping message boards, and some forums have lost their appeal to users. As part of the switch to Deja News, we'll be integrating forums on similar topics. As a result, expect most forums to be busier after Dec. 8. Thank you for your time and effort. We are looking forward to seeing you in the new forums, and we are glad to have you as a part of the ZDNet Community. We will send you just a few more e-mails like this one to keep you up-to-date on the switch, but we promise not to continue spamming you after the transition is complete. Regards, Wendy Frankwich ZDNet and ZDTV Community http://chkpt.zdnet.com/chkpt/zdn11202/www.zdnet.com http://chkpt.zdnet.com/chkpt/zdn11202/www.zdtv.com _______________________________________________________________________ To be removed from this list, simply reply to this message with "unsubscribe" as your subject.

1 0

Re: "Export" controls
by Anonymous 17 Dec '03

17 Dec '03

>Can you give me an example of a commercial vendor who has suffered >because someone bought a "dangerous" product ( Windows, for example ) at >retail and carried it out of the country in a suitcase? My guess would I cannot give such example because hard crypto products are not available to the general public. I am unaware that microshit OS has hard crypto built-in. The only hard crypto package I have ever seen for sale at mail-order (and thus not anonymous) is NAI's PGP (and I have never seen any hard crypto available in a store for cash - but that can only mean that there is no perceived demand). However, any hard crypto that would work on system level and encrypt all communications is not available for purchase (it is available for free, though, in the form of IPSec package with 128-bit block ciphers for *BSD operating systems.) There is a number of VPN companies that offer crypto boxes, but AFAIK they either do not mention crypto scheme they use or they say DES. There is only one VPN company that advertises 128-bit crypto in it's product. >> [ For example, try to buy one of IBM crypto-cards - give them a call >> and ask what does it take to purchase one with hard crypto on it >> >Save me the phone call and describe your experience. BTW - IBM derives a You'll miss all the fun. After talking to 5-6 departments one concludes that no one knows anything about 4758, but they are all nice and helpful, and forward your call to each other. 4758 does not exist for casual callers. My guess is that if you have been dealing with IBM for some time you may be able to get it. To recap, there are no hard crypto drop-in hardware products available to general public in the USA today. >just write a damn book, source, VHDL etc. You can even export that. My The question is how to make money by selling hard crypto in the US. NAI seems to be the only company that can get away with so-called "publishing exception" in the commercial world. Their joining the key recovery alliance is probably unrelated :-) >Disk encryptor - SCSI/EIDE, a bump in the wire between the motherboard >and the disk drive. With its own smartcard/keypad interface, keys are >never seen by OS. It doesn't solve the security problem while the system There are many neat ideas. But no hardware.

1 0

L5 algorithm patent, and free eval version
by Anonymous 17 Dec '03

17 Dec '03

On Mon, 5 Oct 1998, Joey Roa wrote: > My name is Joey Roa and I am Professional Services Team Leader of JAWS > Technologies Inc. I have recently become aware of your list. A colleague > ... > The L5 algorithm is not yet published as we are waiting assurances from out > patent attorneys that we have some protection for marketing purposes. Hello Joey et all, Now that L5 has been patented, will you and your colleagues at Jaws Technology make the L5 algorithm details available to the professional cryptography community for independant verification. Could you also provide the Canadian and/or US patent numbers? (Announcement of L5 patent: <http://www.newswire.ca/releases/October1998/27/c6731.html>) To cypherpunks readers, the free "shareware" version is available from: <http://www.jawstech.com/products/jawsl5/download-free-trial/L5_ShareWare_Se…> I think the coderpunks readers might enjoy playing with this program. It has proven entertaining so far for me.

3 2

Re: Matt Blaze arrested???
by Anonymous 17 Dec '03

17 Dec '03

> X-Originating-IP: [208.198.164.2] > From: "jim finder" <jim_finder(a)hotmail.com> > To: cypherpunks(a)cyberpass.net > Cc: cryptography(a)c2.net, mab(a)research.att.com > Subject: Matt Blaze arrested??? The originating IP for this hotmail posting is lpwa.com, the Lucent Personalized Web Assistant. Ken Williams had posted a URL last week which described how to send anonymous mail using lpwa as a proxy to the hotmail service: > I came across a funny article about a "CIA, DEA, FBI, Lucent > Technologies, Replay.com, Seed-bank.com Grand Conspiracy" at > http://members.tripod.com/~spookbusters/sunnysnooping.htm This is easy to do and provides moderate levels of anonymity. You set lpwa.com as your proxy in the browser settings, and then set up your hotmail account and send the mail. Maybe Jim Finder was just testing the idea. Blaze has attracted one or two cranks who try to harrass him, and this may be another attempt to make some trouble for him.

1 0

Y2K and Atlas
by Matthew James Gering 17 Dec '03

17 Dec '03

-----Original Message----- From: [somebody] Sent: Tuesday, December 01, 1998 5:04 PM To: philosophy of objectivism Subject: For the ARF Ed Yourdon is name known to aging geeks as the developer of structured systems analysis & design. His text on the subject is still in use in C.S. courses around the country. He's also the author of a dozen or so books about programming, particularly mainframe programming. In early 1998 Yourdon and his daughter Jennifer co-authored "Time Bomb 2000: What the Year 2000 Computer Crisis Means to You." (As you might infer from the title, the Yourdons aren't exactly sanguine about the potential impact of the Y2K problem.) (Nor am I.) Yourdon maintains a web site featuring, among many other things, reading list both technical and non-technical about programming and Y2K. Introducing his non-technical list of Y2K books, he recommends Atlas Shrugged with the following comment: >As for Ayn Rand's Atlas Shrugged ... well, you probably read it in >college, but you've probably forgotten all about it. You probably don't >remember John Galt's famous line, "I will stop the engine of the world." >Well, read the book again now, with Y2K-colored glasses, and remember that >computer programmers are reading it, too. The question you need to ask >them is whether they intend to stay on the job if the lights go out on >January 1, 2000, and whether they feel sufficiently motivated to re-start >the engines of the world. If you don't think that's a question worth >asking, then you haven't read Atlas Shrugged. So I guess I'm not the only person to have made that connection... http://www.yourdon.com/books/coolbooks/coolby2kother.html

1 0

Re: "Export" controls
by Michael Motyka 17 Dec '03

17 Dec '03

> I am unaware that microshit OS has hard crypto built-in. > I was pointing out a retail parallel, not a crypto parallel. You sure it's not Microshaft? More meanings. > The question is how to make money by selling hard crypto in the US. > A little experiment is often a good thing. I heard that the guys who made the DES cracker have had $$ requests for machines and/or chips. > To recap, there are no hard crypto drop-in hardware products > available to general public in the USA today. > In case you missed it, my original reply was an attempt to open discussion on some type of cooperative effort. Look at http://www.xilinx.com/products/xc4000XLA.html for prototype purposes. I wonder how many DES or IDEA engines could be put on a 500K gate array? It would fit about 35 instantiations of Twofish. That should be enough for a phone or a disk encryptor. It's not trivial but - Products can be done. On a shoestring. By the right people. Even non-geniuses. Who want to get them done. <-- the key item No sense pushing the button without critical mass. sigh... A friend's t-shirt many years ago: A penny for your thoughts, twenty bucks to act them out.

2 1

A person who counsels to fail to comply with the Act
by Anonymous 17 Dec '03

17 Dec '03

Check out this bit of american slavery: "Failing to register or otherwise comply with the Military Selective Service Act is, upon conviction, punishable by a fine of up to $250,000, impris- onment for up to five years, or both. A person who knowingly counsels, aids or abets another to fail to comply with the Act is subject to the same penalties." www.sss.gov/teach3.pdf (for teachers, note) And this anti-FIJA bit: Except as may be authorized by a judge, no person or entity shall distribute or attempt to distribute any written materials tending to influence, interfere, or impede the lawful discharge of the duties of a trial juror, or communicate or attempt to communicate with any person summoned, drawn, or serving as a trial juror in the Superior Courts in Los Angeles for purposes of influencing, interfering, or impeding the lawful discharge of the duties of a trial juror in, or within 50 yards of any public entrance to, the facilities within which the Superior Courts conduct jury trials within this County. (Rule 5.2 added and effective 7/1/97.) http://www.co.la.ca.us/courts/superior-auc/CourtRules/Chapter5.htm#5.2

1 0

test1 #1
by ichudov＠Algebra.COM 17 Dec '03

17 Dec '03

test 1

1 0

Re: Matt Blaze arrested???
by jim finder 17 Dec '03

17 Dec '03

>Date: Wed, 02 Dec 1998 11:36:51 -0500 >From: Matt Blaze <mab(a)research.att.com> > >I'm afraid you're confused. Whoever this report was about, it >wasn't me: > >* I'm not at Lucent Bell Labs. (I'm at AT&T Shannon Labs.) I'm not > aware of any other Blaze at either AT&T or Lucent, however. >* I'm not a mathematician. (I'm a computer scientist.) >* I've not been to ORD, or any other midwestern airport, > since August. (I do fly a lot, though). >* I never been arrested. (I did accently set off the antitheft > detector at a local bookstore once, but they let me go > when I showed them my reciept). > >-matt > Thanks for clarifying this! I'm very sorry to have started an unfounded rumor but I'm glad to know that you haven't been arrested. Thankfully, it looks like everyone assumed that I was just making this up, so I hope no serious damage was done and that the rumor didn't spread. That said, there <*was*> a radio report. It was on WBEZ 91.5 last night, and, as I said, I only heard the last part of the report. It was a news report about an arrest made at the O'Hare airport for something involving mathematics and foreign governments. I was almost 100% sure they said it was Blaze of Bell Labs who was arrested, but I guess it possible that I misheard. Perhaps they were quoting you or talking about you for some other reason. I remember that someone at bell labs (you???) had some problems with export authorities a few years ago, and maybe this is what they were talking about? Anyway, has anyone heard any more about this story, now that we know it wasn't Matt Blaze who was arrested? Humble Apologies, Jim PS I'm using a non-work account because I work for a large Chicagoland company that does some crypto business and I <*do not*> want to be seen as representing them on the cypherpunks list. Some of the work they do goes against cypherpunk (and my own) goals, and I'd rather not have people think I'm speaking for them. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

SASMF, Part 1
by Anonymous 17 Dec '03

17 Dec '03

Space Aliens Stole My Freedom, Part 1 Know Your Gutless SheepleCustomer(TM) Let's just take a peek at how the new FDIC proposed reg would look if transposed into an FCC setting: ----- "Know Your Customer" Requirements AGENCY: Federal Communications Commission ACTION: Notice of proposed rulemaking. SUMMARY: The FCC is proposing to issue regulations requiring FCC-supervised communications carriers to develop and maintain "Know Your Customer" programs. As proposed, the regulations would require each carrier to develop a program designed to determine the identity of its customers; determine its customers' sources of communicated information; determine the normal and expected calls of its customers; monitor account activity for calls that are inconsistent with those normal and expected callss; and report any calls of its customers that are determined to be suspicious, in accordance with the FCC's existing suspicious activity reporting regulations. By requiring communication carriers to determine the identity of their customers, as well as to obtain knowledge regarding the legitimate activities of their customers, the proposed regulations will reduce the likelihood that communications carriers will become unwitting participants in illicit activities conducted or attempted by their customers. It also will level the playing field between carriers that already have adopted formal Know Your Customer programs and those that have not. --- Minimum steps to take to comply with the Know Your Customer rule. Identify the customer. If a communication carrier offers private leased communication services, it is important that the carrier understand a customer's personal and business background, source of information to be communicated, and intended use of the private leased communication services. --- The extent of the information regarding the customer that may be necessary to fulfill the carrier's Know Your Customer obligations should depend on a risk-based assessment of the customer and the calls that are expected to occur, and should be addressed within the communication carrier's Know Your Customer program. --- Determine the source of information. Paragraph (d)(2)(ii) requires that the Know Your Customer program provide a system for determining the source of a customer's information. The amount of information needed to do this can depend on the type of customer in question. Determine normal and expected calls. Paragraph (d)(2)(iii) requires that the Know Your Customer program provide a system for determining a customer's normal and expected calls involving the communication carrier. A carrier's understanding of a customer's normal and expected calls should be based on information obtained both when an account is opened and during a reasonable period of time thereafter. It also should be based on normal calls for similarly situated customers. Without this information, an institution is unable to identify suspicious calls. Monitor the calls. Paragraph (d)(2)(iv) requires that the Know Your Customer program provide a system for monitoring, on an ongoing basis, the calls conducted by customers to identify calls 'that are inconsistent with the normal and expected calls for particular customers or for customers in the same or similar categories or classes.' The proposed regulation does not require that every call of every customer be reviewed. Rather, it requires that a financial institution develop a monitoring system that is commensurate with the risks presented by the accounts maintained at that institution. Determine if call should be reported. Once a call is identified as inconsistent with normal and expected calls, paragraph (d)(2)(v) requires that a communication carrier determine if the call warrants the filing of a Suspicious Activity Report. This is consistent with an carrier's existing obligations under 12 CFR 353.3(a). --- A. Reasons for and objectives of the proposed rule. The proposed Know Your Customer rule is designed to deter and detect communication crimes, such as obscene phone calls, getting tax advice, and discussing the Constitution. B. Requirements of the proposed rule. The proposed rule would require communication carrier to identify their customers, determine their customers' normal and expected calls, determine their customers' sources of information communicated in calls, monitor calls to find those that are not normal and expected, and, for calls that are not normal and expected, identify which are suspicious. Know Your Customer monitoring would be similar to monitoring that communication carriers already do. For example, communication carriers monitor customer calls to ensure that calling volumes exceeding 10,000 per month are reported under the Communications Secrecy Act, to ensure that customers do not overuse their telephones, and to ensure that required calls are accurate and timely. ----- Editor's Note: Putting this in an FCC context makes it pretty clearly bizarre and unconstitutional, doesn't it? Where do these fuckers get off pulling this Nazi shit? Just to carry it all the way into Wonderland, we've drawn up this questionnaire, also in the telephone context: Sample Questionnaire 1. Is this a __residential or __business account? 2. Approximately how many calls do you expect per month? a. Incoming ____ b. Outgoing ____ 3. List the subject matter of expected calls (use extra sheets if necessary: ____ 4. List the telephone numbers from which you expect to receive calls (use extra sheets, etc.) ____ 5. List the telephone numbers to which you expect to place calls (use extra, etc.):____ 6. List the names of people with whom you expect to speak: 7. List the Social Security numbers of people with whom you expect to speak: ____ 8. List the political organizations to which you belong: 9. List the political organizations to which people with whom you expect to speak belong: ____ 10. Are any of the organizations in (8) or (9) on the Attorney General's list? Yes__ No__ 11. If the answer to (10) was Yes, do you have a current and valid waiver for that (those) organization(s)? Yes__ No__ 12. If the answer to (11) was No, proceed directly to federal prison. Do not pass urine; do not collect $200 from any ATM. 13. Do you regularly call your mother? Yes__ No__ 14. If the answer to (13) was Yes, list the topics you commonly talk about with your mother (use extra, etc.) 15. What are your sources of information for your telephone conversations?____ 16. List all facts known to you, about which you expect to speak in your telephone calls:____ 17. List all times at which you expect to receive or place calls:____ 18. Attach transcripts of all conversations you expect to have. In lieu of transcripts, recordings may be attached. 19. Staple this form to your head, jam a toilet plunger handle up your ass, waddle to the nearest telephone, dial "1" and say, "I'm ready. Pick me up." Wait at your front door. ----- FuckingFedUpMonger

1 0

MERRY CHRISTMAS! guys!
by Bernardo B. Terrado 17 Dec '03

17 Dec '03

sorry if you're angry with this ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ "If a student is particular about his studies, especially while he is too young to know which are useful and which are not, we shall say he is no lover of learning or of wisdom; just as, if he were dainty about his food, we should say he was not hungry or fond of eating, but had a poor appetite. " ---- PLATO By the way, it's Bernie not Bernardo. ``````````````````````````````````````````````````````````````````````````````

1 0