December 2003 - cypherpunks-legacy

Re: Money supply is fake anyway
by David E. Smith 17 Dec '03

17 Dec '03

> > Banks "invent" money on a daily basis. > > Really? Since when? > That's something from college-level economics. If a bank has reserves in excess of their reserve requirement, they can loan out the excess, several times, gambling that they won't be made to provide all of that alleged money in a more negotiable (outside of the bank system) form, like cash. As I understand it, that's where a lot of the 80s Savings & Loan problems came from - too many people wanted their 'money' in a more negotiable form too quickly, and they had to fold. (OTOH, it's been a long time since I took that college-level economics course.) dave --- David Smith, Intellectual Terrorist http://www.midwest.net/scribers/dsmith/

3 2

Email privacy policies at universities
by Rich Graves 17 Dec '03

17 Dec '03

We don't really have one, because we respect privacy in general. Kind of a "congress shall make no law" approach. Skidmore seems to have a pretty reasonable policy at http://www.skidmore.edu/help/rules/mail-privacy.html If you know of others, please pass along for the discussion on the resnet list, http://www.acns.nwu.edu/resnet/resnet-forum/resnet-forum.html The subject line there reads "off topic" for that list, but I don't think it is. -rich

1 0

Re: No matter where you go, there they are.
by jim bell 17 Dec '03

17 Dec '03

At 07:48 PM 4/11/96 GMT+01DST, Powers Glenn wrote: >- It's called "S/A" (Selective Availability) which is the NWO term for adding >- errors that "authorized" users can remove. (Not to be confused with A/S, or >- anti-spoofing) It was originally intended to be turned on in wartime to >- deny the enemy accurate fixes, but during the Gulf War military GPS >- receivers were so scarce that the soldiers had to use commercial products, >- so the S/A actually was turned OFF then! >- >- Since then, pressure has been building to turn off S/A, since its usefulness >- is nearly zero. Even so, the amplitude of S/A errors are only a little >- larger than natural errors caused by satellite timing errors, atmospheric >- propagation variations, etc. The result is that DGPS is useful, which is >- (more or less) a fixed antenna and GPS system which knows where it is, and >- subtracts where it "seems" to be by GPS every second, and broadcasts the >- resulting error data on some terrestrial system to receivers locally. The >- result is errors down to the 1-meter level and even lower. That system >- compensates for both natural errors and S/A, so the whole purpose of having >- S/A is negated. Eventually S/A will probably be turned off permanently, but >- even then we'll want to continue to use DGPS systems. > > Close, but not quite: >S/A is an ADJUSTABLE variable, not on/off. Huh? You sound like you're trying to correct me, but you're not. I'm already aware that the magnitude of S/A is adjustable; nothing I've said above contradicts this. >it can reduce accuracy to 10 meters or 100 meters or whatever. For ordinary C/A code (the kind civilians are allowed to use) it can't "reduce accuracy to 10 meters." The minimal error in C/A mode is based on atmospheric propagation and other errors. Adjusting S/A down or off can eliminate the ADDED error, not reduce it below C/A's normal minimum RMS value. >It's a DoD term, not NWO term. I was being a bit facetious. Nevertheless, my implication was correct: The term is "selective availability" and it was specifically chosen to sound "positive" rather than "negative." (I can't tell you exactly which issue of GPS World magazine mentioned this, but I've read every copy since it was started a few years ago. It was probably in this magazine. It would have been more accurate, I suppose, to call this "Newspeak.") > The "this is where you really are" percision location (forgot >the designation off hand) is ENCRYPTED (yes, there is crypto >revelance here...) in the data stream from the satellites. It's called "PPS," for "Precise positioning Service." Check the most recent issue of GPS World for an article on making that even more accurate. Nevertheless, even PPS is only accurate to about +/- 2 meters; DGPS is easily accurate to 1 meter, and I've seen ads that talk about 0.15 meter accuracy with differential GPS in C/A mode. > The difference S/A makes is on the order of magnitude, therefore not >"useless." That depends on what you compare it to. If you compare it to non-differential, C/A code signal, it turns +/- 25 meter (approx, of course) errors to upwards of +/- 100 meter errors, although as I understand it S/A is normally toned down to about +/- 50 meters. BTW, I don't doubt that DoD has the technical ability to increase S/A even beyond +/- 100 meters, but that would be a pointless exercise. It would also strongly piss off the average civilian GPS user, and since by far the largest number of GPS users are now civilian (and this number is growing rapidly) the DoD knows which side of its bread is buttered. And using DGPS, the effect of S/A is essentially nil, since both it and most "natural" (unintentional) errors are cancelled out. So, what part of "useless" do you not understand? Please note that I didn't say it had no effect, merely that it was "useless." As in, no militarily significant effect. If you still disagree, please formulate a plausible (and, ideally, a PROBABLE) scenario under which the presence of S/A achieves a military benefit based on a rational view of whichever "enemy" you choose. Since DGPS receivers are available for well under $1000, you're going to have to hypothesize a poverty-stricken enemy indeed. >It should be pointed out that different regions of the >earth can have different degrees of accuracy based on the S/A system. > I doubt S/A will ever be turned off, but this is my opinion. Just a couple of days ago, I saw a note HERE reporting that Clinton had backed down (his normal behavior, interestingly!) and had decided to turn off S/A. I haven't seen any confirmation of this claim, but then I haven't looked either. If that report was correct, your opinion is already wrong. I am fully aware that it could later be turned back on, if there was a genuine reason to do so. This would be in line with the original intent behind S/A, to turn it on only when there was some real reasons to do so. Why they did not adopt this planned mode years ago, I don't know. >I know Jim's opinion. Discussion of this point is pointless. In other words, "Don't confuse me with the facts." > DGPS transmission are made from a multiple single points, which >(to the best of my knowledge) are not networked. > glenn That's only partially true. There is nothing to prevent the world-wide distribution of a data stream which represents the complete differential correction data for GPS, broadcast from multiple locations by FM subcarrier, idle cell-phone site, HF, pager channels, or other. In fact, it has been argued that it should be transmitted, in the band of the GPS signals(so that a separate differential antenna is not required), from satellites, with the receivers built into GPS units, so that it would be available to everyone no matter where he is. The attraction of this system, from a government/military standpoint, is that it would tend to foster dependance on this correction system by the average GPS user, and would tend to deter development of DGPS stations independent of the government. That means that the government would actually be able to keep the "S/A advantage": When it wants accuracies to be degraded, they will be. Its current policy, however, practically guarantees that DGPS stations will be broadcasting in every major population center within just a few years. Isn't it a good thing that government is so (CDA alert!) fucking stupid? Jim "He only talks about one subject" Bell jimbell(a)pacifier.com

1 0

InfoWarCon: Call for Papers (Sept in Wash DC)
by John Gilmore 17 Dec '03

17 Dec '03

Here's our chance to talk with, learn from, and educate the folks who are pushing the concept of information warfare and seeing where it goes. The conference itself costs $1000 to attend, but I bet it's free to speakers. So dig out some related concept you've been wanting to pin down on paper, write it up, and send it in. It'd be pretty silly to run or defend against an InfoWar without the cypherpunks, so let's introduce ourselves before the hostilities begin. I've got a paper in mind... John Excerpted from http://www.ncsa.com/iwpaper.html. Note that this "NCSA" is the National Computer Security Association, not the guys who wrote "NCSA Telnet". Fifth International Information Warfare Conference "Dominating the Battlefields of Business and War Sept 5-6, 1996, Washington, DC Call for Papers We are seeking forward thinking papers, demonstrations and interactive concepts for presentation to an audience of 1000+ attendees; representing civilian and military from more than 20 countries, all branches of the US Government and the top US corporations. The papers should offer new perspectives, attitudes, studies, and technologies that can be used for the advancement of the field. You are free to submit on any subject matter, including, but not limited to: <UL> <LI> Battlefield Dominance <LI> Industrial Espionage <LI> Military Perspectives <LI> Policy Quagmires <LI> Personal Privacy <LI> Denial of Service <LI> Terrorism and Counter-Terrorism <LI> Threats to Global Electronic Commerce <LI> Anonymous International Bankings <LI> The convergence of the commercial and the military in the Post Cold War World <LI> InfoWar Technologies <LI> Case Studies <LI> Your thoughts and ideas </UL> Please submit your 1-2 page concept white papers NO LATER than Sunday, May 5, 1996. The evaluation committee will let you know the results by Wednesday, May 15, 1996. We will need your complete submission no later than Monday, July 15, 1996. Send your papers to Betty(a)Infowar.Com. InfoWar Conference &copy Copyright, 1995, NCSA &#174.</H5>

2 1

Re: Bank transactions on Internet
by Dave Emery 17 Dec '03

17 Dec '03

> >>>>> "Dave Emery" <die(a)pig.die.com> pessimised: > > > [... the tools are too expensive...] > > [... and the skills required are too high...] > > [... for anyone on cypherpunks...] > > Come on, Dave, this isn't alt.2600! > I want to immediately applogize to the list readership if anything in my posting seems to imply that I doubted that some of the list members possess the skills or brainpower to build a key cracker. I am sure a considerable number (at least by comparison with most other net communities) do, and many more certainly have the raw brainpower to learn the required technology if not currently up on it. Motivation and available time are another matter however. My only disparaging comment (at least as intended by me) was that the task was probably beyond some of the alt.2600 type crackers who primarily use canned programs and scripts to perpetrate their attacks. That comment was actually intended as a left handed warning about the advisablity of releasing a readily reproduced hardware key cracker design to the world at large. This seems especially true if entire FPGA array PC plugin boards are becoming a commodity item and readily available and the cracker recipe is buy one of those and install this canned software on it. > Most of the subscribers to this list are professionals -- engineers, > programmers, mathematicians, lawyers -- not phone phreaks. I'm sure > that there are more than a few of us with the knowledge, experience, > and free access to the resources needed to handle most relatively > small-scale designs like this. > > (It's like saying that no one on cypherpunks has access to the > distributed computing resources necessary to perform other sorts of > brute-force cracking -- which is patently ludicrous.) > I'm sorry, but rereading my post I simply don't find the statement that cypherpunks readers couldn't carry out the task, My comments were directed at the original cost and effort estimates that I thought were a little low - I'm certainly aware that many cypherpunks list members are working professionals or grad students/researchers with very considerable "free" resources at their beck and call. And even the pessimistic resource estimate I posted is not beyond motivated people. particularly if they see a large profit or advantage in it. But most importantly I may be making a very nieve assumption about the list readership - that it is mostly good guys and not thieves preparing to rip off hundreds or thousands of credit card numbers/ bank access codes from the Internet for gain. It is the implication that for this thief group it would be an easy $400 project to *design* and build a useful key cracker that I was challenging. (I might add that there certainly are other easier ways of obtaining large numbers of credit card numbers and access codes by such means as tapping unencrypted non-Internet data or voice communications and/or altering existing credit card terminal firmware to make it save up and deliver credit card numbers via a backdoor or bugging device. Gaining illegal access to the phone cables or credit terminals at a mall is certainly easier for most crackers and more typical of their experiance base than designing efficient pipelined key schedulers that fit into an FPGA). Presumably most of the competant, talented cypherpunks who could easily design a cracker are already far too well paid for these design skills to have much of any motivation to build such hardware for criminal purposes. And I might add that to my knowlage (admitedly rather limited) I know of no hardware crackers having been built with this technology (at least outside of the classified world). If it really is a simple trivial project that can be carried out with $400 worth of resources why aren't there NYT front page articles about someone having built a useful one and cracked something ? There certainly are lots of ambitious young grad students with lots of resources available to them and time to do this who would love to make their reputation by being the first to crack DES in under a week ... > For instance, from where I'm sitting in my *home* office, I can see > the full development packages for Xilinx and AT&T FPGAs, Viewlogic > VHDL, schematic, and simulation tools, an HP 1660A logic analyser, and > a Tek THS 720 500 MHz digital scope. > You have better tools than I do (I have a 16500B for example rather than a 1660A (which I'd love), but not hugely so, and I've been mostly semi-retired, taking a sabbatical to care for my newborn son and haven't wanted to spend the money to update resources I'd be largely using occasionally for very casual playing. > And I doubt if I'm the only one here who does this for a living. > Judging from other posts I've seen I have little doubt. Certainly I have done related stuff in the past... > The problem isn't resources, but time and motivation -- what sort of > situation would it take to get me (for instance), and one of > cypherpunk's cryptography wizards, to take the time to collaborate on > something like this. I completely agree. But I'd be surprised if it took much of a crypto wizard to do a brute force cracker as a just a simple brute force cracker. The task would demand much more of the skills of a good clever parallel logic designer to figure out how to effectively pipeline the well known and well defined crypto algorithms within the constraints of a still limited FPGA. What a crypto wizard might add might lie more in the direction of optimized strategies for key generation and scheduling to reduce the number of clock ticks and or gates devoted to this. The game of course is how many keys per second per dollar... anyone can build something that will eventually try a key, it is building something that will try keys at a maximum rate on cheap hardware that is interesting. (Sorry to take so much list bandwidth on this).. Dave Emery die(a)die.com

3 2

Know Your Net.Enemies Project [noise]
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Rich Graves <llurch(a)networking.stanford.edu> ambiguously wrote: >definitely be added. I'll write the FUCKING STATIST section. Do you use 'FUCKIN' as an adjective or as an active verb? :) Sorry, couldn't resist :-> JFA

1 0

Re: Scientologists may subpoena
by SBinkley＠atitech.ca 17 Dec '03

17 Dec '03

>with bated breath to see whether or not the subpoena is issued. But if >chaning outside the US won't even work, then the remailers aren't going >to do a whole lot of good. What if we set up a chaining remailing system in as many countries as possible, all working in double blind mode. You could have it randomly pick 20 or so remailers before actually sending the message to its destination. That isn't a very clean method, but would sure slow down the process of obtaining court orders in each respective country. I have this other idea, but it would be difficult to set up. Again, with many many remailers, you could set it up, so that any message you send is sent to a random FTP site of the day. Each of the remailers randomly picks messages out of the pool at the FTP site, and sends it on its way (all is encrypted of course). At the end of the day, the FTP site is erased, and a new one is set up somewhere else (all remailers would then scan there). The beauty is that when a remailer pulls a message out of the FTP site, it has no idea where the message came from, nor which remailer (country) sent it there (providing the pooled messages have had the return addresses removed). This would make it very difficult to track down to the source. The disadvantage is that it requires cooperation between remailers, and that a message cannot be replied to. Anyway, just my $0.02 /sb

1 0

No Subject
by JonWienke＠aol.com 17 Dec '03

17 Dec '03

e. > However, since the protocol requires that Alice send out location data, >once >she starts using it she reveals her physical location to Eve, Mallory, and >anyone ese > who can see the packets. Since the nature of the protocol is that Alice's >location does >not change frequently (and needs to transmitted via a trusted channel to >Bob when it >does), after the first usage Mallory *knows* the physical location he is >trying to >simulate, and can use this information for future spoofing. > > The upshot of this is that Denning's scheme not only provides no >security against >spoofing, and leaks potentially sensitive data about locations. > > If Sadaam Huissain (sp?) had used this scheme during the Gulf War, we'd >have been >able to send a cruise missile directly to his keyboard. This could be prevented by encrypting the data packets, but that would introduce more delay into the protocol, and make it easier to spoof distant locations. >[These flaws in the protocol seem so obvious that I can't help but wonder if >we're >missing something - Dorothy isn't *that* stupid.] Isn't she about the age where Alzheimer's starts kicking in? Jonathan Wienke

1 0

Re: WWW User authentication
by stillson＠ashd.com 17 Dec '03

17 Dec '03

>> >Well, if you use SSL, it's useable by a "large number of browsers" since >> >Netscape has such a large share of the browser market. And then all of >> >the things you're doing w.r.t. authentication are hidden, at least from >> >casual eavesdroppers and others too if you use more than the 40-bit option. >> >There's really no other choice to reach a large number of browsers. > >> Once again mister barber is being an idiot. netscape is not a "large number >> of browsers". > I have to apologize for this. Me having a bad day is not a good reason to call Jeff Barber an idiot. My aplogies. >> He is right that ssl is probably a good way to go. (shttp would >> be better :) ) > >SHTTP might be better if it didn't have to be "useable by a large number >of browsers" -- since Netscape doesn't support SHTTP. (I'm sorry that you >apparently find Netscape's success so frustrating, but it is a fact.) Again, I probably went a little overboard. I just get worried when any one company has as much control over the technology (in this case net based encryption) as netscape has. That, and I used to work for one of their competitors and I get tired of people telling me that netscape is the only company out there. Sorry to be a jerk

1 0

Re: No matter where you go, there they are.
by Paul_Koning/US/3Com%3COM＠smtp1.isd.3com.com 17 Dec '03

17 Dec '03

>From: perry @ piermont.com ("Perry E. Metzger") >Aren't things even worse? Since the satelite signals are not >authenticated with anything like public key methods, couldn't I just >synthesize a signal appropriate to any spot on the planet, knowing the >positions of the satelites relative to that spot? In the case of the C/A (civilian) code, absolutely. In the case of the P code (military) only if you have the key, but in that case, yes. As Jim Bell pointed out, there are boxes you can buy for suitable amounts of money that are "GPS simulators" -- they construct out of whole cloth the signals you would receive if you were at location X with satellites {Y1, Y2, ...} overhead. However, if all you set out to do is fool a location authenticator, deriving shifted location data from the actual satellites is far easier and bound to be much cheaper. There is one limitation this has that the simulator approach doesn't -- delaying real signals requires having access to the same satellites (or a large enough subset, i.e., 3-4 of them) that the checking station has overhead. paul

1 0

Re: Protocols at the Point of a Gun
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 11:50 PM 4/10/96 -0700, Jeff Weinstein wrote: > Given that the IETF has no "official" (whatever that means) sanction, >what would prevent any other organization from coming in and trying to >take over their turf? ... It seems to me that this question represents a classic case of the costs of market entry. IETF has a pretty good reputation as a standards body. If another body were to take over its function, they would have to have superior reputation in the relevant market (i.e. IP protocol suite implementors and their customers). Superior reputation could come from: (1) Better response to proposals. (Hard to imagine in the current climate.) (2) Government coercion. (We will throw you in jail if you don't ...) (3) Government coercion. (We won't buy equipment that doesn't meet x standard.) (4) Large User coercion. (We won't buy equipment that doesn't meet x standard. Probably no user is currently big enough to force standards in this way, not even Microsoft.) Regards - Bill ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

RE: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 11:36 AM 4/11/96 -0400, Blake Coverett wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> >> I notice you gave no examples. Why is that? >> >> Jim Bell >> jimbell(a)pacifier.com > >In a past life I worked on a Honeywell DPS8 box that had >36 bit words and 9 bit bytes. I'm seeing a few notes of this sort which make such claims, but there is not enough information included to establish that anybody _originally_ called those 9-bit data items "bytes" or not. It appears to me that after the fact, 20+ years later, there is a tendency to call ANYTHING other than a single bit a byte, at least during that time frame. What I'm looking for, however, is an indication that this was actually the term used, THEN, for that data structure.

1 0

washington post notices archives
by Andrew K. Bressen 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi-- we here at HKS.net have today received a cease and desist letter from the washington post regarding editorial copy of theirs that was evidently posted to c'punks and then abosrbed into our c'punk archives. Once the archives are restored (RSN) we'll probably manually edit out the messages from the archive. We're trying to get the post to give us URLs for their copies of the content in question so that we can point to their archives, but their legal dept wasn't sure whether or not their archives were on the web. The posts in question date back some time (archive volume 1); I'm not too concerned about a recurrance (though it would make an interesting attack), but thought it was interesting enough to warrent mention, since it seems likely that the washington post was grepping the net looking for themselves. I wonder if robot exclusion on our site would have prevented this? Although the legal staffer who sent the letter did come up with a URL for the offending messages, she seemed unaware of the concepts of "mailing list" and (semi-automated) archives according to the person here who spoke to her. - --andrew k bressen bressen(a)hks.net -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Processed by Mailcrypt 3.3, an Emacs/PGP interface iQCVAwUBMW17+1u2h42ZEVfZAQFslQP/avVguGOK/hRz/1SmZtZpld79edoDyJnf yeBkX7WdrfVt1/xSkOdD4xtVHf1FENfeFr50xnt2PPVb8g0E0DQqMv6Cz4ZNy5Su bXzsmvK/zCvLKPn7gueeRjk3jQKohGRf7R9Y6rr6N6jNbCS4zZQQ/nwN7sWdhZA2 epRRPjbH52A= =8d5T -----END PGP SIGNATURE-----

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 09:50 AM 4/11/96 -0400, Richard Martin wrote: > >-----BEGIN PGP SIGNED MESSAGE----- > >On Apr 10, 6:57pm, jim bell wrote: >> At 06:29 PM 4/10/96 -0700, Simon Spero wrote: >> >No, bytes are no always 8 bits - some machines use(d) 9-bit bytes. >> I notice you gave no examples. Why is that? >Perhaps he thought that most people who were interested could go look >it up themselves. > >- From a really quick web search, we find that the SGI Impact jams 9-bit >bytes [that's what it says] across the Rambus internally. I'm not sure >if the memory itself is 9-bit. Are you sure they're not referring to 8 bits of data and a parity bit? In any case, please give the address to the list so that it can be checked out.

2 1

Hack MSN anyone?
by gorkab＠sanchez.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The names have been changed to protect the innocent... I need say no more I'm sure. - ---------- From: MSN Support JosephB Sent: Sunday, April 07, 1996 4:05 PM To: xxxxxxxxxx Subject: RE: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Yes, windows95 dialup networking uses compression to send the password when connecting. Thanks for using the Microsoft Network Joseph Beasley msn Member Support - ---------- From: xxxxxxxxxx Sent: Friday, April 05, 1996 5:57 PM To: MSN Member Communications Subject: Connection, Member ID: xxxxxxxxxx, Country: United States (1), Locale: English (United States) Ye[Ask Member Support] MemberID=xxxxxxxxxx Problem Description= Microsoft being security conscious and all, I would hope that when I connect to MSN over the Internet, that my MSN client has the decency to ENCRYPT my password when it sends it over the net, yes? This is the first time I couldn't get through to a dial-up connection and had to access MSN using my ISP. Having done so, I find it extrememly convenient, and would like to continue to do so. Thanks. xxxxxxxxxx -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMW18MRhOHC4UmUYJAQHxvAf+NXAoqm8RUIskjtODUE9MYA+0JRs6x8f9 SMD70zWDRpF7mSPB6QaJcWfnufK5VqynrQ6iHfoNO9rC2yRlmkV04Ce3QW2m1z6P NVgAayVofN0Cjd1vITgdrB1XB9u3PnjXUggyTBLnAprTy79dCQsiTgen/2YujsaV Tzx6Xt87CFS8GwQcKWj5VonTkFQVjOuQIa6GbcVwEFiqVaXp2tLf3RUHXBtJ8B0H nC4wecTyra6CW2AAqFVXXmwVGeDh87caSy4Y3oFEQ8mxgZHFxOZLUeLo3MdaE+nx 33Yl2VdsjxTIlkog1R8d+6A1VDqpVqAJzcdjKnPLm8Sivm9wdGgsag== =TSTX -----END PGP SIGNATURE-----

1 0

Re: On computer face recognition:
by David Loysen 17 Dec '03

17 Dec '03

At 10:02 PM 4/10/96 -0700, you wrote: > >On computer face recognition: > > >>> Shaving probably will not be a problem, but holding your head at a >>> slightly different angle... will screw up the system totally, >>> unless the system has radically improved since the last time I read >>> up on it. > >At 11:45 AM 4/9/96 -0500, K00l Secrets wrote: >> Well, the systems I have seen are quite good at finding people's eyes. >> Scaling (for distance), and rotation (for the angle of your head) >> therefore don't really confuse the system once it has your eyes. > >Finding the eyes can only control for rotations in the plane of >the image, when you tilt your head to one side. They cannot >handle the much more common case of 3D rotations, where you >look slightly to the right or slightly to the left of camera. >Facial expressions also throw them badly. > Take a peak at http://www.neci.nj.nec.com/homepages/lawrence/papers. One of Lawences papers is on using Neural networks to recognize faces. Methinks that the state of the art is advancing rapidly and such problems as not looking at the camera or changing your expression are rapidly being overcome. ===================================== dwl(a)hnc.com Zippity do da, zippity ah, my oh my what a wonderful day. Ya right, and hear I am without time to finish a cup of coffee.

1 0

Re: (political) Privacy, Regulatory Arbitrage, Free Speech
by Michael Froomkin 17 Dec '03

17 Dec '03

Thank you for the thoughtful comments. On Tue, 11 Apr 2000, Joseph M. Reagle Jr. wrote: > I just read your paper and had a couple quick comments, I used to think that > the Internet would be an ultimate promoter of liberal democratic values, > however given recent events in asian countries (which you mention) > particularly actions of China (which you didn't) I am not at all sure that > this will be the case -- of course, one can't prove these things, but I tend > to believe that China could actually clamp down on the freedom of speech > with respect to the following: I agree that the next draft should discuss China more. I think China could probably clamp down very effectively. I am not persuaded it could do so without giving up a very large share of the benefits of access. > > "Like it or not, we live now in an age of completely free speech..." I think > it would be very worthwhile to examine what is meant by "free speech." I > don't think free speech means, if I want, I could say what I want and no one alas, this is beyond the scope of this essay. There's a huge literature on this in the law reviews, though. [...] > > So perhaps the Internet shall provide a mechanism for practical free speech > (allowing some to speak their minds, and the others that get trapped will > get crushed) but it shouldn't be considered a subsitute for political free > speech (in which no one gets crushed). In the case of countries like China, I agree. It's not a substitute. Just an enabler in places that don't choose to practice draconian access control. > the hope is that the practical free speech will enable political free > speech, but based on news reports I am seeing this is less likely than I > used to think, and as you mention in the section of "Mobility of Personal > Data" the capability of this technology to abuse the citizens' and > customers' rights are also increasing, but their isn't an open mailing list > on which everyone can examine the conversation between the organizations > which wish to accomplish this. A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

Re: "Contempt" charges likely to increase
by jim bell 17 Dec '03

17 Dec '03

At 07:59 PM 4/12/96 -0400, Black Unicorn wrote: >On Fri, 12 Apr 1996, E. ALLEN SMITH wrote: >> >I might add that the Cayman Islands are full of trust companies with >> >provisions which forbid the disclosure of data to a client who is >> >coerced. A law on the books refuses to recognize "consent" orders made >> >under judicial compulsion. This would give the appearance of total >> >unavailability of evidence and suggest the futility of contempt >> >charges. Yet courts have still, and with no small measure of success, >> >imposed sanctions on witnesses so protected. >> >> What measure of success? Getting the data, or locking up the witness? >> -Allen > >Getting the data. If the IRS or a private plaintiff wants it bad enough, >they can usually get their hands on it, or at least find out where it is. > >The government of the United States doesn't play "fair" when they want >something. But if the government of the United States does play "fair," then why can we not play "fair" and kill their agents who violate what we feel is our rights? After all, the government is merely the representative of the people (at least in theory!) and it 'must' follow the rules (laws, Constitution, etc). To whatever extent it exceeds those limits, and to whatever extent the public can't get justice to prevent those violations, why would the public be obligated to accept them? To believe otherwise is to believe that the government has some sort of special dispensation to violate the law. I don't believe this; it wouldn't surprise me to hear that you do, however. Which is it? Jim Bell

2 1

Web of Trust Keyring
by Black Unicorn 17 Dec '03

17 Dec '03

Does anyone have a pointer to the Web of Trust Keyring? --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information Opp. Counsel: For all your expert testimony needs: jimbell(a)pacifier.com

2 1

Re: Bank transactions on Internet
by stevenw＠best.com 17 Dec '03

17 Dec '03

On FPGAs: > And it is rather unlikely that one could make a high clock speed >high performance hardware based key cracker work without traditional >high speed logic debugging tools such as a fast logic analyzer (if we >are talking 5-10 ns clock especially) and a 1 ghz or so digital scope. >These kinds of gear, though sometimes available after hours to engineers >working for more liberal companies or schools, cost many thousands >of dollars and are not garden variety items available to any hacker. Probably not necessary. Simulators do just fine. And the FPGAs themselves top out at 50 to 80 MHz. > And finally, depending on the technology of the part being >used, there may be a significant cost in the order of at least hundreds >if not thousands of dollars for a specialized programmer capable of >programming ("burning") the FPGA with the interconnect patterns generated >by the software. These tend to either be specialized to one kind of >part and maybe modestly cheap (hundreds of dollars) or universal and >several thousands of dollars (such as DataIO gear). Easy to access. They are everywhere. The EPROMs are about $6 each and are serial. You could build a programmer at home. > And at least in my experiance (I may be unusually stupid and >careless and clumsy or may not be) even if the parts are a few times >reprogrammable (as CMOS FPGAs often are these days) one can assume >that one will fry, or break the pins off, or reprogram one time too >many the FPGA or FPGA's before one gets the design working. This >means that it would be realistic to assume several parts would be >consumed by the prototyping effort, they may not be cheap and this >adds up too. While there are OTP FPGAs out there (typocally Altera), many are in-circuit programmable *any* number of times since they use SRAM internally not EPROM cells to program the configuration. The latest twist on FPGAs is to add more RAM internally and have them reprogram themselves on the fly, hundreds of thousands of times a second. This cuts the logic requirements down for desidhns that don't need all of the logic all of the time. > So whilst someone working with these parts as part of their job >or schooling might well have access to all the required resources on an >informal basis and be able to build a key cracker in evenings or >weekends for little more than the cost of the chip and a PC board to >hold it, it should be realistically noted that the actual cost of >equiping a lab from scratch with the required resources is more on the >order of tens to hundreds of thousands of dollars rather than $400. True, but $400 is probably not far low. > I must hasten to add that high density FPGAs have many many >legitimate uses in prototyping logic and producing products in small >volumes too small to justify the tooling costs of doing mask programmed >gate arrays (which tend to be significantly faster and easier to design, >but cost $5-100K NRE to set up custom masks for fabrication). The >current generation of them make it possible to build logic systems in >one small chip that a few years ago would have been large PC boards >full of PALs and other logic. My employer uses FPGAs in all new designs for production. They are *very* common for products that sell into the thousands per year. Mask-programmed gate arrays have the major disadvantage of very long lead times, usually a more pressing requirement than saving $30 per board over several thousand boards. Companies now make boards that contain just FPGAs wired in a grid. They are sold as general-purpose logic engines with software to implement circuits as hardware simulations. I'm sure that these would do just fine, though they are costly. ------------------------------------------------------------------------- Steven Weller | Weller's three steps to Greatness: | 1. See what others cannot | 2. Think what others cannot stevenw(a)best.com | 3. Express what others cannot

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 02:51 PM 4/12/96 -0700, Alan Olsen wrote: >At 11:34 AM 4/12/96 -0500, Doug Hughes wrote: >> >>On Apr 12 at 8:07 >>jim bell wrote: >>> >>>Are you sure they're not referring to 8 bits of data and a parity bit? In >>>any case, please give the address to the list so that it can be checked out. >> >>Come on, give it up already and admit you were wrong. At least 8 different >>people have cited examples of machines that supported non 8bit bytes. Your >>pride is getting the best of you. > >Jim is unwilling to admit his errors, even in things he has little or no >training in. (I remember him claiming at one point that he was not a >programmer or did any coding for that matter. Why he continues to persist >in such things I will not speculate on...) What I meant was the most honest answer I could give: I am not a professional programmer. I have programmed, in APL, Fortran, Algol, PL/1, Pascal, and I can read BASIC's well enough, but not recently.

1 0

Re: questions about bits and bytes
by jim bell 17 Dec '03

17 Dec '03

At 12:00 AM 4/10/96 -0700, Bill Stewart wrote: >At 09:33 PM 4/8/96 -0400, Jack Mott wrote: >>This may be a bit of a no brainer, but everything I have read sorta >>skips over this point. a bit is 1 or 0. 8 bits make up a byte (0-255). > >Be careful writing code - sometimes a byte is -128 to 127 instead of 0 to 255. >Also, there are machines (mostly old kinky ones) that use bytes of sizes >other than 8 bits. No, Bill, a "byte" has ALWAYS been 8-bits. One of the main reasons the term "byte" was invented was because the term "word" (as in, "word length") varied for different computers, especially in the 1960's. (In fact, many computers of that era used word lengths other than 8, 16, 32, 64 bits, as surprising as this may sound to the current crop of PC and Mac afficionados.) This made it inconvenient to talk about memory capacities unless you were referring to the same machine. The solution was to invent a new term, "byte," which conviently had about the same size as an ASCII character and was always 8 bits.

7 6

Re: PEP Announcement (fwd)
by rah＠shipwright.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 2:28 PM 4/10/96, Black Unicorn wrote: > This showed up in my mailbox: <snip> > PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate > Eudora and MacPGP are now available in the latest Button Circle release >at: > ><ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch9 >6.sit > .hqx> I'm using it. I actually went out and bought OneClick to do so, mostly because I wanted to mess around with scripts for other things and OneClick looks pretty painless to use. PEP works pretty much as advertised, except that the finger operations take too long for my ISP to execute sometimes, and evidently the finger events in Eudora aren't robust enough to wait for the operations to complete, so a "wait" has to run. The work-around is to manually do the finger instensive "get cypherpunks remailer names" and "get remailer-keys" operations with eudora, copy the results, and then run the scripts. Anyway, I bashed on it, and PGP, a bit, and now there's a palette when I use Eudora which I can click to do chained remails, which I was never really able to do before. It also does signs, which are fine, and encrypts, which are also fine, but the decrypts come up in the PGP window, which is crypto-correct, I suppose, but I like the dump-it-into-it's-own-mail-window result of the original OSA scripts which come with MacPGP. This is useful if you actually want to reply to an encrypted mail message. One of the other things that is nice about the original MacPGP scripts is that they automatically verify signatures on decryption, and, at the same time, they also automagically add any attached keys to your keyring, pending certification, etc. Anyway, if you have OneClick already, then PEP is a way cool thing to have. Here. I'll sign this message with it. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMWwYUvgyLN8bw6ZVAQEUKgP/eXQsCS/AaAj07s9PAX07j5WcXCXDGvpF RxDSLqJNA3wOcU3QKrDc/T0HfzQELM/RbjOvDy7XPWUwxEN/SUTfRzAekYtJ6RbM 2w3CDYtNsdXyv4yyrgNF1eIjs+IecYYrCBeXJcvHn6fRwEbVBr+yFgXIprjfeEZ9 of/IGHDE0Qc= =bshY -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: No matter where you go, there they are.
by David Lesher 17 Dec '03

17 Dec '03

I asked a friend charged with spending money in this area. Here's his reactions, and those of someone he consulted: ================== ..There is a business case flaw in the proposal. The scheme as laid out only provides a high confidence factor on the users location (+- 10M), NOT on the actual identity of the user. Thus it would have to be coupled with some other form of I&A. The business question then arises, is the confidence delta provided by this scheme consistent with the cost delta? My first take is that the answer is no. =================== Re spoofing the system. If you think about the geometry of the problem, the delay to be induced for each satellite is a time varying function of the satellite's position, the reference site, and the target. It will vary from positive to negative values for many satellite passes. It can be precomputed, but the precomputed adjustment will be in error by some amount due to the orbital perturbations mentioned in the original article. The most common prediction error is the in-track postion, which inconveniently for the predictor has the greatest effect on one's ability to calculate the right delays. Anyone with access to a decent orbital prediction code and access to the statistics on orbital perturbations should be able to calculate the expected delay prediction error as a result of the orbital uncertainties. If the delay prediction errors are detectable, then it seems the system is secure after all, allthough other reservations on operational suitability might still apply. Note that the sensitivity is a function of the distance between the reference site and the target. If you could collect your reference signal across the street from the target, it would make spoofing a lot easier. -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: washington post notices archives
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:39 PM 4/11/96, Andrew K. Bressen wrote: >we here at HKS.net have today received a cease and desist >letter from the washington post regarding editorial copy >of theirs that was evidently posted to c'punks and then >abosrbed into our c'punk archives. > >Once the archives are restored (RSN) we'll probably manually edit out >the messages from the archive. We're trying to get the post to give us Several relevant points for lists like ours: 1. Expect more and more of these sorts of copyright "cease and desist" (or, as I like to say, "decease and cyst") orders, as newspapers and magazines use search engines to find their stuff. Expect some "automated searches" to be done routinely, even offered as services by third parties. ("Find infringing copies...make $1000 a week in your spare time.") 2. What does removal of infringing articles mean for follow-ups? If I reference a WSJ or NYT article that someone has quoted or forwarded, is my follow-up expunged also? 3. And what of the "Cypherpunks Archives on CD-ROM"? Too late to simply remove a single article...does the entire production run go into the landfill? (I haven't heard much about the "enthusiasm du jour" of the "Cypherpunks CD-ROM," but this always been a concern, that legal issues would have to be resolved, including the getting of releases from several hundred or more parties.) 4. Suppose the HKS archives were actually offshore, in the Cayman Islands or in some place that doesn't recognize copyright law in the same way most Western or Berne Convention countries do? 5. Suppose access to such archives is done via Web remailers, and the location is not easily determinable? (To be sure, lots of hits means traffic analysis will reveal the location....the same general problem with "reply-blocks," of course.) It sounds like the Washington Post is discovering the brave new world. Expect an article or two on this. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PEP Announcement (fwd)
by Black Unicorn 17 Dec '03

17 Dec '03

This showed up in my mailbox: --- My preferred and soon to be permanent e-mail address:unicorn@schloss.li "In fact, had Bancroft not existed, potestas scientiae in usu est Franklin might have had to invent him." in nihilum nil posse reverti 00B9289C28DC0E55 E16D5378B81E1C96 - Finger for Current Key Information ---------- Forwarded message ---------- Date: Wed, 10 Apr 1996 00:03:29 -0400 From: Amos Elberg <aelberg(a)wesleyan.edu> To: unicorn(a)schloss.li Subject: PEP Announcement Uni, can you forward this to the c-punks for me? --------- PEP: Pretty Easy Privacy, a set of scripts for OneClick that integrate Eudora and MacPGP are now available in the latest Button Circle release at: <ftp://ftp.westcodesoft.com/pub/westcode/Contributions/OCButtonCircleMarch96… .hqx> PEP is designed to provide features similar to the UNiX premail program on the Macintosh. It handles encryption, decryption, signing, verifying, anon.penet.fi remailing and cypherpunk remailing. PEP uses OneClick to place a button bar in Eudora, from which the user can select privacy functions. Buttons pop-up menus of encryption targets, signature keys and cypherpunk remailers. Q: What do I do about the rest of MacPGP's interface? A: PEP is not designed to replace MacPGP, just to provide easier access to it from within Eudora. For a full featured MacPGP GUI replacement with added features, try Raif Naffah's MacPGPControl application. Q: Isn't the name 'PEP' pretentious and derivative? A: Yes, I think so too. I couldn't think of a better one. Suggestions are welcome. Q: I have a lot more questions. Where are the answers? A: In the documentation. If you have any more questions, please direct them to <mailto:aelberg@wesleyan.edu> ------------------------------------------------------------------------------ Amos B. Elberg | #include disclaimer.h Amos will code for Wesleyan University | food. E-mail me for a resumé. Please. 341 S. Main St. Apt. 3N |---------------------------------------- Middletown, CT 06459 | Help keep the net safe from the Will Code for Food! | aesthetically challenged. Please, Public keys available from the usual | oppose ASCII art. keyservers, or by request. |---------------------------------------- PGP fingerprint = 08 B8 87 04 6B 21 08 5D B0 62 F7 94 7B 42 0F 10 --- end forwarded text

1 0

Re: Edited Edupage, 4 April 1996
by Michael C. Peponis 17 Dec '03

17 Dec '03

On 12 Apr 96 ,E. ALLEN SMITH wrote: > From: IN%"educom(a)elanor.oit.unc.edu" 5-APR-1996 01:25:00.85 > >IBM'S INTELLIGENT MINER DIGS OUT THE GOOD STUFF > >IBM plans to offer companies "data mining" software and services, allowing > >them to make better use of disparate pieces of information stored in their > >computer systems. The Intelligent Miner software will be available on IBM's > >RS/6000 servers by the fall, and on other platforms by year end. The > >company also plans to develop Intelligent Decision Server software for local > >area network-based information analysis. (Investor's Business Daily 3 Apr > >96 A9) > > Anyone have any _specific_ ideas on how their Intelligent Miner system > works? It would appear to be relevant to the identity-spoofing discussions. > -Allen Not really, it's a tool used in Data Warehousing/Decission Support Systems. Here is what it is in a nut shell. A company creates a Data Warehouse, defining it's data universe in terms of business rules and practices. Data Mining is the process by which users try to make sence of all the data. They call it "intelligent" because it supports natural language queries, ie the end user does not need to know SQL or the table layouts to retrieve the information they want. Very sketchy explination, but there are entire volumes written on the subject, and it's new technology so the exact definition varies depending on who you ask. I have been developing systems like this for the past year, and I still can't give people a cut and dry answer as to what the hell it is. Regards, Michael C. Peponis Public Key Avalible Via Key Servers, or Finger

1 0

Re: Contempt charges
by Moltar Ramone 17 Dec '03

17 Dec '03

> Message-Id: <199604100152.DAA25396(a)spoof.bart.nl> > To: cypherpunks(a)toad.com > From: anonymous(a)nowhere.goucher.edu (Senator Exon) > Comments: Please report misuse of this automated remailing service to > <remailer-admin(a)remailer.nl.com> Oooh... forged headers... forged to indicate they're coming from _my_ school. I wonder who _this_ could be... perhaps someone who has expressed anger at me on the list? Perhaps just a random choice? Perhaps me? (Not me, that I'll tell you...) > Borrowing inspiration from May, a page from Scheier and some code from > Gutman... Techniques from Detweiller, and lousy law from Jim Bell (I _wonder_ who might have posted this... :-) ) > Hard disk space being cheap now, Bob creates several distinct disk > partitions and uses Peter Gutman's Secure File System, or equivalent, to > encrypt all of them. [ ... ] >Practically, Bob cannot be forced to reveal the pass phrases to any >alleged remaining secret data, since this might not exist. To further >encourage this belief Bob might associate innocous data with a first pass >phrase, mildly embarrasing data with a second, and so on, and then, after >revealing the first, gradually allow himself to be be coaxed into revealing >the second and disclose a third only after the rubber hoses came out. > >Since all of the partitions have similar content, no statistic should >reveal which is which. Bob might have a bit refresher routine >periodically nibble read and rewrite the whole disk so that no >electronic characteristic exists that reveals record age. Sure, this will effectively hide the data; so will a plain old encrypted partition... >No doubt, a judge might whimsically keep Bob in jail for a while, trying >to assure that he has revealed all of the pass phrases, but the judge >can never be certain, even when Bob has disclosed everything. This >situation creates doubt that Bob is in contempt, even when he is, and >makes a prison term relatively pointless, unless for revenge. But that's what a contempt charge is _for_: "You're not treating me with respect, so I'm going to punish you." It might be described as being for a particular reason (ie supressing evidence), but each of those reasons ultimately boils down to lack of respect. In addition, were I handing down (or prosecuting) the contempt charges, I'd claim that the statement (even if it was made in public) that the individual didn't know all the keys in the first place was a lie, and that, by repeating the lie, they were purjuring themself. I am not a lawyer; however, I suspect that neither was the anonymous poster. In fact, I think I have a pretty good idea of who it was: someone on the list who: (1) Has recently been claiming that contempt charges were worthless, and that people should start ISPs, and pool money for insurance. (2) Has (probably) used this technique (at least once) before to create the appearances of support for one of his/her ideas which really has no support. (3) Might _possibly_ be upset with me (due to the headers...) I can't think of _anyone_ who meets THAT description, now can I? ;-) Jon ---------- Jon Lasser (410)494-3072 - Obscenity is a crutch for jlasser(a)rwd.goucher.edu inarticulate motherfuckers. http://www.goucher.edu/~jlasser/ Finger for PGP key (1024/EC001E4D) - Fuck the CDA.

1 0

Re: So, what crypto legislation (if any) is necessary?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:27 PM 4/9/96 -0800, jim bell wrote: >At 07:08 PM 4/9/96 -0700, Bill Frantz wrote: >>At 3:21 PM 4/9/96 -0800, jim bell wrote: >>>And the rest of us are tired of seeing those non-responses! >> >>I wish to state that Jim Bell does not speak for me. > >Tell me, what is the most exciting, interesting, and imaginative usage of >"Yadda Yadda Yadda" that _you_ remember, Bill? This will be my last post on this subject. Since Jim Bell ALWAYS has to have the last word on any given subject, he will continue to try to read something into my statement that is not there. I can not get much clearer than: I have not authorized Jim Bell to speak for me. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: No matter where you go, there they are.
by mccoy＠communities.com 17 Dec '03

17 Dec '03

At 8:53 AM 4/10/96, Hal is rumored to have typed: > Peter - didn't they say that the checking station is also listening > to the satellites? That way they can tell that you are playing back > signals that you taped earlier because they won't match what the > satellites are broadcasting right now. There is going to be processing and network delay involved here (unless Denning et al have figured out some way to communicate faster than the speed of light), so drift between the what you report and what the checking station and repeaters are hearing _at that time_ is inevitable. This is the loophole which allows Peter's attack, a loophole which cannot be closed (because the spoofer can always claim to be on a slower link than she really is and there is nothing the verifiyer can do to prove otherwise.) If I want to pretend to be closer to the receiver than my true location I simulate a slow link which gives me enough time to record what the signals would be at the near location and then quickly resend them to give the appearance of the spoofed location. In fact, I think that this really all boils down to trying to use GPS as a non-interactive proof of location, and the information posted about the system does not address the obvious attacks on such systems which are known from research into ZNPs. > If their authenticated repeaters are used then you have to assume the > checking station has all the satellite signals and again the best you can > do is pretend to be a Mole Man. The authenticated repeaters may collect all signals, _but the receiving station does not get them all at once_ because it will take time for the signals to propogate from the repeater back to the station attempting to determine location. Having all of the signals does not help the checking station other than allowing it to share a set of sats with the person attempting to authenticate. It still does not And perhaps more importantly, do you really want anyone you connect to on the net to know your location to the nearest 10 meters? What is Dennings fascination with building Big Brother? jim

4 7

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash reord"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"hacktic"} = "<remailer(a)utopia.hacktic.nl> cpunk mix pgp hash latent cut post ek"; $remailer{"flame"} = "<remailer(a)flame.alias.net> cpunk mix pgp. hash latent cut post reord"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk pgp hash filter"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"ford"} = "<remailer(a)bi-node.zerberus.de> cpunk pgp hash ksub ek"; $remailer{"robo"} = "<robo(a)c2.org> cpunk hash mix"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{"rmadillo"} = "<remailer(a)armadillo.com> mix cpunk pgp hash latent cut ek"; $remailer{"ecafe"} = "<cpunk(a)remail.ecafe.org> cpunk mix"; $remailer{"wmono"} = "<wmono(a)valhalla.phoenix.net> cpunk mix pgp. hash latent cut"; $remailer{"shinobi"} = "<remailer(a)shinobi.alias.net> cpunk mix hash latent cut ek reord"; $remailer{"amnesia"} = "<amnesia(a)chardos.connix.com> cpunk mix pgp hash latent cut ksub"; $remailer{"gondolin"} = "<mix(a)remail.gondolin.org> cpunk mix pgp hash latent cut ek reord"; $remailer{"tjava"} = "<remailer(a)tjava.com> cpunk mix pgp hash latent cut"; $remailer{"pamphlet"} = "<pamphlet(a)idiom.com> cpunk pgp hash latent cut ?"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'gondonym'} = '<alias(a)nym.gondolin.org> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk pgp hash latent cut ek"; $remailer{"treehole"} = "<remailer(a)mockingbird.alias.net> cpunk pgp hash latent cut ek"; $remailer{"nemesis"} = "<remailer(a)meaning.com> cpunk pgp hash latent cut"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"vegas"} = "<remailer(a)vegas.gateway.com> cpunk pgp hash latent cut"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"ncognito"} = "<ncognito(a)gate.net> mix cpunk latent"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (c2 robo alpha) (gondolin gondonym) (flame hacktic replay) (alumni portal) Use "premail -getkeys pgpkeys(a)kiwi.cs.berkeley.edu" to get PGP keys for the remailers. Fingering this address works too. Note: The remailer list now includes information for the alpha nymserver. Last update: Mon 13 May 96 6:45:35 PDT remailer email address history latency uptime ----------------------------------------------------------------------- mix mixmaster(a)remail.obscura.com ++++++++++++ 4:10:52 100.00% alpha alias(a)alpha.c2.org +.+++++++++* 49:42 99.99% haystack haystack(a)holy.cow.net -*#*##+--++* 18:17 99.98% exon remailer(a)remailer.nl.com *******+***# 2:48 99.98% lead mix(a)zifi.genetics.utah.edu ++++++++++++ 37:55 99.97% amnesia amnesia(a)chardos.connix.com _. --+----++ 12:19:41 99.83% flame remailer(a)flame.alias.net ---+---+-+++ 2:44:17 99.81% c2 remail(a)c2.org +++++++++++* 46:01 99.75% alumni hal(a)alumni.caltech.edu #-### #*#### 7:16 99.69% vegas remailer(a)vegas.gateway.com ###**-***##* 1:07:26 99.64% ecafe cpunk(a)remail.ecafe.org ###*###+## # 7:38 99.60% portal hfinney(a)shell.portal.com #-## -# #### 5:07 99.57% shinobi remailer(a)shinobi.alias.net ***+**+* +** 37:06 99.26% penet anon(a)anon.penet.fi _ .____. 66:02:55 99.01% replay remailer(a)replay.com +********+* 5:20 98.53% treehole remailer(a)mockingbird.alias.net ---+++-+-- 2:07:49 86.55% extropia remail(a)miron.vip.best.com --.---- 8:00:07 48.50% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Re: Free demo disk of "distorted number" crypto
by Mark O. Aldrich 17 Dec '03

17 Dec '03

On Fri, 10 May 1996, William Ono wrote: > On Fri, 10 May 1996, Mark O. Aldrich wrote: > > > technical. They are also offering a technical write-up via fax-back at > > 301.588.2162. > > I just called that number, but got no answer after ten rings. Could you > please verify it? I just checked it. It's working. It answered with the "menu" after two rings. Anyone else try using this thing? ------------------------------------------------------------------------- | Liberty is truly dead |Mark Aldrich | | when the slaves are willing |GRCI INFOSEC Engineering | | to forge their own chains. |maldrich(a)grci.com | | STOP THE CDA NOW! |MAldrich(a)dockmaster.ncsc.mil | |_______________________________________________________________________| |The author is PGP Empowered. Public key at: finger maldrich(a)grci.com | | The opinions expressed herein are strictly those of the author | | and my employer gets no credit for them whatsoever. | -------------------------------------------------------------------------

1 0

Report on Smart cards
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Financial Times, 13 May 1996 Smart cards poised to mark revolution in data protection The poor image of the technology as "Big Brother's little helper" may be altogether undeserved, says Alan Cane The smart card -- a piece of plastic the size of a credit card with a computer embedded in it -- offers numerous benefits, but will force a re-evaluation of attitudes to privacy and data protection, says Demos, the independent think-tank. Its report, one of the first to analyse policy issues raised by the rapid proliferation of smart cards in areas such as finance, health and public administration, warns that the benefits will only accrue when people are confident the technology will not become "Big Brother s little helper", as the authors put it. Helpfully, Demos suggests policies to sidestep what it sees as a "sterile confrontation" between civil libertarians and authoritarian government and business interests in promoting the benefits of smart cards. "We have argued that people will trust in these technologies when they can choose anonymity where they want it and have greater control over the use of personal information held about them," say the authors. What distinguishes the smart card from other information technologies and gives it its power is the capacity to concentrate and manipulate a huge amount of information in a tiny space. A reading device is necessary to view the information, but smart cards compute as well as store data. Software can be incorporated to encode the data, rendering it unreadable to anyone without the right key. What can smart cards be used for? Their main use now is as telephone cards for public pay-phones, but they have the potential to identify individuals, to act as an electronic wallet for cashless shopping, and to provide a secure and portable information store. Medical histories could be stored on a smart card, for example, ready for recall by a doctor. Visionaries talk of virtually unlimited amounts of information distributed through society in a variety of forms -- the credit card model has been adopted for convenience rather than because of limitations inherent in microcomputers. Badges, pins and jewelry could all become "smart" accessories in the future. However, this sort of crystalgazing raises questions. For example, what information should be stored on a smart device? Who should be able to read it? The Demos researchers are critical of suggestions by Michael Howard, Britain's home secretary, that a smart card could be used as a national identity card: a government-issued, multi-functional card, with the populace having little or no choice about which applications were available on the card -- and perhaps no say about the privacy system employed. Regulation of the privacy system -- encryption -- is important. It is comparatively easy to devise encryption methods which are almost impossible to break within a reasonable period. That worries governments fearful of being unable to unpick communications from terrorists and the like. The US has attempted to forbid the export of the more powerful US cryptography systems. The Demos researchers argue that such tactics are counter-productive. They favour a private "key escrow", a system where cryptography users deposit the key to their system with a trusted private registry, approved and regulated by governments. "Government law enforcement agencies would have to obtain a court order on the basis that they had strong reason to believe that an individual or company that had escrowed their keys ... was guilty of some crime". The report proposes a radical reform of data protection legislation through some 10 supplementary conditions. Data users, for example, would have to get express consent from individuals for the use to which they would want to put the data. Rules on disclosure to third parties would be tightened, so that data users would have to receive specific permission from a data protection registrar in order to gain access to specific information. It argues that individuals should be able to choose the card they want, and decide what information and applications will be loaded. "Where [Michael Howard's] card is an essentially authoritarian instrument, our proposal is for a more market-based instrument in which the role of government is to align the incentives within the market to ensure privacy, trust and individual access and control," says the report. - On the Cards, by Perri 6 and Ivan Briscoe. Demos, 9 Bridewell Place, London EC4V 6AP. UK9.95. -----

1 0

Re: Mandatory Voluntary Self-Ratings
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 03:45 AM 5/13/96 EDT, E. ALLEN SMITH wrote: > the conservatives won't let people just rate > "objectionable" material in order to keep it from them. They want it off the > net/world whether or not it's rated. In the course of channel surfing, I have once or twice come across the Christians ranting about pornography. They have both legitimate and illegimate complaints, but mainly they emphasize the legitimate complaint. PICS addresses this legitimate complaint. Should cut the volume down considerably, or else force them to drop the hypocrisy, if indeed they are hypocrites. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: Civil liberties of employees (Re: FYB_oss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:15 AM 5/13/96, E. ALLEN SMITH wrote: >From: IN%"tcmay(a)got.net" 13-MAY-1996 00:55:07.93 > >>Actually, one _does_ check one's Constitutional rights "at the door" (of an >>employer), and the confusion over this issue is pervasively destroying real >>Constitutional rights. > >>For instance, if I hire someone, I can require him or her to wear a >>uniform, to not wear blue jeans to work, to not smoke (or even to smoke, if >>this is what the job involves), to take off his or her clothes, to tap >>dance, to not say anything to my customers, and on and on. If the >>government required these behaviors, this would be a legitimate issue, but >>not if employers set these conditions as terms of continued employment. > > In general, I agree... but one important point to make is the contract. >If the contract says that you can require the employee to tap dance, then you >can require the employee to tap dance. If the contract _doesn't_ require the Sure, I agree that _contracts_ can make a difference. But note that contracts are not a requirement of employment: I can, for example, hire someone to rake my leaves. If he decides that manual labor violates his "civil rights," I can give him the boot. No muss, no fuss, no contracts. (But contracts are of course possible. Enforcement of the terms is another matter. By the way, I think enforcement of such contracts should be handled outside the normal legal system, and paid for by the parties using the system.) --Tim Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

PGPShell & Eudora
by Michael E. Carboy 17 Dec '03

17 Dec '03

While trying to solve a corrupted clearsig problem with Eudora 2.2 and PGPShell, I noticed comments in the c-punks archives on this same problem. I wanted to pass on that Aegis Research's PGPShell "Beta4" version solves the problem and does "preprocess" the message before signing so that Eudora won't wreck it. The shell can be downloaded at http://aegisrc.com. It is self-extracting and, if installed in your existing PGPShell directory will create a subdirectory named "Pretty~1" (no, I am not kidding) and then install the new .exe there. Regards, MEC Michael E. Carboy carboy(a)hooked.net carboy(a)carboy.com Key fingerprint = C9 E9 79 12 43 76 A2 DB 1A 72 FD 04 F2 03 6F 8A -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzDwxdIAAAEEAMmDaOXoZczvK4R7vH7ql+0sY/oHyqdtsjuOG8jbObnFjh2N jh3TAxyXGb83xmsm6Eb6muXf6oZJdTIzO7UuSwKh+afLg6un+LU7S/VTFTUf4QNq T1e2jZxcr33SFUxiKN7q83GkZhHyY1EeM/O8pGX+JhMANMv7gf9JSEYWhfvhAAUT tCVNaWNoYWVsIEUuIENhcmJveSA8Y2FyYm95QGhvb2tlZC5uZXQ+iQCVAwUQMPDG Lv9JSEYWhfvhAQF2VQQAqMj60pWt3+jZow8q/DFiM9Jw73rii2deJwfdju9vGWgU S6Se5TegVYlti8mWLF+mRSldEnRIKZs7mycW9YlVmfxa+uM2sTceoDIACkZy1MWF ULLeIzFDreR2YZLAVMQ4ToWTkRS2T+/jM8RQEMakPCYDIKBzCIuRQ7J+jmpR+Fs= =79nx -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Transitive trust and MLM
by eli+＠GS160.SP.CS.CMU.EDU 17 Dec '03

17 Dec '03

In article <+cmu.andrew.internet.cypherpunks+UlYwNe:00UfAM107VG@andrew.cmu.edu> EALLENSMITH(a)ocelot.Rutgers.EDU writes: > The different paths going through those different signatures will be >correlated/non-independent, yes.... but that isn't the problem unless you're >considering multiple paths (in a more complicated version). To determine key validity, you do have to consider all paths. If a single trusted path to the bad key exists, the attacker wins. > IIRC, there have been some sociological studies showing that _everyone_ >is linked through 6 or so people. Milgram's "small world" experiments used a much looser sort of "link" than we want here. It would be certainly interesting to know how large a difference this makes. > Now, there's the question of whether you _need_ to be linked to everyone - > [...] I see nothing wrong (and am in favor of) separation of the > elite from the masses. Gee, let me guess which group you're in... I'll go with "people I want to talk to" versus "people I don't want to talk to", thanks. It's true that you don't need to talk to everybody. The problem is that I might want to talk to people whom I don't know personally, but know by reputation, or by function ("DEA Rat Hotline" -- well, maybe not). -- . Eli Brandt usual disclaimers . . eli+(a)cs.cmu.edu PGP key on request . . violation of 18 U.S.C. 1462: "fuck".

3 2

Re: Civil liberties of employees (Re: FYB_oss)
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:34 AM 5/13/96 -0700, Timothy C. May wrote: >Sure, I agree that _contracts_ can make a difference. But note that >contracts are not a requirement of employment: I can, for example, hire >someone to rake my leaves. If he decides that manual labor violates his >"civil rights," I can give him the boot. No muss, no fuss, no contracts. But there is a very clear contract here. He rakes your leaves and you pay him the agreed amount. If he does not rake, he is in default and you don't pay him. If he rakes and you don't pay him, you are in default and he can probably collect thru small claims court. I have done consulting work here in Silicon Valley based on such contracts. (The value was low and I had assurance, from a mutual friend, that I was contracting with a man of honor. I did the work and got paid.) IMHO, it beats the hell out of 3 months dealing with corporate legal. ------------------------------------------------------------------------ Bill Frantz | The CDA means | Periwinkle -- Computer Consulting (408)356-8506 | lost jobs and | 16345 Englewood Ave. frantz(a)netcom.com | dead teenagers | Los Gatos, CA 95032, USA

1 0

Re: Civil liberties of employees (Re: FYB_oss)
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ C'punks, At 09:34 AM 5/13/96 -0700, Timothy C. May wrote: >Sure, I agree that _contracts_ can make a difference. But note that >contracts are not a requirement of employment: I can, for example, hire >someone to rake my leaves. If he decides that manual labor violates his >"civil rights," I can give him the boot. No muss, no fuss, no contracts. There is an implicit contract. Most human interactions are conducted with implicit rather than explicit contracts, but with contracts none the less. Even "explicit" contracts are usually more implicit than you might think. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

CDT Policy Post 2.18 - Join Sen. Burns online TONIGHT (5/13) at 9:00 ET
by editor＠cdt.org 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- _____ _____ _______ / ____| __ \__ __| ____ ___ ____ __ | | | | | | | | / __ \____ / (_)______ __ / __ \____ _____/ /_ | | | | | | | | / /_/ / __ \/ / / ___/ / / / / /_/ / __ \/ ___/ __/ | |____| |__| | | | / ____/ /_/ / / / /__/ /_/ / / ____/ /_/ (__ ) /_ \_____|_____/ |_| /_/ \____/_/_/\___/\__, / /_/ \____/____/\__/ The Center for Democracy and Technology /____/ Volume 2, Number 18 ---------------------------------------------------------------------------- A briefing on public policy issues affecting civil liberties online ---------------------------------------------------------------------------- CDT POLICY POST Volume 2, Number 18 May 13, 1996 CONTENTS: (1) Join Senator Burns online TONIGHT (5/13) at 9:00 ET to discuss Privacy and Security on the Net (2) Subscription Information (3) About CDT, contacting us ** This document may be redistributed freely with this banner in tact ** Excerpts may be re-posted with permission of <editor(a)cdt.org> ----------------------------------------------------------------------------- (1) JOIN SENATOR BURNS ON HOTWIRED TONIGHT (5/13) AT 9:00 ET ON TO DISCUSS PRIVACY AND SECURITY ON THE NET Senator Conrad Burns (R-MT) will hold a second online 'town meeting' tonight to discuss recently introduced encryption legislation. The Promotion of Commerce Online in the Digital Era (Pro-CODE) Act of 1996 (S.1726), sponsored by Sen. Burns, Sen. Patrick Leahy (D-VT) and others, seeks to relax outdated and restrictive export controls on encryption. This online chat is the second chance in as many weeks for Netizens to participate in a discussion regarding this important legislation. We hope many concerned Internet users will take advantage of this rare opportunity to interact with a U.S. Senator who is leading the fight on an issue of great importance to the Net.community. DETAILS ON TONIGHT'S EVENT: * Monday May 13, at 9:00 pm ET (6:00 pm Pacific) on HotWired's "Wireside Chat". URL: http://www.hotwired.com/wiredside/ To participate, you must be a registered HotWired member (there is no charge for registration). You must also have RealAudio(tm) and a telnet application properly configured to work with your browser. Tonight's town meeting is the second in a series of planned events, and is part of a broader project coordinated by CDT and the Voters Telecommunications Watch (VTW) designed to bring the Internet Community into the debate and encourage members of Congress to work with the Net.community on vital Internet policy issues. Events with other members of Congress working on Internet Policy Issues are currently being planned. Stay tuned for future announcements. ---------------------------------------------------------------------------- FOR MORE INFORMATION ON THE ENCRYPTION POLICY DEBATE For more information on the Encryption Policy Debate, please visit CDT's encryption policy issues page at http://www.cdt.org/crypto/ You can also join CDT, VTW, EFF, EPIC, People for the American Way, Wired Magazine, and others in an online campaign to promote secure communications online. For more information, visit: * The Encryption Policy Resource Page -- http://www.crypto.com/ * The Internet Privacy Coalition Page -- http://www.privacy.org/ipc * EFF's Crypto Page -- http://www.eff.org/ * EPIC's Crypto Page -- http://www.epic.org/crypto * VTW's Crypto Page -- http://www.vtw.org/ ----------------------------------------------------------------------------- (2) SUBSCRIPTION INFORMATION Be sure you are up to date on the latest public policy issues affecting civil liberties online and how they will affect you! Subscribe to the CDT Policy Post news distribution list. CDT Policy Posts, the regular news publication of the Center For Democracy and Technology, are received by more than 9,000 Internet users, industry leaders, policy makers and activists, and have become the leading source for information about critical free speech and privacy issues affecting the Internet and other interactive communications media. To subscribe to CDT's Policy Post list, send mail to policy-posts-request(a)cdt.org with a subject: subscribe policy-posts If you ever wish to remove yourself from the list, send mail to the above address with a subject of: unsubscribe policy-posts ----------------------------------------------------------------------- (3) ABOUT THE CENTER FOR DEMOCRACY AND TECHNOLOGY/CONTACTING US The Center for Democracy and Technology is a non-profit public interest organization based in Washington, DC. The Center's mission is to develop and advocate public policies that advance democratic values and constitutional civil liberties in new computer and communications technologies. Contacting us: General information: info(a)cdt.org World Wide Web: URL:http://www.cdt.org/ FTP URL:ftp://ftp.cdt.org/pub/cdt/ Snail Mail: The Center for Democracy and Technology 1634 Eye Street NW * Suite 1100 * Washington, DC 20006 (v) +1.202.637.9800 * (f) +1.202.637.0968 ----------------------------------------------------------------------- End Policy Post 2.18 5/13/96 -----------------------------------------------------------------------

1 0

DCSB: The FSTC Electronic Check Project
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Frank Jaffe, of The Bank of Boston and The Financial Services Technology Consortium (FSTC) "The FSTC Electronic Check Project" Tuesday, June 4, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Frank Jaffe is a Senior Systems Consultant in the Applied Technology Group at the Bank of Boston. Frank is currently the project manager for the FSTC Electronic Check project which involves over 30 companies. Frank has played a leadership role in planning the amalgamation of Bank of Boston's five major retail computer systems into a single, common software system; acting as project leader for a new teller system, and leading the screen phone R&D project in cooperation with Northern Telecom and Bellcore. The FSTC Electronic Check project will develop an enhanced all-electronic replacement to the paper check. Electronic checks will be used like paper checks, by businesses and consumers, and will use existing inter-bank clearing systems. Like its paper counterpart, the Electronic Check represents a self contained "information object," which has all of the information necessary to complete a payment. Likewise, paper checkbooks are replaced by portable Electronic Checkbooks; pens & signatures are replaced by signature card functions and digital signatures using advanced cryptographic techniques; stamps and envelopes by electronic mail or other communications options such as the World Wide Web over the Internet. The fully automated processing capabilities of Electronic Checks opens the possibility of other types of financial instruments, such as electronic cashiers, travelers, and certified checks. Electronic check writing and processing will be integrated into existing applications, from cash registers to personal checkbook managers to large corporate accounting systems, to greatly increase the convenience, and reduce the costs, of writing, accepting, and processing checks. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, June 4, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, May 4, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for the following few months are: July Pete Loshin Author, "Electronic Commerce" August Duane Hewitt Idea Futures We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZec9fgyLN8bw6ZVAQHb/wP9FrQXK4sCBRnfqNt2bJTzWX5BpxDC4NXY RZjQfNP6coAvjh1nc1gNVHcFFgCB2Mh8Mmt876gJr48JUfWpMIQ3XW4CKuqjY6NQ Bw/SRarICPNLSCMbsdX2kHYwi1OuMwkVYm9rXotF4byrDItdxursXacxvvdYyW/u mZMx+eXWq1E= =hXUa -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/ ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Senator Burns at HotWired Today
by Jon Lebkowsky 17 Dec '03

17 Dec '03

Monday, 13 May 6 p.m. PDT Senator Conrad Burns in WiredSide Chat Senator Conrad Burns (R-Montana) has recently introduced legislation to make it easier for netizens to get strong, easy-to-use privacy and security tools for the Internet. The Pro-CODE bill (S. 1726) aims a silver bullet straight at the heart of the Clinton administration's unworkable Clipper and Clipper II schemes by rolling back Cold War-era regulations on the export of strong cryptography. Join us Monday, 13 May at 6 p.m. (Tuesday 01:00 GMT) to talk technology with Washington. -- Jon Lebkowsky <jonl(a)wired.com> http://www.well.com/~jonl Electronic Frontiers Forum, 7PM PST Thursdays <http://www.hotwired.com/eff>

1 0

TO ALL MEMBERS
by Mathew Ellman 17 Dec '03

17 Dec '03

TO ALL MEMBERS, IM TIRED OF ALL THIS SHIT I HAVE UNSUBSCRIBED MANY TIMES AND ALL I GET IS SOME STUPID ASS REPLY ABOUT CLOSED LIST OR ADDRESS NOT MATCHING AND I GET NO REPLY SO UNLESS YOU ALL WANT TO GET A BUNCH OF UN WANTED BULLSHIT (LIKE THE SHIT IM GETING FROM YOU ) I SUGEST SOMEONE FIND A WAY TO GET ME THE FUCK OFF THIS LIST . I HAVE GOT IN TOUCH WITH THE PESON THE REPLY TELL ME TO AND NO REPLY. IM TIRED OF ALL THIS SHIT.

3 2

[NOISE] Re: Notes from the SF Physical Cypherpunks meeting
by Peter Trei 17 Dec '03

17 Dec '03

> From: minow(a)apple.com (Martin Minow) > Subject: Re: Notes from the SF Physical Cypherpunks meeting [...] > The Swedish government has a rather strong tradition of protection > of individual privacy (encrypting COM e-mail is one example). [...] > Martin Minow > minow(a)apple.com Huh? 'a rather strong tradition of protection of individual privacy'? In Sweden, for many years you could (and for all I know, still) go to a public records office and look up all kinds of personal data on anyone, without restriction - you could, for example, find out your co-workers exact salaries if you were curious. My understanding is that Sweden's postion vis-a-vis the Internet has been particularly clueless, with international email technically a crime, and government officials who regard modems as criminal tools. I hope things have improved. Peter Trei (former resident alien in Sweden) ptrei(a)acm.org

2 1

Interest to punks in latest CACM
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

A Meeks article I think that would benefit some cypherpunks... - politics/effectiveness "Comparing Information Without Leaking It" - Fagin, Naor, Winkler - crypto/protocol "A Reengineerings Framework for Evaluating a Financial Imaging System" - certificate processing workflow redesign. _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Notes from the SF Physical Cypherpunks meeting
by minow＠apple.com 17 Dec '03

17 Dec '03

Thanks to everyone who took the trouble to correct errors in my notes from Saturday's Cypherpunks meeting. They were written for my own benefit -- and for the benefit of some friends who couldn't be there. Since I can give away information without losing it (to misquote Thomas Jefferson), I'm happy to share it with the cypherpunks. A comment from Matts Kallioniemi might be worth some further discussion: >>COM e-mail/bbs system (Sweden) -- operator could backup >>e-mail, but not read it. > >Sure. The database was encrypted by using XOR with the string >"KOM". That was the sorry state of encryption in the early eighties. > Encrypting the database with a fixed string offers a good example of how "locks keep honest people honest." This would prevent an operator from unintentionally reading a message in case it was revealed by, perhaps, a disk sector editor or crash dump. I suspect that the state of encryption in Sweden in the early eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who moved to Switzerland to start Crypto AG?), but not necessarily visible to the general public. The Swedish government has a rather strong tradition of protection of individual privacy (encrypting COM e-mail is one example). For example, the initial Swedish implementation of a national criminal database in the mid 1970's (equivalent to the US NCIC) used dialback telexes to prevent unauthorized (and untracked) access. A recent newspaper article noted that some police officers were being investigated for unauthorized access to the personal information of a collegue who had complained of sexual harassment. Martin Minow minow(a)apple.com

3 2

CDA Dispatch #10: Last Day in Court
by Declan B. McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- Fight-Censorship Dispatch #10 ----------------------------------------------------------------------------- The CDA Challenge: Last Day in Court ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this dispatch: The DoJ's flimsy, cheesy, flawed defense Judges question DoJ investigation of CompuServe "The Newspaper Decency Act" http://pathfinder.com/Netly/daily/960513.html The Netly News May 13, 1996 PHILADELPHIA -- Anyone want to bet on the outcome of the Communications Decency Act? I attended the whole thing, which ended Friday in a Philadelphia federal court, and here's the McCullagh Morning Line: 3:1 that the CDA gets struck down as unconstitutional. It can't possibly be upheld -- not from what I understand about the First Amendment, not from what I heard of the flimsy, cheesy Justice Department case (and I heard the whole flimsy, cheesy defense) and certainly not from how the judges were acting on the last day of the hearing. Members of the three-judge panel practically laughed in exasperation at Justice Department wafflings. As you probably recall, The American Civil Liberties Union and American Library Association coalition challenged the so-called Decency Act on the grounds that it would unconstitutionally chill free speech online. The CDA would criminalize "indecent" speech on the Net, invoking a standard -- indecency -- that's yet to be defined. Not for lack of trying, of course. DoJ attorney Tony Coppolino danced a nimble flamenco around the legal meaning of "indecency" and what may or may not be prosecuted under the CDA, arguing on Friday that indecency is a "medium-dependent standard." That is, he said, it can be read to apply mostly to hardcore porn, not literature, and would leave most Web-based jottings alone. But he admitted: "We can't provide assurance that a prosecutor won't take on an absurd case." Dolores Sloviter, chief judge of the Third Circuit Court of Appeals, jumped down his throat: "I've been taking the position for 17 years that people should know what they can be prosecuted for. Doesn't that present a problem?" she asked. "I still don't understand" what indecency means under the CDA, she said. "We've been trying to get at this for 40 minutes," grumbled Judge Stewart Dalzell. Later Dalzell grilled DoJ attorney Jason Baron over the Justice Department's decision to "review" a complaint lodged by the American Family Association against CompuServe's new adults-only service. (The AFA is the most virulent "family values" group involved in the fight over the CDA. Only a week after the law was passed, the AFA said it didn't go far enough.) Dalzell stressed that CompuServe had employed every blocking and parental control mechanism possible under current technology -- but that didn't stop the FBI from investigating the Columbus, Ohio-based corporation. "What more could CompuServe have done?" Dalzell asked. Baron cavilled. "The Justice Department was concerned this may be obscenity," he claims. The distinction between obscenity, which is illegal, and indecency, which is still undefined, is important, and that was a nice try by Baron. Unfortunately for him, the CompuServe forum in question has only Playboy-style centerfolds -- softcore stuff that the DoJ's own attorney Coppolino admitted earlier is not obscene. Clearly, the Government had no business looking into the CompuServe matter. Indeed, outside the courtroom at the end of the day, the ALA's Bruce Ennis charged that the government violated a restraining order barring them from investigating alleged CDA violations. "We were very upset. We think this violated the court order," said Ennis. "We went to court yesterday and asked for a clarification. That's now pending." The only defense against prosecution and conviction that the government offered was requiring credit cards before providing access to "indecent" speech on web sites -- a solution that Baron admitted isn't exactly practical for individual speakers. When Baron trotted out Dan Olsen's -L18 self-tagging scheme as an alternative, even the normally quiescent Judge Ronald Buckwalter noticed: "It's not available now. It's a hypothetical." Judge Sloviter added it was "the product of Mr. Olsen's creative imagination." In final arguments, Chris Hansen from the ACLU said not only would a requirement for -L18-style self-labelling "violate the prohibition against compelled speech," there is no tagging technology "that applies to Usenet newsgroups and mailing lists." The most unusual sideshows of the last day of the hearing was when government attorneys were forced to defend free speech in print. Would a "Newspaper Decency Act" banning violence on the top of the front page be constitutional? asked Judge Dalzell, waving a copy of the Philadelphia Inquirer with a photograph of a Liberian prisoner being executed. "My ten-year old son is a rabid Phillies fan" and came across this image, he said. (We must confess to missing the logic here: Are Phillies fans particularly sensitive to violence?) "The print medium enjoys the greatest protections -- the Internet is becoming more television-like," replied Coppolino, trying to dodge the question. The Philadelphia court is expected to issue a decision by mid-June. Both the plaintiffs and the Department of Justice have said they will appeal to the Supreme Court, which may decide to hear the case after it reconvenes in early October. Assuming the Justice Department loses, will they really appeal to the Supreme Court? If so, I object to my tax money being wasted on this crap. --By Declan McCullagh ----------------------------------------------------------------------------- Mentioned in this article: DoJ refers American Family Association's CDA complaint to the FBI: <http://pathfinder.com/Netly/daily/960507.html> AFA "charges" CompuServe with violating the CDA: <http://fight-censorship.dementia.org/dl?num=2252> FBI finally rebuffs the AFA, when pressed: <http://fight-censorship.dementia.org/dl?num=2445> Excerpts from DoJ and anti-porn groups' CDA briefs: <http://fight-censorship.dementia.org/dl?num=2387> Transcript of Olsen's "-L18" description and other testimony: <http://www.cdt.org/ciec/transcripts/April_15_Olsen.html> Mike Godwin on indecency vs. obscenity: <http://www.cs.cmu.edu/~declan/articles/godwin.indecency.txt> This and previous Fight-Censorship Dispatches are available at: <http://fight-censorship.dementia.org/top/> <http://www.eff.org/pub/Legal/Cases/EFF_ACLU_v_DoJ/> <http://www.epic.org/free_speech/censorship/lawsuit/> To subscribe to the fight-censorship announcement mailing list for future Fight-Censorship Dispatches and related discussions, send "subscribe fight-censorship-announce" in the body of a message addressed to: majordomo(a)vorlon.mit.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> <http://www.ala.org/> -----------------------------------------------------------------------------

1 0

Re: Fingerprinting annoyance
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:26 PM 5/13/96, Mark O. Aldrich wrote: >On Mon, 13 May 1996, Senator Exon wrote: > ><snip> >> i can fill out and manipulate the card myself i just need a >> working method. >> is there no privacy advocate who can help me? >> > >I think most privacy advocates would advise, "Refuse to submit." It >sounds like you're looking for more of a hack on the fingerprinting process. And if you are working for me, and I ask for a fingerprint, and you refuse or "smear" the results (repeatedly, as the first smearing I may just take as your token protest and have you printed again), you'll be out the door by the end of the day. (Personally, I've never worked for a company which demands fingerprints, but I've worked for companies which demanded ID badges and signatures, and these are effectively as intrusive. And I suspect that my former employers are now using thumbprints, and maybe full prints.) What one "doesn't like" and considers an "invasion of privacy" varies from person to person. Some people think having their picture taken is a stealing of their soul. Others fear nefarious things will be done with the DNA from their blood samples. Trying to convince a company that photo ID badges and fingerprints are Bad Things is perhaps admirable, just realize that in a free society that employer is under no obligation to hire someone who refuses to go along with the company's security policies. (This relates to the "civil rights" thread.) >of like a key certificate. If you really can dork the card, have ten >different people volunteer one print each. There's no way that they'll >ever be able to use that as evidence in a court or for any other purpose, >either. A stupid idea. As the employer, I wouldn't have to prove it a court of law...suspicion alone that some of my employees were fucking up a security system might be enough for me to either a. promote them to the Tiger Team, or b. fire their asses. (I just can't understand where this pervasive meme is coming from here on this list, the notion that employers are severely limited in what they can do to employees unless they can "prove it in court. Like it or not, most employees in the United States are still employed "at will," and are not covered by employment contracts such as some executives and the like get.) >If you're forced to do this in person with a tech, you can continuously >"fight" the grip they have on your hand and smudge the card. However, Sure. It makes it easy for the employer to simply say "Next candidate." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Civil liberties of employees (Re: FYB_oss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

Professor Froomkin and I have many disagreements about the nature and direction of laws in the U.S. I think I was careful to couch my points in terms of what the law should be, not what it currently is. For example, I think it fully Constitutional to choose not to serve blacks in one's home, business, church, or whatever. Until fairly recently, the courts saw it this way as well. (I'm not referring to state-sponsored discrimination, such as keeping blacks and women from voting, or visiting government-paid-for facilities, etc) [This is a provocative statement to many. I can elaborate if there is real interest. Suffice it to say that if I operated a bookstore, or gym, or restaurant, or whatever, I would not personally choose to discriminate thusly. Though I might with regard to other (unspecified here) so-called minority groups. And it would be my free right to choose whom to hire, whom to do business with, whom to serve, and so on. It's pretty clear in the Constitution, as I see it, that the government is not empowered to tell people whom they may associate with and whom they _must_ associate with. Again, the so-called Civil Rights Movement, which had good origins in overturning clearly unconstitutional laws about voting (Jim Crow laws), state-enforced segregation, etc., has been carried to the point of interfering with the right of free association.] The current interpretation of the law makes it a crime for a restaurant to allow smoking (at least in many--and increasing--locales). The current interpretation (henceforth shortened to "CI" for brevity) says that a church may not discriminate on the basis of religious affiliation, and hence must not discriminate against Satanists. The CI says that a health club may not discriminate against women (but, interestingly, many health clubs here in my state of California are "women-only"). The CI says that if a white person uses the term "nigger" he may be convicted, in some jurisdictions, of a "hate crime," but if the coloreds use the term, it's OK. [Here in Santa Cruz, the term "black" has fallen into disfavor, and is dubbed a label of the whitemale patriarchy. Thus, we have "lesbians of color," "students of color," "queers of color," etc. As one leading thinker puts it, "all wymyn are people of color." Therefore, colored people, or coloreds, for short. We have come full circle.] >The issue here isn't a constitutional issue. It's a *statutory* right. >And a real one. Sex discrimination in employment is prohibited by law. >We can call this a "civil right" or something else, but the if the facts >alleged in the case to which TCM refers are as claimed, they seem to have >a fairly good case under the law as it stands. And there's a lot more >than skimpy outfits at issue, including a refusal to hire men for what are >allegedly food service jobs (gender may only be a determination of >employment if it is a bona fide occupational qualfiication, e.g. policing >the showers in the gym; gender is not a BFOQ for food service jobs.) It is not the business of any regulatory agency to _second-guess_ why I want my girls at my Hooters to wear skimpy outfits. In fact, there is no real doubt why the girls are dressed as they are. (Hint: the name.) The girls can choose to work for me, or not. No slavery is involved. (Of course, I also favor legalization of indentured servitude. The military is allowed to buy X years of labor by paying for a student's education, so why not IBM? It might actually help the unemployment crisis we are now in.) In any case, I choose to focus on politico-jurisprudential issues, of what the law _should_ be, not what the current mess says is the law. As Roseanne Barr--not one of my favorites--recently so cogently observed: "Heidi Fleiss is going to prison, OJ Simpson is playing golf in Brentwood...we're living in Dante's Inferno." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"eli+(a)GS160.SP.CS.CMU.EDU" 13-MAY-1996 19:59:41.90 >EALLENSMITH(a)ocelot.Rutgers.EDU writes: >> The different paths going through those different signatures will be >>correlated/non-independent, yes.... but that isn't the problem unless you're >>considering multiple paths (in a more complicated version). >To determine key validity, you do have to consider all paths. If a >single trusted path to the bad key exists, the attacker wins. Hmm.... a useful distinction in this is between multiple paths with no common elements except the beginning and end and ones with common elements. The sections of the ones with common elements that have no common elements can probably be treated as a subset of the larger path - a virtual link, if you will - with its values (trustworthiness et al) determined by the paths contained within it. >> IIRC, there have been some sociological studies showing that _everyone_ >>is linked through 6 or so people. >Milgram's "small world" experiments used a much looser sort of "link" >than we want here. It would be certainly interesting to know how >large a difference this makes. Milgram? Thanks, I'll check for that name. >It's true that you don't need to talk to everybody. The problem is >that I might want to talk to people whom I don't know personally, but >know by reputation, or by function ("DEA Rat Hotline" -- well, maybe >not). I'm not disputing that... just that you don't need to be able to go through the web to reach everyone who's got a key. Admittedly, the subsection of people who have keys are more likely (through being more technologically sophisticated et al, on average) to be useful to contact than those who don't. -Allen

1 0