December 2003 - cypherpunks-legacy

Systemics Announces First Internet Trading System
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 18 Jul 1996 12:48:03 +0200 From: Ian Grigg <iang(a)systemics.com> To: rah(a)shipwright.com Subject: Systemics Announces First Internet Trading System Systemics Announces First Internet Trading System 17 July 1996. Copyright (c) 1996 Systemics Ltd. 1996 could well be the year that marks the start of the Internet Financial System. Consider these developments: * Intense competition between rival payment systems has erupted as the large payment institutions have woken up - the new territory is on the Internet. * Earlier this year The Spring Street Brewery surprised Wall Street by conducting its own IPO - by the simple expedient of using the Web as a communication medium. After several weeks of hectic phone answering, CEO Andrew D. Klein realised he was in the wrong business and announced plans to start a new industry: Internet investment banking. * Across the pond in that other giant of international finance, the paperless trading system Crest starts up this week at the London Stock Exchange, signalling massive job losses. The exchange's troubles began late last year when exchange-member ShareLink was discovered delivering trading information on the Internet. The exchange severed ShareLink's "feed". Claim led to counter-claim, with litigation close behind, in a slanging match that ruptured images of the calm, polite English way of trading. Before saner heads could move in to force closed-doors negotiations, the palace revolution was underway. Suing one of ourselves? It's just not cricket. And now, Systemics Ltd has added in the last remaining ingredient, the Internet Stock Exchange. After a year of hectic, but secret, development by a small team of cyberventurers, the Exchange went live in June with Systemics own debt. A cohort of private investors were placed with Systemics bonds, which now trade on a nightly basis. Trades have been mostly small and experimental, as the investors, all computer professionals, get to grips with the new-found power of instant access to the 'market'. The Genesis of a new Financial System Ian Grigg, co-founder of the team, concentrates on the business aspects during the daytime, and in his spare time, helps with coding the market. "It seemed like a simple thing back then, take the basics of digital cash, add in securities, and build a market to trade the securities for cash." In the summer of last year, co-founder Gary Howland was working on digital cash protocols for DigiCash. Meanwhile the Internet was exploding into the public eye, as conventional media started to realise the potential of the new medium. Howland conducted long email discussions with his future co-founder. "There was this awesome potential energy, just sitting around in the digital cash concept waiting for chance to go kinetic." Grigg was attending lectures on Finance as part of an MBA from London Business School. "In the day time, I was learning the basics of what a bond was, and at night we would have these unlimited discussions on where the net was heading. With each lecture, each discussion, the feeling was getting stronger - we had the tools in front of us. We could build an Internet Financial System." The Systemics team aren't the only ones to have seen the potential. Bob Hettinga, a prolific net writer, had described the basic concepts as much as a year before. Grigg thinks that it took the combination of diverse skill sets and motives for ideas to turn into reality. "We're continually surprised that nobody else saw it and jumped in. But if you analyse the work that went in to the software and the building of knowledge in the core disciplines, it really is a major project that is too risky for any conventional company. I would guess it can only be done by a small, tightly focused team with key individuals. Or, by one of those great, wide ranging alliances that bring in diverse stake holders." The Internet Financial System will consist of Issuers, Payment Systems, Markets and Investors, just like in the physical world. An Issuer runs a special service suite on the Internet to manage the financial instruments. Those instruments are placed by the Issuer with a private group of Investors. Then, when the Exchange accepts the issue and runs a Market in that instrument, Investors can trade the instruments using Systemics Trader, a specialised browser. Instruments are bought and sold for digital cash, provided by an Internet Payment System. The Systemics team are proud of what they have achieved. Grigg explains: "The small investor gets direct access to the markets. Settlement is immediate - when the trade is done, the money or instruments are waiting for collection. And with the security of modern forms of cryptography, there's a lot of peace of mind. This Exchange carries no risk, which results in a cost to the Investor that is so small that it creates a new segment." Internet Trading Takes Off In the first instance, it was necessary to prove the system under real trading conditions. Systemics issued its own debt as one year zero coupon bonds with a face value of USD 10. Each of the investors was given a tranche at an issue price of $9, allowing investors to earn a dollar for every nine dollars invested over the full year. To manage the portfolio of cash and bonds, each investor downloaded Systemics Trader. On the 25th of June, the first live market was opened by the Exchange for the first investor trades. "Since then, we have gradually settled into a routine. The market opens at 1915 GMT, for a six hour trading session. This time slot seemed to give the best access for our investors, who are located in diverse time slots and daily patterns." Trades are not frequent as people who have never traded before get to grips with the concept. "Our investors are all long term associates who understand the future of the Internet. They were keen to invest in what we think is the most advanced project on the Internet today. For all that, trading got off to a slow start as investors proved initially timid at risking their own cash and bonds." However, within a week, the backers are showing all the signs of an aggressive investor community. "If they're not happy, they don't trade." Demands for additional instruments caught Systemics by surprise, as investors pointed out that without a comparison between instruments, there is no decision on value. "It's obvious in hindsight, there's a limit to what people can do in a one-bond exchange." The challenge now is to decide on alternative instruments. Secure Payments are based on Cryptography At another level, the Exchange is just a complicated shop on the Internet. It buys and sells financial instruments for cash, and relies on a secure value transfer system to make the trade. "When we laid down the strategic components a year ago, there was no sure availability of any payment system, let alone one up to the rigors of finance. So we had to do our own," said Howland. In a forthcoming paper, he describes a design for a digital payments mechanism built upon the cryptographic key format in Phil Zimmermann's Pretty Good Privacy, the Internet standard for email encryption and digital signatures. "PGP is the only system that is widely available and provides good security. The challenge was to turn it from a message passing system into a value passing system." The Systemics payment system works on the notion of a value-containing box that is controlled by a PGP key. A server holds the public key, anyone who has the private key can control the box. A box can be used as an account, allowing the conventional management schemes of accountancy to be used. In this case, the server ascribes value to the box, and the users write instructions to transfer value from one box to another. Or, it can be used as a coin, allowing cash emulation. In this case, users transmit secret keys, and coins are cashed in by issuing instructions to transfer the value in a received coin to a box account. Howland states that this design allows for immediate settlement in both financial instruments and cash, a critical issue in financial markets. Also, the use of PGP keys makes independant verification of the protocols a relatively low cost task by leveraging off of the enourmous amount of trust placed in PGP. Systemics believes in open cryptography. "We intend to publish all our protocols with example software, and our goal is to publish a complete and working payment system. Cryptography and digital payment mechanisms are socially beneficial and should be widely disseminated." Systemics have already published their Cryptix library, providing strong cryptographic solutions for Java and Perl developers. The Investor Takes Control Systemics Trader, the specialised trading browser, is written in Java. "As far as we know, this is the first serious application written in Java outside Sun itself," commented Mike Wynn, author of Systemics Trader. Working as an HTML browser, Systemics Trader can pass through firewalls set up to allow WWW browsing. This has doubled the potential user base; about half of Systemics' investors work on secure systems. Systemics Trader manages a portfolio of financial instruments and cash using a 'box' as a digital account. 'Limit' and 'Market' orders can be submitted, tracked and cancelled. The 'board' for market instruments can be monitored on an investor-demand basis, so as to present the latest prices to the investor. A secure registered mail protocol is used to ensure messages containing value get delivered from the Exchange to the investor. Given the vagueries of the Internet, Systemics Trader has to sign for each payment that is sent to it before the payment is considered to be delivered. Then, both parties to the trade know that the deal is done. Future versions will manipulate both digital cash and digital accounts, as well as multiple currencies. Real-time feeds are also a possibility. For now, however, Systemics is concentrating on building in the basic features and reliability that risking an individual's money will demand. Wynn's plans are oriented towards the developing a trading library that can be used as the basis for a whole class of browsers. "In the short term, our investors and testers are still proving the system for us. In coming weeks, we intend to release a new version of Systemics Trader for widespread demonstration purposes on our test markets." An Internet Team Systemics Ltd, an Irish company, holds the brand and fronts for the team in any formal discussions. But the real capital is in the heads of the many individuals who have contributed. Outside the tiny core is a small group of "insiders" who contribute ideas, software development and testing. And outside this group is the Internet software community. Enourmous amounts of freely available software have gone into the system, making the efforts of the group just the tip of the iceberg, and the core team just the bunch of penguins sitting on the tip. "We are an Internet team, not a company in some office. What some are calling the virtual company is really a series of concentric circles flowing out over the Internet. The pebble dropped in the centre of the well is the idea, the development waves move out and reflect back in to form the product. Think about Internet development as that big node where all the waves rush in to one point." Acknowledgements This information release from Systemics Ltd. Copyright 1996 Systemics Ltd. Free and widespread distribution is permitted, as long as attribution is maintained. Please point your readers at our home page: http://www.systemics.com/. This release will be located in docs/releases/1996-07-17.html Systemics, Systemics Trader and Cryptix are trade marks of Systemics, Ltd. The Spring Street Brewery can be found at http://plaza.interport.net/witbeer/ and Wit Capital at http://www.witcap.com/ ShareLink is at http://www.esi.co.uk/sharelink/. Also see InfoTrade http://www.infotrade.co.uk/. Bob Hettinga, prolific net poster, is at http://www.vmeng.com/rah/ or rather, his e$ homepage is. Subscribe to the e$ mailing lists for the latest digital cash gossip. Pretty Good Privacy and PGP are trademarks of PGP, Inc. Phil Zimmermann and PGP are thse days better found at their new corporate home: http://www.pgp.com/ Java is a trademark of JavaSoft, found at http://www.javasoft.com/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Cybank breaks new ground; rejects public-key encryption
by Seth I. Rich 17 Dec '03

17 Dec '03

C Matthew Curtin (cmcurtin(a)megasoft.com) wrote: >People need to learn that the sort of snake oil that is being sold as >"secure" just won't cut it. Your concern for the customers of Cybank >is valid, however, so I propose something along these lines: > >Announce, very publicly, such that every Cybanlk customer would hear >about it in time, that you have cracked their hokey little non-crypto >scheme, and that you intend to publish your work in a full-disclosure >paper to be published on Month Day, Year. [...] I chuckled when this whole Cybank thing started. Only a month or so ago, they had some funky bug in their mail system such that all their internal email was being cc'd to the First Virtual users' mailing list (and also to one poor individual). They were helpless and completely unable to figure it out, as we watched their (not very happy) internal messages float unrequested into our mailboxes. Seth --------------------------------------------------------------------------- Seth I. Rich - seth(a)hygnet.com "Info-Puritan elitist crapola!!" Systems Administrator / Webmaster, HYGNet (pbeilard(a)direct.ca) Rabbits on walls, no problem.

7 6

Re: Symantec's Your Eyes Only
by Clay Olbon II 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> wrote: >At 11:57 AM 7/16/96 -0400, Clay Olbon II wrote: > >>Now my $.02. I am concerned about the lack of a distinction between >>transient communications and stored data. This is apparent in the GAK >>proposals, but is also increasingly apparent in mainstream corporate >>products such as this one and ViaCrypt BE. It is apparent (to me anyway) >>that corporate access to stored data (data owned by the company, on >>machines owned by the company) is probably necessary. I do not see this >>same need for access to transient communications. Am I way off base on >>this one? > > >This has been mentioned a number of times by various people. It should be >obvious that it is pointless to escrow the key of a data stream that you are >not recording, such as a telephone conversation. Also, if you have no >permanent need for that data (also, the telephone conversation) it is >unnecessary. As might be expected, however, the proponents of GAK don't >distinguish between keys for storage and keys for communication. > >Such an oversight is predictable. It's likely that governments will be >more >interested in keys for communication, because the data is far more easily >(and secretly) accessible. Were they to admit that nobody has a need for >his own communication data key, they'd lose a substantial fraction of their >target data. > My point was not that govts want to escrow communication keys, it was that this is appearing more and more in commercial products marketed to businesses. I run the computer system for a small office and I would rather not see employee email - maybe I am just naive. However, there obviously is a demand for this type of product. It must come from either a lack of understanding of crypto, or a freeh-style authoritarianism on the part of corporate executives. I wouldn't rule either one out. If it is the latter, I'm not sure there is anything we can do. Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

1 0

ABC News on internet telephony
by Clay Olbon II 17 Dec '03

17 Dec '03

There was a pretty long piece on the evening news on using the internet for long distance and how much money can be saved. Even had several demos of intercontinental phone calls. The disappointing aspect was they didn't mention PGPfone (although if they had, I'm sure child pornographers and terrorists would have been mentioned as well :-) Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

3 2

Re:Seek And Destroy
by rednax 17 Dec '03

17 Dec '03

Hmm, this page however, does something if you are using netscape www.angelfire.com/pages0/cbp3/index.html -- r 3 |) |\| @ >< rednax(a)asiapac.net "violent! you mean it's alive??"

1 0

Re: SecureDrive(IDEA), Realdeal and plaintext attack
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Cc: cypherpunks(a)toad.com galactus(a)stack.urc.tue.nl Iolo Davidson<iolo(a)mist.demon.co.uk> On 18 Jul 96 at 4:19, Edgar Swank wrote: > JFA wrote: > > Question: > > > > Since realdeal overwrite everything with 0s, and that theses > > zeroed sectors are encrypted later with IDEA, will that give an > > attacker an edge? The attacker will likely know that there are > > large disk areas that contains 0s. > > > > Any comments? > Yes. Each sector encrypted by SecureDrive also incorporates a "salt" > value derived from the sector address and (usually random) volume > serial. So encrypted zeroed sectors will be different from each other > and (without the IDEA key) cannot be distinguished from sectors > containing data. IDEA is reputed to be resistant against known plaintext attacks. But I did not read about wether or not it is resistant to several-plaintexts (?choosen plaintext) attack. If the sectors were not salted, each zeroed sectors would translate in an identical way on the encrypted disk. So, there would be only one cyphertext-plaintext pair repeated over many empty sectors. If you salt the encryptor, there are many different cyphertexts corresponding to one single plaintext. Can the salt be figured out by an attacker? If yes, would the many-cyphertext to single-ultimate-plaintext could give an edge to an attacker? In that case, it would be effectively better to not wipe a drive with zeroes. The problem is, realdeal cannot be turned selectively for only one drive while not wiping the other one. Thanks for your reply. JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants: physicists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

2 1

Adapting PGP to other languages
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 Jul 96 at 18:10, anonymous-remailer(a)shell.port wrote: > Does anyone know how to tanslate PGP into Burmese? The PGP sources have a language tool in the 'contrib' directory for translating the language files. Being fluent in 'Burmese' or whatever language you want to translate it to is helpful. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Making encoding out of an authentication cipher
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 Jul 96 at 19:36, EVERHART(a)Arisia.GCE.Com wrote: > Had an interesting thought, maybe worth passing on for commentary. > > (...since "authentication" ciphers are considered "harmless" by > those interested in spying on your info...) > > Suppose you have a secure hash function H(msg) that delivers a random [..] There's a section in Schneier's Applied Cryptography about using hash algorithms for ciphers. There are several ways of doing this, although some are stronger than others. One you adapt the hash algorithm to a cipher, it's a cipher, not a hash algorithm, and is regulated. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re:
by Arun Mehta 17 Dec '03

17 Dec '03

At 18:10 17/07/96 -0700, someone via anonymous-remailer(a)shell.portal.com wrote: >Does anyone know how to tanslate PGP into Burmese? I've been talking to human rights people here -- we certainly plan to translate into one or more Indian languages, and perhaps soon there will be action at an Asian level as well. Is this an urgent requirement? If so, I can try to arrange. Arun Mehta Phone +91-11-6841172, 6849103 amehta(a)cpsr.org http://www.cerfnet.com/~amehta/

1 0

Re: Crypto 96
by Deranged Mutant 17 Dec '03

17 Dec '03

On 17 Jul 96 at 16:45, Hal wrote: > Crypto 96 is coming up in about a month. This looks like a more > interesting program than last year, IMO. According to the preliminary [..] > Key-Schedule Cryptanalysis of IDEA, G-DES, GOST, SAFER, and Triple-DES > John Kelsey, Counterpane Systems, USA > Bruce Schneier, Counterpane Systems, USA > David Wagner, Univ. California at Berkeley, USA > > There are actually several cryptanalysis type papers for which > I can't tell from the title whether they will be big new > results or not. Anybody know what "key schedule" cryptanalysis > is? The way a key is transformed into a larger key or S-box. I assume cryptanalysis of these means that there may be weaknesses which can be exploited. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Encrypted files in terror case
by Joe Thomas 17 Dec '03

17 Dec '03

Excerpts from a N.Y. Times News Service piece available at http://www.nando.net/newsroom/ntn/info/071896/info12_18308.html : NEW YORK (Jul 18, 1996 02:00 a.m. EDT) -- In the seven weeks since the trial of Ramzi Ahmed Yousef began, the case, charging a plot to blow American jumbo jets out of the sky, has come to hinge on one off-white laptop computer. [Most of the story, dealing with the defense contention that Philipine police altered files on the laptop, deleted.] Several witnesses reported that some computer files were in code, part of which the police could not decipher. Last week, after the jury adjourned for lunch, Duffy [the judge in the case] prodded the defense to point out that encoding files was not unusual and that some software programs offer such an option. "I don't want the jury to think that encryption is something that only bad guys do," Duffy said.

1 0

RE: Cypherpunks and Toad.com
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

root@HellSpawn wrote: >I'd like to put the words > >Cypherpunks(a)toad.com > >On a tee-shirt. Is cypherpunks, toad.com, or the combination thereof >copyrighted or trademarked or otherwise limited for use? Not that I know of, and you are of course free to do anything you want, but I urge you to leave off the "@toad.com" to prevent clueless subscription requests/noise. There are a number of cpunk tshirts already, one of which contains TCM's sigfile, so the word is likely not copyrighted???

2 1

Re: ANNOUNCEMENT: PGPfone Beta 7 Now Available for Download
by Robin Powell 17 Dec '03

17 Dec '03

>>>>> In article <1.5.4.32.19960718150222.0030bf9c(a)giasdl01.vsnl.net.in>, Arun Mehta <amehta(a)giasdl01.vsnl.net.in> writes: > In response to my question about how I might use PGPfone without my ISP knowing, > At 10:52 16/07/96 -0400, Robin Powell wrote: >> >> Hmm... This looks like a _really_ good place for stego. Granted, you >> might get a significant slow down, but it might be worth it depending >> on your needs. > Wouldn't that be very, very slow? It would suffice if I could > have the ISP think that the packets were for irc, or something > else they allow... I actually wasn't reffering to your particular situation so much as a general comment. Having a game of nettrek with encrypted voice in the unused packets would be _very_ secure, I should think... -Robin

1 0

Re: Responding to Pre-dawn Unannounced Ninja Raids
by law＠Samoa.org 17 Dec '03

17 Dec '03

I prefer to keep a large jar of marbles available in the entry room, aoupled with a hard floor, it makes it a bit tricky for an entry team towork properly.. You can probably check out your local crack house for tips on preventing forced entry..there seems to be a constant race between LEO entry tactics and what the drug dealer do to defend themselves.. I might also suggest that you check out Bo Gritz'z SPIKE phase 8 video tape http://www.bogritz.com/products8.html "Perhaps one of most exciting phases and controversial. In Phase 8 you learn Close Quarters Combat (CQC). You'll learn how to identify friend or foe so that you don't shoot a friend. You'll also learn how to clear a room safely and identify a terrorist and hostage." SPIKE 8 also has a good section on room defense. but then who am I to talk. bob's lawyer Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Re: US versions of Netscape now available
by liberty＠gate.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [I've wanted, and tried (honest!) to stay out of this emerging flamewar, but David Sternlight <david(a)sternlight.com> wrote: <...> >It doesn't "leak overseas" as if there were some regrettable lapse in the >plumbing. Someone has to commit a felony violation of Federal law. Also known as "civil disobedience," a dangerous concept which is probably being taught today in civics classes in highschools across the nation. [HORRORS!] On a more serious note, I think that the requirements on the Netscape download page might actually be a "Good Thing," since they expose the public, in an election year, to the info-lust of the GAK crowd in a way that cypherpunks alone never could. I, too, wish that "my life as an arms trafficker," or the CJR book/t-shirt requests, or some of the wilder stuff like Vince's export-a-cryptosystem-to-Anguilla page were linked to Netscape's page discussing ITAR requirements, but I fully understand that Netscape is a business and that they must deal, on a continuing basis, with the government. The government officials whose jobs depend on stupid regs. can be rather humor-impaired. JMR Regards, Jim Ray -- DNRC Minister of Encryption Advocacy "It is long past time to end the laughable presumption that voters who can easily cope with the choices offered at Burger King are somehow 'confused' by more than two choices at the voting booth." -- me Defeat the Duopoly! Vote "NOTA," not Slick/Dull in November. Harry Browne for President. Jo Jorgensen for Vice-president. http://www.HarryBrowne96.org/ ___________________________________________________________________ PGP id.E9BD6D35 51 5D A2 C3 92 2C 56 BE 53 2D 9C A1 B3 50 C9 C8 <mailto:liberty@gate.net> http://www.shopmiami.com/prs/jimray Coming soon, the "Pennies For Perot" page. Keep billionaires off welfare! ___________________________________________________________________ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Freedom isn't Freeh. iQCVAwUBMe5TwW1lp8bpvW01AQFbpgP/aic2ShJ5N09eVJLxZAUfkP1FsNlNRdFY MNgLvE8+0PnlLoXA2Js5HVo7Zad7URYrtwrSG2C7MwPcs6zwXgxLT6pf+oCg05/m fqaGbc/bWFLTyJDV/+BNEZCWRXPr19FvHv+0NNEVYbQ81IuQsLIgBf/E3g2KXD6X Ma44rCMPTFU= =JR+d -----END PGP SIGNATURE-----

1 0

Re: "address verification databases"? (was: Netscape download...)
by Ryan Russell/SYBASE 17 Dec '03

17 Dec '03

So... I just have to know someone's name and phone number in the US? Ryan ---------- Previous Message ---------- To: tcmay cc: cypherpunks From: jsw @ netscape.com (Jeff Weinstein) @ smtp Date: 07/18/96 12:47:22 AM Subject: Re: "address verification databases"? (was: Netscape download...) Timothy C. May wrote: > > At 9:45 PM 7/17/96, Jeff Weinstein wrote: > > > Because we have not yet been able to obtain the address verification > >databases that we need for Canada. There is someone working on > >tracking this down right now. When we get the proper database we > >will add access to canada. > > > > --Jeff > > Jeff, can you tell us anything more about what these "address verification > databases" are? > > For example, are they derived from government sources? Census data? (Naw, > can't be, for at least two obvious reasons). Voting records? (Naw.) Credit > card purchases? (??) Our database was obtained from American Business Information. They make those CDROMs with 11 million business names and addresses, and other such products. There is a link to their web page from our US download page. > While I can imagine various commercial firms have indicators that a "T. > Christopher May" once lived in Rio Del Mar (the name of a town I lived in, > though not an official "Postal Service" address), I really find it odd > that, for example, there would be any database that could "parse" the > informal information people provide (absent a well-defined set of addresses > and precise spellings). > > In case I'm not making myself clear, there are no "official" addresses of > persons in the U.S! Not even the tax system requires registration of all > persons and specific addresses. This has come up in several "voter's > rights" cases, where persons with no fixed address were nevertheless able > to vote. If I, T.C. May, say my address is Moonbeam Trailer Park, who's to > say it's not? Maybe it's where I'm staying with a girlfriend, maybe it's > where I get my mail, maybe it's my spiritual home. And yet just which > "address verification database" could possibly confirm that I live in (or > get my mail at the Moonbeam Trailer Park at this exact moment? Absent any > laws clearly defining what one's official name is, official phone number > is, official zip code is, official address is, etc., just about anything we > choose to put down on the Web form is kosher. Our verification software does not check that the person whose name is entered in the form lives at the address entered in the form. We do verify some parts of the information entered. Things like is the state code one of the 50 states, does the zip code match the state, etc. (NOTE - these may not be the exact checks implemented currently. I have not examined the code myself, but these are the types of checks being done.) > At least the MIT system was based on ISP domain names, crude as this is, > and not on putative names and residential or business addresses. We also screen out based on domain names. > Anyway, I don't know if Netscape is rejecting the information I'm providing > them, as I've been unable to get through in roughly 30 connect attempts. We will be increasing capacity soon. The demand is very high. It costs us real dollars to buy hardware and T3 lines to allow people to download the software for free. > But I'm still curious about what these "address verification databases." > Sounds ominous to me. I'm sorry that my choice of words disturbed you. I hope my explanation will allay at least some of your fears. There are many people here (including Jim Barksdale) who are very concerned about maintaining personal privacy. Certainly if we could we would make the US versions of our software available in the same way that we currently make the export versions available. At least people now have the choice of obtaining the US version over the internet. --Jeff -- Jeff Weinstein - Electronic Munitions Specialist Netscape Communication Corporation jsw(a)netscape.com - http://home.netscape.com/people/jsw Any opinions expressed above are mine.

2 1

Re: Making encoding out of an authentication cipher
by David F. Ogren 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To: EVERHART(a)Arisia.GCE.Com, cypherpunks(a)toad.com Date: Thu Jul 18 12:44:15 1996 > Suppose you have a secure hash function H(msg) that delivers a random > long period set of hash bits for msg, which is computationally infeasible > to invert and such that the value of H(msg) depends very sensitively on > all bits of msg. These things are used for authentication and tend to > be > all over the world. > > Now suppose I have a key and apply the following transform, where "+" > will mean binary exclusive OR. > > Cipher: > H(key) + M(1) = C(1) > H(key+M(1)) + M(2) = C(2) > H(key+M(2)) + M(3) = C(3) > > and so on where M(n) is the message and C is the enciphered message. > > Decipher: > > H(key) + C(1) = M(1) > H(key+M(1)) + C(2) = M(2) > H(key+M(2)) + C(3) = M(3) > > and so on. > > If the hash function is cryptographically strong, is this or is this > not > a strong cipher? Are there fast hash functions around? > This, along with several other methods (Karn, Luby-Rackoff and MDC are some others) have been suggested in order to convert a hash function into and encryption algorithm. And while the method you suggest has not been broken (at least to my knowledge) there are at least two major problems: 1. It is slow. This method would appear to be approximately the speed of MDC. And MDC (using SHA, what appears to be the most secure hash) is (very roughly) 5 times slower than Blowfish and 3 times slower than IDEA. And although MDC is faster than 3DES in software, 3DES could easily outpace MDC in hardware. 2. (To directly quote Bruce Schneier from Applied Cryptography, page 353) "While these constructions can be secure, they depend on the choice of the underlying hash function. A good one-way hash function doesn't necessarily make a secure encryption algorithm. Cryptographic requirements are different. For example, linear cryptoanalysis is not a viable attack against one-way hash functions, but works against encryption algorithms." (Any typos are mine.) - -- David F. Ogren | ogren(a)concentric.net | "A man without religion is like a fish PGP Key ID: 0x6458EB29 | without a bicycle" - ------------------------------|---------------------------------------- Don't know what PGP is? | Need my public key? It's available Send a message to me with the | by server or by sending me a message subject GETPGPINFO | with the subject GETPGPKEY -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMe5p4uSLhCBkWOspAQFzLQf+J7VGyboBIb4/x2uT3ACs/xgMP11EnggF 6xnrT/TalqJofF1KcEGa3+DgfRRSAn0lxe2jGnLRCAj85zNwXNBy6V4A9pr/0Ldg lD0aHpDFBRXZngqHtCANce8OJvC/EwPbotOuFR+V2vwrB7CHD+4XlNxcfcWDZN7i /ffD6YdUnOpKtvj5ElmPmbOfODC10XD35nRbu1NMurmJQESA14Ohzk9KhRzVkNtv pYkwcCqkR2kWGnWSkew9Zfw4U+IOdFiwb9etgiOEl86hM38cK1SM1RxArEfW3vIw k2EM6o/rF4OIiDUYlJ3STxYAn7kAnOQ6PeYeUu48WmX1Y3q05qmFrQ== =Hj2r -----END PGP SIGNATURE-----

1 0

Re: US versions of Netscape now available
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:35 AM 7/17/96 -0700, Yap Remailer wrote: >Have you heard any reports of anyone successfully downloading it >period? Netscape always times out in the middle of a download. I >think the server is so overloaded that it's actually impossible to >download the software. Yep. Got it just after the announcement. Came through fine. (After that, i could not get it to download anything, but the first try worked fine.) Sounde like it is overloaded. (Of course, since it is mentioned on their homepage and they only have one machine serving it, what do you expect?) >I sure wish there were an ftp site overseas somewhere, then I could >actually get the damned thing. Give it a week and i am sure that someone will have it available. Something announced this far and wide will manage to leak out somewhere... --- Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ "We had to destroy the Internet in order to save it." - Sen. Exon "Microsoft -- Nothing but NT promises."

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by Steven Seyffert 17 Dec '03

17 Dec '03

Part of original message below Well Stig, the world is getting crazier by the second..... What about the dutch man that made a trademark out of the name 'Route 66' combined with the highway sign. He got it and now has a nice swimming pool.........of about 100 meters long.......and it's heated! -- ________________________________________________________________________ Steven Seyffert Webmaster at http://www.sale.nl/ Korenbloemstraat 17 3551 GM, Utrecht Utrecht, the Netherlands +31 (0)30-2441251 webmaster(a)sale.nl private: steven(a)knoware.nl ---------- : From: Stig <stig(a)hackvan.com> : To: cypherpunks(a)toad.com : Subject: Re: #E-CASH: PRODUCT OR SERVICE? : Date: woensdag 17 juli 1996 5:00 : : > btw: I'm surprised DigiCash didn't file for a European Trademark, : > but opted for Benelux and US protection. : : Perhaps this has already been voiced on the main list (I get a filtered : helping or two of cypherpunks), but *I'm* surprised that such a generic name : as 'Ecash' was granted trademark status anywhere. : : It's like giving Microsoft a trademark on the term 'Email'... It's nuts! : Was the term ecash not in use before DigiCash showed up on the scene? : : Stig : : :

1 0

Borders *are* transparent
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:51 AM 7/18/96, snow wrote: >On Tue, 16 Jul 1996, David Sternlight wrote: >> At 3:36 AM -0700 7/16/96, Duncan Frissell wrote: >> >At 04:18 PM 7/15/96 -0700, sameer wrote: >> >> Not like that's tough to figure out. Congrats. It's cool to >> >>actually be able to connect to my webserver using real encryption. >> >>Glad the lawyers don't think Barksdale is going to jail anymore. >> >I'm glad too. So how many minutes did it take to leak overseas? >> It doesn't "leak overseas" as if there were some regrettable lapse in the >> plumbing. Someone has to commit a felony violation of Federal law. > > No they don't. If they are French, Russian, English, Greek, etc. They > _may_ be violating their countries laws, but they are not necessarily >violating ours. This is a terribly important point: if a citizen of Foobaria succeeds in connecting to the Netscape site--perhaps by experimenting with various combinations of domain names and submitted address/zipcode combinations--and Netscape sends him the file, he has not committed a crime in his own country. (Unless they have their own laws....) Ironically, under the ITARs, as I understand them, a citizen of Foobaria who "exports" (= retrieves from Netscape's site) such materials actually *has* violated our ITARs. (It is possible for persons outside the U.S. to violate U.S. laws, of course. You can all imagine examples.) Prosecuting a person in Foobaria for violating U.S. ITAR regs would of course be problematic, and unlikely. Likewise, much "export-controlled" software is freely purchasable without any form of identification or proof of citizenship/residency in any of thousands of U.S. software stores. (I don't know if the copies of Netscape Navigator on the shelves in U.S. stores are now the "U.S." version, as opposed to be a somwhat-crippled version, but I sure do know that a *lot* of nominally-export-controlled software _is_ freely purchasable.) Much of this software goes out of the country in luggage. In my various flights out of the U.S. over the years, never have my bags been so much as glanced at, except presumably for bombs with sniffers, scanners, etc. Further, I have mailed optical disks out of the country--a single one of these can store a whole lot of stuff. (As I said in a 1992 interview, a DAT is like a shoulder-fired Stinger missile.) On a trip to France and Monaco last year, I deliberately carried several optical cartridges and couple of DATs, all crammed with software, PGP, RSADSI's MailSafe, Mathematica, etc. To make a point, and as props for my talk on crypto anarchy. Certainly there was no checking on the way out at SFO, and no checking whatsoever at Charles de Gaulle in Paris. (On my return trip, the bored inspector in San Francisco asked what my purpose in being overseas has been. Had I said "tourism" I would've been waved through. Instead, for interest, I said "Meeting with Russian cryptographers in Monte Carlo," just to see what would happen. He asked me what "cryptographers" are or do... "They make secret codes." He then waved me through. Sigh.) None of this is surprising, of course. Borders _are_ transparent. There are so _many_ degrees of freedom for getting stuff across borders. The hope that a bunch of *bits* can be stopped in ludicrous. _This_ is why I expect the Netscape beta to arrive overseas pretty soon. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Steganography
by Mark M. 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- There has been some discussion on steganography in the past few days. I've been thinking about the subject so here is a list of my random thoughts: 1. Steganography "standard": Current steganography software relies almost totally on security through obscurity. The problem with such an approach is that there is no standard way to extract data from .gif or .jpg files. If two people want to communicate using stego, they have to have some secure channel through which they could negotiate a protocol that could extract information from data files. This brings up the same Catch-22 situation that exists with conventional cryptography. My idea is that there should be some common, well-known way to de-stego data files. This really doesn't weaken the security of any stego software because if strong crypto that doesn't append any headers on to the message is used in conjunction with stego software, then the output of a stego program would just appear to be random garbage. There would be no way for the feds to prove that the random data was encrypted. I don't know much about graphic and sound file formats, but I think that in most cases the least-significant bit of a graphics or sound file should be pretty random anyway. 2. Recognizing stegoed data: Another problem with stegonography is that while many programs use some kind of identifying header so the recipient can tell whether the file contains hidden information or not, this also allows a snooper to determine the same thing. I think that the ability for the recipient to identify whether the data is stegoed or not is important. So I came up with the idea of using a MAC keyed with the session key used to encrypt the hidden data for checking if the picture contains stegoed data. With this approach, an attacker would not be able to verify if a file contained hidden data or not since the session key would be encrypted with the recipient's public key. 3. Message pools: With steganography more widespread, the use of message pools becomes a lot more interesting. People could communicate anonymously using one of the alt.binaries.* groups with everyone else reading the group completely oblivious to this fact. The posts would be pictures that would decode normally, but only the recipient would be able to decrypt the hidden data. Since the binaries newsgroups are among the most popular on the Usenet, reading one of the binaries newsgroups would draw less suspicion then reading alt.anonymous.messages. I don't know how reliable some of the binaries groups are since many NNTP servers don't carry them or expire the articles early, but since cross-posting seems to be fairly common on those newsgroups anyway, a cross-posted file with stegoed data would have a good chance of reaching the recipient. - -- Mark PGP encrypted mail prefered Key fingerprint = d61734f2800486ae6f79bfeb70f95348 http://www.voicenet.com/~markm/ -----BEGIN PGP SIGNATURE----- Version: 2.6.3 Charset: noconv iQCVAwUBMe6OdLZc+sv5siulAQHMOAP/Yv6SLWY/CCXzXj/91q0hh2M3oVjMr7a6 RBEKCaExosbjJojoTlM9epyzO/gC4jrAj+3IIeciPLHyJPgF2CJmW3NU4bRHPls5 d2kEUPCIc/mLVcbieEC4OO7QlYeFY0vIBn+y1CO3V0kLN20N6Y3845p4a7BY6Wa+ u7dE12QbZLc= =8xQ7 -----END PGP SIGNATURE-----

1 0

Mac Crypto/ internet commerce workshop , sept 5-6, cupertino..
by Vinnie Moscaritolo 17 Dec '03

17 Dec '03

The Mac Crypto / Internet commerce workshop,( gathering, conference) will happen...YES (if more like machack than anything else.) The dates will be Sept 5/6, Here in Cupertino, CA at Apple. In addition I will also host the Aug (late) or Sept Cypher-punks meeting one of those nights too. My goals are: 1) to provide a vehicle to educate any and all Apple employees and Developers who are responsible for apple's future on the internet about what is going on in the Internet commerce world. 2) To provide a forum where developers can work together to create internet commerce producs for the Macintosh platform. I am responding to the copious feedback that I have recieved from developers both at WWDC and MacHack, through the various mailing lists that I run (Mac-crypto, net-thinkers etc) and through personal contacts. >>>>>>>> I am looking for folks to talk, papers etc.. <<<<<<<<< The (real) prelminary agenda goes something like: (day one) Introductions and overviews: 1) Introduction to crypto technology, what is it who are the players. 2) Introduction to electronic commerce (Finacial cryptograpy), e-cash, e-checks, digital bearer bonds, etc. 3) How to use this technology today, where is the oppertunities. 4) What needs to be done on the Mac, oppertnunites. (day two) Tech stuff. 1) Random number generation on the Mac, (the key to strong crypto) 2) Password management and the Mac (How to get something better than the Powertalk keychain) 3) Optimizing crypto on the PPC. 4) How to write a OT network server that will give you the performance required for transacting business. remember this is a totatly grass-roots thing, but we are gathering momentum. Look at how effective Internet-config is on the Mac. The conference will materialize more in August, consider this an official anouncement. So book your air tickets, while they are cheap.. (bring a parachute?) be there, aloha! Vinnie Moscaritolo Developer Tech Support http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A

1 0

Secure IRC conversations
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

Hi there, does anybody know of a way to have encrypted conversations on the IRC or via ytalk? Thanks, Harka ___ Blue Wave/386 v2.30 [NR]

4 3

Re: Opiated file systems
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:05 AM 7/18/96, jim bell wrote: >It has long occurred to me, considering the size and low power of the >typical 3.5" hard drive compared with the size of the typical house or >apartment, that it might be an interesting project to remotely connect such >a (hidden) drive to your computer using a reasonably surreptious link that >is difficult to trace. Say, an IR optical link, a single bare (unjacketed) >optical fiber, a LAN with hidden nodes, or a similar system. Maybe an >inductive pickup. In any raid, they'll have to decide what to take, and >chances are very good that they won't find every hidden item. I think the druggies call this a "rat line": two apartments next to each other, with the humans living in one and the drugs stored in the other. The drugs are gotten through a hole in the wall. (Hey, I'm not saying it works, or that it stops raids, prosecutions, convictions, etc. Just noting the existence.) Any multi-unit apartment can do this already, with data. The hard disk can be upstairs and two units away, connected with Ethernet (as many apartment buildings out here in California already are), or whatever. Any raid on Unit 3B, for example, finds that no files are stored locally. A separate investigation and/or search warrant for whereever the files actually are stored would be of course problematic and/or delayed. (Friends of mine have worked on "remote storage" ideas for exactly such applications. Clearly there are many options: storage in other local sites, storage in offshore sites, encrypted storage, even storage by a "priest" functionary ("Son, I am ready to receive your digitally transmitted confession.").) Lots of possibilities. For various reasons, few have been pursued. (Mostly because, I think, there have been relatively few raids on data, and when there have been raids, there were usually other HUMINT-type factors involved. E.g., few child porn rings are going to be broken only on the basis of seized disks. As this situation changes, expect more "data archival" services to evolve.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 3

Internet Through Radio
by Jerome Tan 17 Dec '03

17 Dec '03

Does anyone know how to Internet through radio using packet modems? By next year, our telephone company will be implementing metered phones, this will be unfair to modem users since they do that to prevent people from talking to the phone for long hours.

2 1

RE: Responding to Pre-dawn Unannounced Ninja Raids
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

At 4:13 AM on 96/07/18 Timothy C. May wrote: >It's a mark of what has gone wrong with this country that >ordinary citizens actually fear the midnight raids, the no-knock >searches, the "threat suppression" by ninjas. I recommend an article sub-titled: Fourteen ways of looking at a blackshirt. I've excerpted particularily relevant pieces below. Eternal Fascism by Umberto Eco New York Review of Books (June 22, 1995) In spite of some fuziness regarding the difference between various historical forms of fascism, I think it is possible to outline a list of features that are typical of what I would like to call Ur-Fascism, or Eternal Fascism. These features cannot be organized into a system; any of them contradict each other, and are also typical of other kinds of despotism or fanaticism. But it is enough that one of them to be present to allow fascism to coagulate around it. [...] 3. Irrationalism also depends on the cult of action for action's sake. Action being beuatiful in itself, it must be taken before, or without, reflection. Thinking is a form of emasculation. [...] 4. The critical spirit makes distinctions, and to distinguish is a sign of modernism. In modern culture the scientific community praises disagreement as a way to improve knowledge. For Ur-Fascism, disagreement is treason. 5. Besides, disagreement is a sign of diversity. Ur-Fascism grows up and seeks consensus by exploiting and exacerbating the natural fear of difference. The first appeal of a fascist or prematurely fascist movement is an appeal against the intruders. Thus Ur-Fascism is racist by definition. 6. Ur-Fascism derive from individual or social frustration. [...] 11. In such a perspective everybody is educated to become a hero. In every mythology the hero is an exceptional being, but in Ur-Fascist ideology heroism is the norm. This cult of heroism is strictly linked with the cult of death. It is not by chance that a motto of the Spanish Falangists was Viva la Muerte ("Long Live Death!"). In nonfascist societies, the lay public is told that death is unpleasant but must be faced with dignity; believers are told that it is the painful way to reach a supernatural hapiness. By contrast, the Ur-Fascist hero craves heroic death, advertised as the best reward for a heroic life. The Ur-Fascist hero is impatient to die. In his impatience, he more frequently sends other people to death. [...] Franklin Roosevelt's words of November 4, 1938, are worth recalling: "If American democracy ceases to move forward as a living force, seeking day and night by *peaceful means* (emphasis mine) to better the lot of our citizens, fascism will grow in strength in our land." Freedom and liberation are an unending task. ---------------------- If you set out to defeat an enemy because you despise what they do or say, make sure that you are different - not just stronger. Ciao, James

1 0

Re: New Infowarfare Panel
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:14 PM 7/18/96, David Sternlight wrote: >At 8:30 PM -0700 7/17/96, Timothy C. May wrote: > >>Winn Schwartau is running conferences, is talking about the imminent danger >>of the nation's computer networks being knocked out (paraphrasing his >>latest "Wired" item: "imagine your ATM network being knocked out and people >>being unable to gain access to their money"). >> >>Schwartau is predicting/advocating a "fifth branch" of the military to deal >>with the this threat. A cyberforce, as it were. >> >>Color me skeptical, but I see this all as a lot of hype and fear-mongering. >>Folks in the Pentagon, FBI, and NSA probably see it as a way to get more >>funding, Folks in the consulting business probably see it as a way to crank >>up the seminar prices and increase the number and frequency of "Information >>Warfare" workshops and seminars. > >Haven't there been some worked examples of information warfare that make >this fear and the need to deal with it legitimate? I'm certainly not saying "information warfare" is impossible--for example, I did some work in the late 70s for DARPA on knocking out satellites with particle beam weapons. Specifically, I rebutted MIT Professor Kosta Tsipas' claim that directed energy weapons in orbit would require tens (or more) of Space Shuttle trips _per shot_. I showed the DARPA people how it could be done with 5 orders of magnitude less energy, and speculated that "ticklings" of satellites could be done with commercially available ion implanters--they got real concerned and I was not invited to the classified sessions where they discussed this threat model, as I lacked a clearance. However, the current wave of publicity about "information warfare" seems to focus on _possible_ scenarios, with Hollywoodesque overtones. (And I just learned that "infowar consultant" Schwartau is indeed "working on a movie." Not to ascribe impure motives to him--who's to say what's impure?--but it still sounds like hype to me.) >As I recall my background reading in the public press, wasn't the etiology >that we figured out how to do some pretty nasty things (the Gulf war was >one presenting occasion) to enemies' info infrastructures to threaten their >entire social system. Then, as I understand it, someone smart said >something like "If we can do this to them, then someone can do this to us." >and we were off to the races. Sure, we dropped conductive fibers on their power lines, we blew their dishes out with Special Ops sniper fire, and we did a lot of other such things. Could this destroy the nation's "infrastructure"? Hey, there have been scenarios for disrupting Wall Street, for all sorts of things. Bombs in power plants, knocking over high tension lines, etc. Some things never change. But destroying or even seriously damagaing the U.S. infrastructure would be _very_ hard to do. Sure, the government should think about such things. Utilities companies routinely plan for efforts to disrupt service. (I live a mile or two from where "Earth Action Now!" knocked over a power line about the time treehugger activist Judi Bari was partly blown up while apparently transporting a homemade bomb down here to Santa Cruz.) >It's the military and counterintel community's job to think like this and >act to protect us. I don't think imputing selfish motives is dispositive. I noted that there is a recent wave of hype: books, conferences, calls for action, even movie deals (:-}). Given that there is no real evidence that these mysterious "HERF guns" have ever been used, nor is there evidence that they would do much beyond knocking out the PCs in the office they were aimed at, this is why I said "color me skeptical." By the way, I was interviewed for the BBC programme "The I-Bomb," had discussions a while back with someone working on HERF guns, and have been in touch with Schwartau on this latest round (he contacted me). I'm still skeptical. "Extraordinary claims require extraordinary proof." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: ABC News on internet telephony
by Deranged Mutant 17 Dec '03

17 Dec '03

On 18 Jul 96 at 9:41, Clay Olbon II wrote: > There was a pretty long piece on the evening news on using the internet for > long distance and how much money can be saved. Even had several demos of > intercontinental phone calls. The disappointing aspect was they didn't > mention PGPfone (although if they had, I'm sure child pornographers and > terrorists would have been mentioned as well :-) PGPfone isn't marketed very well. Other Internet phone software is advertised in magazines, promotions with ISPs, etc. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

RE: overseas PGPfone and Netscape
by Jean-Paul Kroepfli 17 Dec '03

17 Dec '03

Ian Goldberg wrote: >Could various people with various architectures post MD5 or SHA1 hashes >of the files they downloaded? (i) very good idea (ii) Do you know where I can find a MSWin or MSDOS executable of SHA? Jean-Paul ~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~-~- Jean-Paul et Micheline Kroepfli (our son: Nicolas and daughter: Celine) eMail: JeanPaul.Kroepfli(a)utopia.fnet.fr Also Compuserve and MSNetwork Phone: +33 81 55 52 59 (F) PostMail: F-25640 Breconchaux (France) or: +41 21 843 27 36 (CH) or: CP 138, CH-1337 Vallorbe Fax: +33 81 55 52 62 (Switzerland) Zephyr(r) : InterNet Communication and Commerce, Security and Cryptography consulting PGP Fingerprint : 19 FB 67 EA 20 70 53 89 AF B2 5C 7F 02 1F CA 8F "The InterNet is the most open standard since air for breathing"

1 0

Re: (fwd) Re: US versions of Netscape now available---NOT
by David Lesher 17 Dec '03

17 Dec '03

> > Whatever YaKnow > > cybernut(a)nutcom.com > > 10401 Wilshire Blvd, Suite 805 > > Los Angeles, CA 90024-4628 > > (310) 475-3799 > > > > > > Isn't that nice. Some creep is proud enough of his skill at accessing the > trivially available InterNIC finger data that he posts it to invoke > harassment. And being a coward as well, he hides behind an anonymous > remailer. Of course, SternFUD himself advertised all the same material & much more hornblowing on http://www.switchboard.com; Check it out yourself. (I do note UnProfessor has removed the Panasana address that was there previously.) [IMAGE] DR. DAVID STERNLIGHT PROVIDES ECONOMIC AND STRATEGIC PLANNINGCONSULTING SERVICES FOR HIGH-TECHNOLOGY FIRMS. Strategic uncertainty is now the norm for the business environment. Wrenching events such as the fall of the Soviet Union, major shifts in technology and its location, and new directions in national and international policy strongly affect the medium and long-term business future...... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: Gorelick testifies before Senate, unveils new executive order
by jim bell 17 Dec '03

17 Dec '03

At 03:04 AM 7/18/96 -0700, David Sternlight wrote: >Serious studies have shown that the kinds of protections to make the >systems we depend on robust against determined and malicious attackers (say >a terrorist government, or one bent on doing a lot of damage in retaliation >for one of our policies they don't like) "Policies"? There you go again. A "policy," at least in regard to the US government, is not merely opinion, but is action. Action which may (legitimately) anger people. Action which may not genuinely be in the interests of American people, although you'd never get those government thugs to admit it. If somebody overseas doesn't like a US government "policy," maybe the best thing to do is to determine whether it's actually beneficial to the ordinary American citizen, or whether its benefits can be achieved simply by changing government behavior. So what's the best way to avoid "terrorism"? Maybe the fastest, more efficent, and overall best way to avoid it is to get the US government to stop doing things that foment it, rather than trying to protect against it after the fact. , have costs beyond the capability >of individual private sector actors. Your friendly neighborhood ISP, for >instance, probably can't affort the iron belt and steel suspenders needed >to make his system and its connectivity sabotage-proof, and so on. Even >cheap but clever solutions involving encryption in such systems require >standards and common practices across many institutions. None of which require government actions to achieve. If anything, what is required is that governments STOP doing things which discourage such implementations of encryption. Government is the problem, not the solution. >In such a case, where public benefits from government action greatly exceed >public (taxpayer) costs, This is the classic Sternlight misrepresentation. Chances are excellent that this public benefit you speak of is almost totally a benefit to government employees, not ordinary citizens. Government's "solutions" are predictably skewed to maintain government budgets, not actually designed to solve the underlying problem. Jim Bell jimbell(a)pacifier.com

1 0

RE: ABC news on Internet Telephony
by talon57＠well.com 17 Dec '03

17 Dec '03

David Sternlight writes: >There's something fundamental going on here beneath the surface. >Surprisingly, a recent item (maybe the one you reported) on this >suggests that the big phone companies are trying to use this >phenomenon rather than stop it. I think it was AT&T who announced >that they had web software that improved the quality of such >internet voice calls. Surprisingly constructive, in contrast to >the coalition of small phone companies screaming for the FCC to >"stop it". The FCC has wisely said they're not going to act right >now because it could kill an incipient new technology. There is something fundamental going on here, a lack of common sense, and/or critical reasoning. Lets try it again. Who is the most likely to be disintermediated by a global packet network? (how do you get to your ISP?) I assume by "big phone company" vs "little phone company" you are refering to long distance vs local service, tell me, if the RBOC's continue merging, at what level do they become a " big phone company." The RBOC's are not the only local service providers of course, here in Illinois alone there are more than 80 (at my last count) providers of local service, and soon there will be many more. The other "urban myth" you are helping to support is the notion that it is the local providers that are fighting deregulation. Ameritech filed for total unbundling in March of '93, and you don't see them insisting on having a percentage of the long distance market before the long distance companies are allowed to compete in the local loop. >This is the rankest speculation on my part, but could some of the >bigger, smarter phone company cum internet providers have done >some serious analysis and concluded that we're moving away from >distance-based rates for voice calls. Might they even have >examined where we'll be in the next ten years (with ADSL, etc.) >and decided that the network technology and simple market >economics makes fixed charges per "line" more profitable to them >than metered usage? Maybe this is wishful thinking on my part, but >some of the bigger actors are starting to behave in a surprisingly >counter-intuitive (based on the way we stereotype them) fashion on >this topic. point to point circuits are more efficiently handled by circuit switching rather than packet switching networks. Nicholas Negroponte wrote an interesting piece about asynchronous vs synchronous, I believe it is in his book "Being Digital." ADSL is an interesting attempt at digital telephony but expensive and basically would mean replacing existing central office switches. (backbone bandwidth) In a packet network you have to either dedicate a portion of the bandwidth for a synchronous circuit, or you have to have a very fast network and use very small packets (ATM), expensive either way. A single central office has many times the bandwidth of the widest part of the internet, and the average state has hundreds of CO's. If even a small portion of the Internets current users tried placing a call things would grind to a halt. A huge increase in the number of backbones and their bandwidth would solve this, but who will pay the bill? TANSTAAFL Sometime ago the discussion was on the cost of laying new fiber, may I suggest the realworld heuristic of "a million dollars a mile." Please note I am not trying to make fun of anyone personnally, I am in the words of Jubal Harshaw "heaping scorn upon an inexcuseably silly idea, a practice I shall always follow." Brian communicate globally, censor locally

2 1

Alternative Journalism
by enquirer＠alpha.c2.org 17 Dec '03

17 Dec '03

THE CYPHERPUNK ENQUIRER PRESENTS: "Adventures in Alternative Journalism" The Analysis Piece Alice stared at the two strange creatures. She was completely dumbfounded. "So let me see if I've got this right. You make really good wheels. But if the Queen of Hearts had wheels, her subjects who occasionally raid your borders would be able to get away faster, and you wouldn't catch as many of them. Is that right, Tweedledumb?" "I'm Tweedledumber. He's Tweedledumb. Yes, that's right. We have a technological lead over the Cards, and we have to maintain it." "So you won't sell them wheels?" "Well, it's more complex than that. A large part of our population is engaged in making wheels, and we make a lot of money selling them to the Cards. So we made a compromise. We only sell them SQUARE wheels." "But of course," Tweedledumb chimed in, "it's very expensive to make both square and round wheels. So most of our people only make square wheels, so they can sell them to both us and the Cards. Of course, our people are allowed to buy round wheels, IF they can find them." "AND," stated Tweedledumber, "since the wheel is patented here, we get to collect a hefty licensing fee for every wheel sold." "But the Cards DO have wheels!" Alice could see over the fence, and the Cards were happily zipping around all over the place. "And so do a lot of people over here. What happened?" "Well, we couldn't stop the Cards from building their OWN wheels ... " "And people like buying the Card wheels because they're faster than our wheels, and they're cheaper, because they don't have to pay us the licensing fee ..." "You see, we have a licensing treaty with the Cards for most things, so if they make something we have a patent on, they have to pay us, but the wheel can't be exported, so it can't EXIST over there, so our patents don't apply ... " "But I don't understand! You said you needed to catch people, but now you can hardly catch anyone!" Alice was totally astounded at what she was hearing. "It's only a stopgap measure anyway." Tweedledumber clasp his hands behind his back and started pacing. "We need to get an agreement with the Queen of Hearts that both of our people will only use, oh, say, pentagonal and maybe hexagonical wheels. That way, everyone can get around faster, but we'll still be able to catch them." "But who's WE?" "Anybody with a TLA on their shirt. WE get round wheels." "What's a TLA?" Alice almost felt relieved when she saw the familiar grin materialize. The rest of the Cheshire Cat soon followed. "A TLA, my dear, is a Three Letter Anachronism. When people start referring to you by your initials, you've overstayed your welcome. If everyone starts calling ME TCC, I'll know it's time to find another job." The caterpillar spoke up from its perch on the toadstool. "Wrong, tuna breath. TLA's are the only thing standing between society and total chaos." Alice turned to face the caterpillar, who responded by blowing a lungful of hookah smoke in her face. "THESE two goons only deal with the dangers of the Queen of Hearts and her soldiers, I have to worry about the domestic situation. So we came up with a solution. There are certain unscrupulous locals who engage in terrible things, terrorism, drug dealing, child molestation, money laundering ... we have to be able to catch them. If they had wheels, they could outrun us. But if we had ACCESS to those wheels when we needed it ... by the way, speaking of drug dealers, we know about that mushroom, and the pills. You might want to think really hard about playing ball with us, the Queen of Hearts is rather fond of cutting off dope addict's heads." "Access to wheels? Does that have anything to do with those ropes hanging off the back of those carts?" "Yup. We pull on that rope, the wheels fall off. And since we may have to stop a LOT of people at one time, we could have a riot, or another Butthole Surfers concert, we figure that we should be able to stop about ten percent of the population at once, a little less in the rural areas ... well, they've gotta be REALLY LONG ROPES ... and there have to be A WHOLE LOT of them ... course, the ones with the ropes we let have octagonal wheels ... " "But can't just anybody pull the rope? You'll have wheels falling off all over the place." "Price you have to pay for a safe society. Besides, we have trusted third parties holding to to the other end." "How will you get people to use it, when they can get regular wheels from the Cards?" "How else? We could pass a law. But it's easier just to threaten all the wheel dealers - put the rope on or we shut you down. Spread the word that only criminals don't use ropes - what are you afraid of? Got something to hide? Eventually we'll have to outlaw the round wheel, of course, but for the time being, some creative social engineering should do the trick." The caterpillar took another long drag on the hookah. "Good shit. Dole was right about this stuff." "But can't people get real wheels for free?" "Sure, we've pulled off enough they're lying around all over the place. But then you need an axle, bearings, steering - most people still just go down and buy the whole package. We get them, we're in - guy up in Seattle makes something like 90% of all carts sold here, you should see the shit we've got on HIM! No problemo. And those idiots at Netscape - we've got them doing a complete background check on anybody who wants a round wheel - come back in five days, and maybe you can have it." "So, Alice, are you learning anything?" Alice liked the Cheshire Cat, but it did have very sharp teeth, and very long claws, and it did have the habit of appearing out of nothing. Alice felt that it should be treated with respect. "Not really, your cattiness. It doesn't make any sense at all!" "It isn't supposed to. You have to look at it the right way. From their perspective, it makes perfect sense." "I'm confused." "Don't worry about it. It gets worse before it gets better. Come on, we're going to a party. Tim May and John Gilmore are throwing a Mad Tea Party." "Are they really mad?" "May's crazy as a loon. You'll like him. Gilmore, he's just still pissed at Shimamura for that stunt in the hot tub ... "

1 0

Re: Opiated file systems
by Deranged Mutant 17 Dec '03

17 Dec '03

On 16 Jul 96 at 19:21, Mark M. wrote: > > A problem with a c'punk-style encrypted fs with source code and wide > > distribution is, of course, that attackers will KNOW that there is a > > duress key. > > I don't see how this would effect the security of such a filesystem. There > is absolutely nothing that an attacker can do to get the real key. An attacker > would just ignore all computers that have duress key capability. 1. Confiscate computer (along with physical drive) with duress-capable encrypted file system; 2. back up the encrypted sectors; 3. reverse-engineer file system driver to figure out how the duress-key works, if there are multiple keys, where data is stored; 4. make sure you've rubber-hosed or subpeoned all passphrases or keys; 4a. if the system destroys data, you've got backups ("Very funny kiddo; now give us the real key...") 4b. even if there are two filesystems, the attacker will want access to both, just to make sure... Duress keys rely on a form of security through obscurity. They make sense for real-time situations where the attacker has to rush in, gain access quickly, and leave real fast (ie, bank robberies). If the attacker has plenty of time, he can prepare for that possibility. Rob --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

3 2

Re: 119_816
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 11:29 AM 7/17/96 GMT, you wrote: > 6-17-96. NYP: > > "11 Officers Are Accused of Failure to pay Taxes. Claims of > Sovereignty and 98 Dependents." > > At least 11 New York City police officers have been > accused of failing to pay any Federal taxes for several > years by declaring they each had 98 dependents and by > insisting that the Government had no right to tax them. > The officers relied on a package of instructions that > described how to avoid paying taxes by declaring that > they were sovereign citizens who did not have to pay > taxes. Anyone know which "package of instructions" they were using, and where they can be obtained online? //cerridwyn//

2 1

Re: Surf-filter lists
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 02:31 PM 7/17/96 -0500, you wrote: ><rant>A Private organization cannot "censor" anything. The fundamental >definition of the word require some agent of the government take action >to censor. To accuse Surf-Watch, net-nanny, AOL, MSU, AT&T, or whatever >of "censorship" accomplishes nothing except to make us look the >fool.</rant> I am not going to go into petty details about the actual definition of censor, and how private organizations do censor, but private citizens have the option of getting their information from an uncensored source, the same as when a government censors. The only difference is the government is allowed to use physical coercion, whereas on the surface corporations are not yet allowed to do so. I will, however, address your argument on a different level. Your view of this issue typifies one of the primary objections I have to many of the arguments amongst libertarians. The problem is NOT JUST GOVERNMENT. It is with any authority that has power over you. When a private entity becomes powerful enough that they have the ability to forcefully exert their influence over you, they are just as bad as Government. Granted, Surf-Watch and so forth haven't yet become that big, but there are some rather large Media companies who have, as well as institutions such as the Church. For example, I think our mainstream news IS censored, and not necessarily by the government, more by corporations intent on keeping us in the mindframe that will make them the most money and prolong and extend their power. I am not saying that a private entity doesn't or shouldn't have the Legal Right to censor, but I am saying that censorship of any form by any entity is a Bad Thing and the public (not the government, mind) should fight it on all fronts. This, in my mind, is the only reason to be dismayed by the decision on the CDA. It was found that the government shouldn't censor on the Internet because there were forms of Corporate censorship available. It would have truely been a great day if the decision had been that the government shouldn't censor on the Internet because censorship is wrong. >I agree that the problem with the "bait-and-switch" filtering of net >materials by these various filtering packages needs to be addressed. If I >want to protect my kids from seeing alt.naughty.pictures, I shoudl still >be able to unfilter political and health speech. The real problem isn't >censorship, it's disclosure by the makers of filtering packages about >what exactly their packages are going to filter for me and my family. That is another problem, not the Real Problem. The Real Problem is that parents are scared to have to explain to children why something they've seen is wrong or bad. They are afraid to teach their children their beliefs and values, so instead would rather just filter everything that conflicts with those beliefs, so that they believe it by default. This is a big problem when those children grow away from their parent's influence though, and creates bigotry and intolerance. (They don't know why they believe what they do, but believe it with fearful vengeance). //cerridwyn//

3 2

Home Made Telephone Voice Changer
by Jerome Tan 17 Dec '03

17 Dec '03

Does anyone know how to make a home-made telephone voice changer?

2 1

Re: Telecom regulations - Reuters coverage
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 23:22 7/17/96, E. ALLEN SMITH wrote: [...] >>FCC Chairman Hundt Sees Tax On Telecom Industry > >> FAJARDO, Puerto Rico - A small tax will probably be imposed on >> telecommunications companies' revenues to subsidize telephone access >> in rural areas and help wire classrooms for the Internet, Federal >> Communications Commission Chairman Reed Hundt told the nation's >> governors. > >[...] > >> But ensuring that residents in sparsely populated areas have access at >> affordable rates and meeting the administration's goal of wiring every >> classroom in the nation for Internet access will require annual >> subsidies of about $10 billion, Hundt said. Ten billion today will of course mean 100 billion tomorrow. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:19 7/16/96, Stig wrote: >Perhaps this has already been voiced on the main list (I get a filtered >helping or two of cypherpunks), but *I'm* surprised that such a generic name >as 'Ecash' was granted trademark status anywhere. > >It's like giving Microsoft a trademark on the term 'Email'... It's nuts! >Was the term ecash not in use before DigiCash showed up on the scene? No that I am aware of. Furthermore, to the best of my knowledge, DigiCash's Ecash is the only ecash that I am aware of. The other "ecashs" lack various properties of cash, as previously explained by Bryce. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

Re: Opiated file systems
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

>a (hidden) drive to your computer using a reasonably surreptious link that >is difficult to trace. Say, an IR optical link, a single bare (unjacketed) >optical fiber, a LAN with hidden nodes, or a similar system. Maybe an I find the idea of the optical fiber very interesting. Is there such a beast currently available? I really don't know anything about fiber, and therefore it would be very difficult for me to construct such a system myself...

1 0

Minneapolis radio on Netscape US Version
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- KCFE has a brief and shallow "Business Report" in the afternoon. Yesterday, one of the items was Netscape's getting permission to make the US version available over the Internet. The bit mentioned a "strengthened method of scrambling data" and also mentioned the Gov't concern that it might be downloaded by terrorist groups. Some good, some bad. - -- Roy M. Silvernail [ ] roy(a)scytale.com PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMe7JdBvikii9febJAQE28wP/eyvR1jfi5oU4sHwsnro6EwbHMr45Qptb wdX+0CDEtLCZv2eXQt+guWy4jIuEMrvd5obFiTGDJECkQ1aecYNiosQgdyJzqNgb 5xm98V7MlWBWGr7P5Ev4uOsC7mXbPvnPZ2BiCtlG5H+jnv4KKv7fr1ZtSngU+8Xl vDCp8MwQN9Q= =ZVdP -----END PGP SIGNATURE-----

1 0

Reverse Engineer
by Jerome Tan 17 Dec '03

17 Dec '03

What do you mean by "reverse engineer?" I have heard this word several times especially in the world of hacking, but... can someone tell me what it really meant?

4 3

Cookies etc...
by EVERHART＠Arisia.GCE.Com 17 Dec '03

17 Dec '03

On VMS, I have an applique which can be used to control completely what can be opened by apps you don't trust. It is perfectly capable of ensuring that nothing you haven't authorized is opened behind your back, mainly by telling you before the open proceeds what is being tried and giving you the ability to prevent it. Forcing use of some other disk (or scratch area) instead is of course also possible, selectively. The problem of things like cookies being left around without explicit permission (or other covert actions) would seem to be that there is no basis for assuming that the app is doing any of this as the agent of the person running the app. With EACF I can completely control this sort of thing; native out-of-the-box VMS has some facilities for partial control as well, which can be adequate. In doing so, they step outside the normal paradigm of assuming the "subject" is the user. I would contend that the "subject" should in fact be considered much more complex than user ID. At minimum, use of a tuple containing userid, program being run, location of user, privileges present, time of day, and identifiers ("group memberships") would seem to be needed for serious efforts, so that "subject" has some relation to what actually happens. The ability to treat certain actions as dynamically altering security or integrity levels is important too. Apps that leave files on your system without telling you are doing covert functions; these should be treated with great suspicion. So where are the critics of this? Does leaving such files constitute unauthorized computer use? I would say so. Anyone see the marshals coming to Netscape or Microsoft to haul anyone off to jail? Leaving files around would seem to deserve INFORMED consent. Do we get it? If your OS isn't as secure as VMS, maybe you want to think about this. ;-) Glenn Everhart(a)gce.com

1 0

Re: An interesting instance of poltical anonymnity, now
by Cerridwyn Llewyellyn 17 Dec '03

17 Dec '03

At 06:56 AM 7/18/96 EDT, you wrote: >Don't feel sorry for Klein - he's a fucking statist who opposes freedom of >speech. If CBS fires the creep for lying, it'll serve him just right. Than they should fire him on that basis (anti-free speech etc), not on the basis of preserving anonymity. //cerridwyn//

1 0

re: Opiated file systems
by EVERHART＠Arisia.GCE.Com 17 Dec '03

17 Dec '03

Hmm... I can set up a cryptodisk on a not necessarily contiguous file on another cryptodisk; the software is free. The second cryptodisk would appear to be just a binary file on the first; would it not be an obscured filesystem? (The drivers have been given away for years public domain for vms, vax or alpha, in source. My old rsx11d driver was published similarly back in 1977 or 78.) In fact, though, the containing file of a cryptodisk does not have to have any specific name or location, and can be hidden away as though it were, say, a sound file or something else among the rest of the system store. Before someone comes demanding your keys, they first have to realize that something might in fact be encrypted. My approach would be to have lots of these obscured cryptodisks for the stuff I wanted private, if I wanted to hide a lot, and have the usual assortment of cleartext stuff of all sorts lying around. The default operation mode forgets the keys automatically once you log off...or even at dismount. If you're stuck with a whole partition being hidden, this is harder to do. When any file of over a few kb can be a separate filestructure when the proper magic is applied, locating the keys can be impossible. glenn

1 0

Netscrape download
by David Lesher 17 Dec '03

17 Dec '03

[From Phil Karn] Netscape's use of a CGI interface to download the US version (128-bit key) of Netscape Navigator raises the possibility that they are "serializing" or "personalizing" each copy they send out, perhaps in response to a DoS request that they do so in order to trace unauthorized redistribution. One way to test this theory without redistributing the actual code is to compare MD5 hashes of the distributions. After two days of unsuccessful attempts at obtaining the code from their overloaded server, I've just successfully downloaded the SunOS, BSDI and Windows 95 versions of Netscape Navigator. Here are the MD5 hashes of the files I received: BSDI version: 4ec4a705e2e4c6560475852fae807c8c SunOS version: e72ff352ca7c619cb31b8f8ef3651b28 Windows 95 version: 8e936813f12a1b3b77ed03d9239ebd5d Anybody care to compare these to the copies they obtain, assuming the logjam on the server breaks sometime soon? Phil -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close...........(v)301 56 LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead........vr vr vr vr.................20915-1433

5 4

Re: #E-CASH: PRODUCT OR SERVICE?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:18 AM 7/17/96, Stig wrote: >Perhaps this has already been voiced on the main list (I get a filtered >helping or two of cypherpunks), but *I'm* surprised that such a generic name >as 'Ecash' was granted trademark status anywhere. > >It's like giving Microsoft a trademark on the term 'Email'... It's nuts! >Was the term ecash not in use before DigiCash showed up on the scene? I agree, but note that Microsoft has gone a long way toward getting the courts to give it full monopoly ownership of the term "windows," or "Windows." I guess that windows-based Symbolics machine I was using in 1984, or those Xerox PARC windows-based D-machine, were violating the standard Microsoft set years later. (I admit that I bought Windows 1.0 about six months before I bought my first Macintosh, but I also note that Windows 1.0 was a ludicrous joke, and did not become a serious product until Windows 3.0 was released in 1990. And Apple had their windows (Windows is a TM of The Microsoft Corporation, all rights reserved) based machine, the Lisa, out in 1982-3.) As for Digicash's claims on "digicash," "ecash," etc., it won't matter much. The whole legal knot (including the patents and claims on the algorithms) makes things more complicated, but I don't worry too much about Digicash claiming people can't use the term "ecash." (If anything, Digicash may have failed to protect the name aggressively enough, and it may have entered the English language as band-aid did.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Alternative Journalism
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:04 PM 7/18/96, enquirer(a)alpha.c2.org wrote: > THE CYPHERPUNK ENQUIRER PRESENTS: > ... >"Don't worry about it. It gets worse before it gets better. Come on, we're >going to a party. Tim May and John Gilmore are throwing a Mad Tea Party." > >"Are they really mad?" > >"May's crazy as a loon. You'll like him. Gilmore, he's just still pissed >at Shimamura for that stunt in the hot tub ... " Ssshhh! Don't let it out that I'm crazy as a loon. BTW, "loon" is now considered to be derogatory slur and has been replaced by the more PC term "differently outlooked." We differently outlooked persons are forbidden by U.S. and California law from owning firearms, a method used increasingly to seize the firearms of those who have ever come into contact with the mental health profession. (Hint: Never, ever, ever, ever have yourself admitted to any kind of psychiatric facility for any reason whatsoever! Never, ever, etc. let a family member have you admitted for treatment, observation, or analysis. You will likely find that your right to own a firearm has evaporated if you do any of these things.) Personally, whenever I fill out the forms to buy a gun, I have no compunctions about lying. (The checking procedures are primitive, fortunately, unless one is so stupid as to answer "Yes" to any of the questions the form asks.) That I am a felon has never stopped me from picking up a gun. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Opiated file systems
by JonWienk＠ix.netcom.com 17 Dec '03

17 Dec '03

You had better make sure that you TEMPEST-shield any such hidden drive. Jonathan Wienke "1935 will go down in history! For the first time a civilized nation has full gun registration! Our streets will be safer, our police more efficient, and the world will follow our lead in the future!" --Adolf Hitler "46. The U.S. government declares a ban on the possession, sale, transportation, and transfer of all non-sporting firearms. ...Consider the following statement: I would fire upon U.S. citizens who refuse or resist confiscation of firearms banned by the U.S. government." --The 29 Palms Combat Arms Survey http://www.ksfo560.com/Personalities/Palms.htm 1935 Germany = 1996 U.S.? Key fingerprint = 30 F9 85 7F D2 75 4B C6 BC 79 87 3D 99 21 50 CB

1 0

Remailers & NYMs
by kpdarby＠juno.com 17 Dec '03

17 Dec '03

Does anyone know some good PGP encrypted remailers, that are secure and pretty fast? How about a few good NYMs? KPD ------------------------------------------------------------------------------------------------------------------- "Injustice anywhere is a threat to justice everywhere" --Rev. Dr. Martin Luther King, Jr. -------------------------------------------------------------------------------------------------------------------

1 0