December 2003 - cypherpunks-legacy

RE: two bogus messages to this list
by Mark M. Lacey 17 Dec '03

17 Dec '03

>Um, not to disagree with you re Intel/Micro$loth, but most UNIX systems >can be brought up in single-user mode and the root password changed by >anyone with physical access to the system. You could end up with even >more trouble than if someone messed with your M$ box. Microsloth has, at the heart of it's system, a call which traps ALL KEYSTROKES and EVENTS. This call exists from Win32s on, and can be placed inside of a DLL which most users would have no idea was loaded. Even under NT, this DLL can be made to remain resident and trapping Keystrokes, events, and window contents. This is (or was?) no problem under X Windows the last time I tried it (not recently), too. In fact, you could monitor the keystrokes of any machine that you had access to remotely, as long as X was running. All it took was a short little C program. So what call is it on NT that you're talking about? Mark M. Lacey <mml(a)halcyon.com> "Speaking for nobody but myself." [Finger mml(a)halcyon.com for my PGP public key.] [If you don't have 'finger', e-mail me for it.]

2 1

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by jim bell 17 Dec '03

17 Dec '03

At 11:57 PM 11/11/96 -0500, Michael Froomkin - U.Miami School of Law wrote: >On Tue, 12 Nov 1996, Doug Renner wrote: > >> article nearly head-on. However is it true that what you are saying is >> that two fundamental premises in the article you refer to as "rabid" are >> incorrect? Namely: >> >> "ARTICLE 1, SECTION 8 OF THE CONSTITUTION STATES THAT CONGRESS SHALL HAVE >> THE POWER TO COIN (CREATE) MONEY AND REGULATE THE VALUE THEREOF. > >The above is a true statement. Note however that "congress" cannot >operate the mint. It must -- **MUST** -- delegate this duty to the >executive branch (or someone outside the legislative branch, cf. Chadha >v. U.S.) if it wants it done. Congress is free to select the type >of agent it wants to do this. Indeed, if Congress chose to license >private mints, that would, IMHO be legal. The point here is that the >states don't have the power to coin money. But, apparently, during the 1800's states (?) and individual banks did indeed print their own currency. The way I see it, a positive statement in the Constitution that the Feds have the power to coin money does not necessarily exclude other people/banks/states/foreign countries from doing likewise. Jim Bell jimbell(a)pacifier.com

3 2

BizWeek speaks on Crypto
by John Fricker 17 Dec '03

17 Dec '03

http://www.businessweek.com/1996/47/b350287.htm --j ----------------------------------- | John Fricker (jfricker(a)vertexgroup.com) | -random notes- | My PGP public key is available by sending mail with subject "send pgp key". | www.Program.com is a good programmer web site. -----------------------------------

3 2

Children & Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 8:26 AM -0800 11/11/96, Hal Finney wrote: > >>I have two kids entering their teens, and I'm sure other list members are >>parents as well. What can we do for our children to help them enter their >>adult lives with better chances to retain privacy? Perfect privacy is very difficult to achieve but with practice, one can learn (and teach one's children) much improved privacy. The following suggestions are not the most radical ones. They represent things that you can do at little cost or risk. Things you can do to teach your children to protect their privacy. 1) Practice privacy yourself. Children learn by example. 2) Don't apply for an SS# for your child. 3) Do apply for a passport for your child (without an SS# of course). Use it as the foundation for an ID pack for your child because passport apps don't contain much useful information on a person and can even be obtained without a birth certificate when the child is an infant. 4) Make up some facially valid SS numbers for future use using a freeware program like ssn.exe. 5) Teach your child to give your accommodation address and voice mail number as his address and phone number whenever asked (just like you do -- you do do that, don't you). 6) In descending order of importance: keep him out of government schools, keep him out of private schools in your country of residence, home school him. (Government schools give the government a direct opening into information about your family. Handing a child over to the government effectively ends any parental rights you might have while he is in school. Additionally, he may never learn to read and write.) 7) Introduce privacy concerns into your ideolect: Whenever you are driving around and see a police car say "There's the Geheime Staatspolizei" and explain who the "Home State Police" were. 8) Play privacy games like: Let's think of things we can say to people who ask us why we're not in school." "Let's think up some neat names to give to people when we don't want them to give them our real name." "Let's practice giving random answers to the question 'What's your name, address, and phone number.'" 9) When driver's license time comes teach them how to get a license in another state or country than their state of residence (and why this is important). 10) Get them a secured credit card in their true name to add to their ID pack. If you like, you can get them one in a nom de guerre as well. Secured credit cards are the best ID money can buy. (Because people think they're ID but they're not). DCF

2 1

Children and Privacy
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:31 AM 11/12/96 -0800, Timothy C. May wrote: >(Side note: Jim McCoy's suggestion that kids can be kept off the >parental-unit's tax returns and thus not get a SS number is fraught with >problems. Many schools--including public schools--use the SS number for >various internal and tracking reasons. Anyone who turns their children over to puiblic schools cannot be very interested in privacy since public schools are the major pathway that governments use to exert social controls on families. In addition to all the paperwork on and tracking of the children, public schools record and track the families. The various state child protective services agencies use information derived from schools to control children and parents. If you are not on welfare and do not have your children in a government school, you will almost never come to the attention of those authorities. >Even if the kid is free of SS >numbers until he's a teenager--at a cost of thousands of dollars a year in >IRS deductions not taken--he'll essentially have to have an SS number in The "fine" for not listing your kids SS# on returns is minor ($50) and is not usually assesed in any case. You can still deduct them. Also those millions of parents who don't file their returns don't face the problem either. >his high school years, for a variety of reasons. Maybe this can be avoided, >but I doubt the reward is worth the hassles.) It is very rare to have an SS# bounced back at you if you just make one up which is valid on its face. This applies to both schools and jobs. DCF

2 1

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Financial Times: Friday, November 8, 1996 Credit Card Group Set for Control of Mondex By Tim Burt MasterCard International, the credit card consortium, has stepped up its bid to take a leading position in the embryonic cash card business by agreeing to acquire a majority stake in Mondex International of the UK. Mondex is a leading developer of "electronic purses" -- plastic cards with memory chips that can be "loaded" with cash and used for small purchases. The deal is expected to give MasterCard 51 per cent of Mondex, set up by National Westminster and Midland of the UK but now jointly owned by 17 banks. Under the agreement, MasterCard would promote the Mondex electronic cash card through banks which carry its franchise. The Mondex system has been piloted in Swindon, Wiltshire, and Hong Kong. It works by storing cash on a microchip card, which can be loaded using automatic telling machines or specially equipped telephones. Cards -- including credit, debit and store cards -- are used for payments worth an estimated #2,000bn a year. MasterCard believes Mondex could give it a greater share of that market, although some industry observers doubt the appetite for such electronic cash cards. The acquisition could exacerbate tensions between MasterCard and Visa, its main rival, in attempts to establish an industry-wide standard for chip cards. Visa has already done pilot tests of its electronic purse at the Atlanta Olympic Games last summer and in Spain, Australia and Argentina. It is understood Mondex would become a free-standing subsidiary of MasterCard, and its existing management is expected to remain. Banking analysts said the deal could signal an admission by MasterCard that trials of its own electronic purse had not proved an unqualified success. Yesterday, however, MasterCard said it would be conducting a full-scale trial of its own smart card in New York next March. Electronic purses are undergoing trials elsewhere in Europe and North America, and some of Mondex's rivals claim it does not conform to the international standards for chip cards developed by companies such as Visa and Europay. Mondex has had a mixed reception among UK customers and retailers but said this week that it had been received enthusiastically in the Far East. In Hong Kong -- where Mondex was launched last month in conjunction with HongkongBank and Hang Seng Bank -- more than 20,000 customers and 400 stores have signed up to join the scheme at the two malls where it is being tested. The card is also being tested in Canada and is expected to be launched in Australia next year. Financial Times: Friday, November 8, 1996 World Tries Out New Electronic Purse Systems By George Graham Ever since inventors figured out how to implant a miniature computer chip in the thickness of a standard payment card, banks have been toying with the possibilities opened up by this extra memory and processing power. Top of most lists is the electronic purse: a way of loading money on to the card so that it can be used as a direct substitute for cash in small transactions such as buying a newspaper or a bus ticket. Mondex is among a host of electronic purses now on trial around the world. Originally piloted in Swindon, England, it is also being tested in Canada and was launched this week in Hong Kong. The arrival of MasterCard, the international payment card consortium, as its prospective majority shareholder will give Mondex the opportunity to move beyond local and national trials to, potentially, worldwide use. MasterCard had run trials of its own electronic purse in Canberra, though reports that these proved unsatisfactory would appear to be borne out by its imminent new link with Mondex. But Mondex is not alone in the electronic purse contest. Visa, MasterCard's great rival, piloted its Visa Cash electronic purse at the Atlanta Olympics, and in such countries as Spain, Australia, and Argentina. It will be launching a trial in the UK next year. Europay, despite being MasterCard's partner in Europe, has already launched its own purse called the Clip. Other national electronic purses range from the disposable Danmont card in Denmark -- sold for face value and thrown away when used up, like a phone card -- to the reloadable Quick chip in Austria, which is integrated into the customer's regular cash card. The most heavily used electronic purse so far, and arguably the only one that can yet claim to be a commercial success beyond a closed circuit such as a university, is the PMB card in Portugal. It has 170,000 cards in active use, and an expected 50,000 point of sale terminals installed by the end of this year. But no winner has yet emerged. "The reason for all of these pilots is that no one has proven the business case. I'll be really interested to see if anyone makes money out of this," Mr Eugene Lockhart, president of MasterCard International, said earlier this year. Banks generally like the idea of an electronic purse, which cuts out the risk they run on a credit card payment of not getting paid. It is also cheaper to operate than a debit card: because the money is already loaded on the card, there is no need for each transaction to be authorised by a central computer. 'The reason for all these pilots is that no one has proven the business case' weighs particularly with late night shops and with bus and taxi drivers who do not want to have to carry change around with them. But they do not want to install new card terminals until they are sure what the standard will be. The gains are much less obvious for consumers. To compete with cash, an electronic purse has to be not only free but very widely accepted. That threshold has so far been crossed usually in very limited geographical areas, such as the Sydney suburb where an electronic purse accepted at petrol stations, shops and fast food outlets has been successfully married with a bus pass. Mondex's technological features make it a closer replica of cash than most competitors. Mondex money moves anonymously from one person to the next, and can even be transferred to another individual's Mondex card, instead of only to a shop with a special terminal. In most other systems each transaction ends up being processed through a central computer. That leaves more of an audit trail -- a plus point with police. But Mondex's biggest shortcoming has been that it stood alone, raising questions on whether it would gain acceptance beyond the confines of Swindon. Rivals say it does not conform technically to the international standards for chip cards developed by Visa, MasterCard and Europay, although Mondex officials have demonstrated its cards will work in standard terminals. Mondex took a big step towards wider acceptance this summer, when National Westminster Bank, its creator, sold control to a broad international consortium of banks. With MasterCard expected to take control, the Mondex card has will be crossing another threshold toward worldwide acceptance.

3 2

Make.digital.money.fast
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Rabid Wombat <wombat(a)mcfeely.bsfs.org> writes: > On Sun, 10 Nov 1996, Clay Olbon II wrote: > > > Pyramid schemes could be a growth market in a crypto-anarchic world. It is > > yet another market such as gambling, or the lottery, that could be conducte > > with anonymity. And it appears to be much more widespread on the internet > > How is it like gambling? If I get a pyramid letter instructing me to send > money to five people on the list, add my name to the bottom, send to 5 > people, or whatever, there's nothing stopping me from removing all the > names, adding my name and those of four friends, and passing the letter > along. With an anonymous system, I could easily be all five people, > without even the bother of getting five different post office boxes. > > There's no gambling involved; only blantant stupidity. I agree - MMF is stupid. Gambling in Las Vegas is stupid. Buying lottery tickets is stupid (except in rare cases when the jackpot is very large.) The way most investors play the market is stupid. It's unbelieavble how many billions of dollars move around in non-productive activities which can only be described as stupid. Coming back to MMF, I recall the famous quote from Dave Rhoad's original post which said approximately: "The success of this project depends on the honest and integrity of each participant." (By the way, DR is a real person, living in California.) My small-scale survey indicates that almost all the people who post MMF try to "cheat" in a minor way by not sending the $5 to the 5 people upstream of them. I think this casn be prevented cryptograhicaly if the MMF post includes digitally signed assertions from the 5 upstream people certifying that they've received their $ from this particular poster. A slightly more sophisticated form of "cheating" is described by RW above: the poster generated 5 nyms, generated 5 receipts from these nyms, and effectively starts a new pyramid. A partial response to that would be to require each new nym to be certified by its immediate upstream neighbor: sort of like the web of trust, rooted in Dave Rhoades himself. But that too can be circumvented by a single person "spamming" the pyramid by multiple nyms all belonging to him. There's no good way to ascertain that mutliple nyms don't belong to the same person. > --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

2 1

anon remailer
by luc pac 17 Dec '03

17 Dec '03

hi -- i'm having a discussion with some people, trying to persuade them to set up an anonymous remailer on an italian server. i need a few technical data about how much computing resources does a remailer take, how much ram, cpu time, average traffic and so. since i can't deal with the huge (though interesting) traffic carried by this list, i'm not going to subscribe. so please if you can help, contact me privately at my address. i feel that if i succeed, a new remailer would be of some help for the entire cypherpunk community worldwide. thanks. --- Key fngrprnt (since 1993) = 52 DB 96 92 FA 1D CE 71 0D 63 96 E5 9A 9B 07 0A http://www.geocities.com/Hollywood/3879

2 1

Re: Kriegsman Furs Website hacked...
by Steve Edwards 17 Dec '03

17 Dec '03

These hacks can be amusing, regardless of your political orientation... But, to bring the thread onto topic, how are these hacks perpetrated and how can a responsible webmaster reduce the exposure? On Wed, 13 Nov 1996, Eraser wrote: > > Hey all.. > > Another commercial hack. > > http://www.kriegsman.com/ which is still live at this posting. not any more. > if it goes down, or is fixed, a mirror exists on > http://www.skeeve.net/kriegsman/ > > nicely done... > > one for the furry creatures. > > ------------------------------------------------------------------- > | Skeeve Stevens - MyInternet personal.url: http://www.skeeve.net/ | > | email://skeeve@skeeve.net/ work.url: http://www.myinternet.net/ | > | phone://612.9869.3334/ mobile://0414.SKEEVE/ [753-383] | > ------------------------------------------------------------------- > Steve Edwards sedwards(a)cts.com

1 0

Taxation Thought Experiment
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Another thought experiment, comments welcomed: o TAXES THOUGHT EXPERIMENT 1) I generate $100 of productivity for my company 2) Company is taxed %30, $70 left 3) Company pay shareholders and costs, $30 is left 4) Company pays me 5) I pay 40% in taxes, so $18 left 6) With $18 I can buy a $16.82 object (%07 sales tax). Results: 1) I see $16.82 realization from $100 productivity increase. * Govt. gets $49.26 of my productivity, or nearly 3 times the amount I get. _______________________ Regards, Our greatest glory is not in never failing, but in rising up every time we fail. -Ralph Waldo Emerson Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

6 9

(fwd) NSA And Vince Foster?
by vznuri＠netcom.com 17 Dec '03

17 Dec '03

gadzooks, has anyone seen this yet? atom bomb type stuff here. I guess we won't hear Perry and others rant about Vince Foster material on the list any more, eh? From: softwar(a)us.net (Charles R. Smith) Newsgroups: talk.politics.crypto Subject: NSA And Vince Foster? Date: Mon, 11 Nov 1996 00:36:45 GMT ======== ubject: NSA FOSTER DOCS: FOSTER INVOLVED IN NSA COMPUTER ESPIONAGE ISSUES From: "John Q. Public" <jqp(a)globaldialog.com> Date: Sun, 10 Nov 1996 13:13:29 -0600 not to be used for commercial purposes from the Nov. 11, 1996 issue of The Washington Weekly posted with permission NSA RELEASES DECLASSIFIED FOSTER DOCUMENTS The National Security Agency has now released the first batch of documents in response to a Washington Weekly FOIA request filed in August of 1995. The documents, pertaining to the late Vincent W. Foster and his work with the NSA and with Systematics Inc. have many passages and names blacked out and some documents bear "Confidential" or "Secret" classifications. The first batch of documents contain 77 pages. After conversations with NSA staff, we understand that an additional estimated 600 to 700 pages of documents will be released pending review by other intelligence agencies. The Washington Weekly eventually will make all documents available on its web site. VINCE FOSTER INVOLVED IN NSA COMPUTER ESPIONAGE ISSUES One morning in May of 1993, a mini bus left the National Security Agency at Ft. George G. Meade, Maryland. It drove directly to the White House to pick up Bernard Nussbaum and Vincent W. Foster. From there, the party proceeded to the Justice Department to pick up Webster Hubbell and John Rogovin. At the Supreme Court, Justice John Paul Stevens joined the party. They all returned to the NSA for a secret roundtable discussion with top NSA officials on Codebreaking and Telecommunications. On the agenda were items such as: * What Has Happened to SIGINT * How We Handle Crypt[ology] Problems * Problems We Face In The Future * Rule of Law Only this broad outline of the meeting is revealed in a recently declassified NSA document. But it makes clear that one of Vince Foster's responsibilities at the White House was cryptology and intelligence gathering. As such, he was privy to top secrets. That would explain the presence of two NSA binders deposited by Vince Foster in a White House safe. So why did the White House deny that Foster was working on NSA documents? Last May, White House spokesman Mark Fabiani told the Washington Times that "There were no National Security Agency documents that he was working on that were in his possession." Why did the White House try to conceal Foster's NSA ties? Why did Fabiani find it necessary to contradict the sworn statement of Foster's secretary Deborah Gorham, who said that "There were two one-inch ring binders that were from the National Security Agency"? Published in the Nov. 11, 1996 Issue of The Washington Weekly Copyright (c) 1996 The Washington Weekly (http://www.federal.com) -- ~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^~^ \ / ~/ |\| | | |> | : : : : : : Vladimir Z. Nuri : : : : <vznuri(a)netcom.com> \/ ./_.| | \_/ |\ | : : : : : : ftp://ftp.netcom.com/pub/vz/vznuri/home.html

2 1

UNSUBCRIBE CENSORSHIP
by Sheldon Andrews 17 Dec '03

17 Dec '03

UNSUBCRIBE CENSORSHIP

4 3

Re: Child Protective Services and Political Views
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:26 AM 11/12/96 -0800, Timothy C. May wrote: >Who knows, it may even be a >technical crime ("contributing to the delinquency of a minor"?) to even >discuss basic libertarian ideas with a minor. And as I said, Child >Protective Services could quite possibly seize a child whose parents were >sufficiently vocal about their beliefs.) One shouldn't be vocal to public employees in any case. Avoid them. If you are going to be vocal use a non government forum. Separate your personal life from your political life. It's not too hard to break most of the pointers between your physical presence and your ideological presence. Even though an investigator could find where I sleep at night, they would have to actually expend the resources. My neighbors and the local cops are unlikely to make the connection because they and I move in very different circles and I minimize my database presence. In any case, those stupid enough to turn their children over to the government deserve whatever happens to them. Even if CPS never gets involved, the damage they do to their kids may be irreversible. My parents weren't that stupid in 1956 when I started school and that was at a much lower level of knowledge of the effects of government schools. There is no excuse today when we can see the damage all around us. As I said earlier today, you can reduce your risk of CPS oppression to nil by keeping your kids out of public schools and licensed day care. DCF

2 1

Mac S/WAN (encrypted ip) mailing list..
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: mac-crypto(a)thumper.vmeng.com Reply-To: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> Mime-Version: 1.0 Precedence: Bulk Date: Tue, 12 Nov 1996 12:13:16 -0800 From: Vinnie Moscaritolo <vinnie(a)webstuff.apple.com> To: Multiple recipients of <mac-crypto(a)thumper.vmeng.com> Subject: Mac S/WAN (encrypted ip) mailing list.. hi; as promised I have create a mailing list that will be focused on developing secure networking technology on the Macintosh. (ipsec,SKIP & OT etc) there are aleady a variety of ways todo this sucessfully with opentransport that involve createing a STREAMS modules to do ipsec. I will refer you to http://www.cygnus.com/~gnu/swan.html for more info about a great project that is underway that could really use a Mac implementation. for now , it will be an open list, you can subscribe to it by Send mail to mailto:majordomo@thumper.vmeng.com containing the single text line subscribe mac-swan Expect to receive confirmation when the majordomo daemon handles on your request. to contibrute to this list send email to mailto:mac-swan@thumper.vmeng.com Vinnie Moscaritolo ------------------ "friends come and friends go..but enemies accumulate." http://www.vmeng.com/vinnie/ Fingerprint: 4FA3298150E404F2782501876EA2146A --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

2 1

Supreme Court rules against FCC, MCI, AT&T
by Pzbowen＠aol.com 17 Dec '03

17 Dec '03

Supreme Court Rejects FCC Phone Rule Request WASHINGTON (Reuter) - The Supreme Court Tuesday declined a request by federal regulators and long-distance phone companies to reactivate landmark rules intended to pry open the nation's local phone monopolies to competition. The denial means key terms and conditions for deregulating the $100 billion local phone market will for now depend on the decisions of state regulators in the 50 states -- instead of on uniform rules issued by the Federal Communications Commission. It is a defeat for the FCC and long-distance giants AT&T Corp. and MCI Communications Corp. They sought to reinstate the FCC's "interconnection" order after a U.S. appeals court suspended key provisions pending a challenge to the rules, and Supreme Court Justice Thomas declined to restore them. It is a victory for the Baby Bell companies, GTE Corp., other local carriers and state regulators who are seeking to overturn the regulations in the St. Louis-based appeals court. They argue the FCC unfairly snatched away from the states the power to issue policies governing pricing and other matters. The rules spell out how long-distance companies, cable-TV operators, utilities and others wanting to get into the local phone business can plug into the local network under the new telecommunications law. "For all practical purposes the state have complete control over the prices new entrants will pay to share the existing telephone networks during the critical period when competition is supposed to begin in local telephone markets," FCC Chairman Reed Hundt said after the high court's denial. The appeals court temporarily suspended the rules last month, saying the FCC probably erred when it drafted them. On Oct. 31, Justice Thomas declined a request by the FCC and its long-distance allies to lift the lower court's "stay." They separately asked Justices Ruth Bader Ginsberg and John Paul Stevens to reconsider the request. The justices referred the matter to the entire court. "The stay prevents grossly arbitrary and distored pricing rules from going into effect and ruining the whole process," said GTE General Counsel William Barr. "It does not delay the timetable set forth in the Telecommunications Act of 1996 for the introduction of competition, but instead allows for a more level playing field." Oral arguments in the St. Louis case are set for January. FCC Chairman Hundt conceded Friday it was unlikely the appeals court would decide in favor of the FCC. And he doubts the rules will be put into effect for at least 1 1/2 years, if ever, while they are fought over in the courts. Hundt was encouraged, however, by the actions of state regulators arbitrating interconnection agreements between the Bells and their long-distance rivals. He said key provisions to the arbitration decisions issued so far are similar to the suspended FCC rules. Iowa, Texas, Maryland, Virginia and Pennsylvania have been among the states that have issued decisions that will lay the groundwork for arbitrated agreements between the Bells and AT&T, MCI and No. 3 long-distance company Sprint Corp. "There hasn't been any evidence that the states are going off and doing any wild and crazy stuff," said analyst Robert Mayer of Deloitte & Touche Consulting Group.

1 0

Re: New Linux-IPSEC mailing list for the S/WAN project
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

paul(a)fatmans.demon.co.uk writes: > > > Yeah, right. Be sure to ask Paul Bradley to implement his brute force > > attack on one-time pads. :-) > > I retracted this and as I explained the post was in error as I was > talking about stream ciphers when I should have been taking about > OTPs. Please read a little deeper into my post asshole. I've got more interesting things to do than read "deeper" into your ignorant drivel. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 2

linux ipsec question
by Alex Strasheim 17 Dec '03

17 Dec '03

I've been off the list for quite awhile, so if this has been beat to death already, I apologize. Is there any kind of consensus of opinion on the linux-ipsec project? What do people outside of the project think about it? It seems like a very good thing to me, but I don't know much about s/wan, so my opinion isn't worth much. I'm a little curious as to how this project fits in with other secure IP efforts. Will the linux-ipsec software interoperate with other packages? How does it relate to IPv6? Policymaker? Basically, I'm not very clear about the significance of this project. Is it going to be a good package that I could use to encrypt traffic between offices in NY and LA, or is it going to be a package that will let me communicate securely with the net at large, using a well accepted standard? Finally, what do you all think about the basic way this is set up? I mean, does it make sense to use a linux box with two net cards to protect a lan? Or should secip software be built into individual devices, like it is in IPv6? Is this a standard that might get picked up by someone like cisco? Etc. Thanks... -- Alex Strasheim, alex(a)proust.suba.com

2 1

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Rick Smith 17 Dec '03

17 Dec '03

Hal Finney wrote: : Are there other measures which parents could take while their children are : young to get them off to a good start, privacy-wise? I doubt it's ever too late to start. Sure, it seems as if old, crufty bits sit on the 'Net just waiting to embarass us ("oh, yeah, maybe I *did* post to alt.naughty.stuff 'way back then...") but there *is* such a thing as bit rot and perhaps it really is our friend after all. The first question, always, when evaluating security measures is to ask "What are you trying to protect?" This gets really weird when you don't know what the threats really are, which is true of this situation. I don't really see "privacy" itself as something you can pursue as an absolute objective. I think Black Unicorn's tale illustrates this well -- he doesn't try for non-existence, instead he describes a series of well reasoned and consistent steps. Basically, though, it has to be a personal choice. So it's hard to judge perfectly for another, even your own kids. IMHO you have to find a reasonable balance for your kids. The problem is that you don't want your kids to disappear -- there are times they will WANT their records found. The problem is to make verification easy when they're directly involved and difficult otherwise. The basic and obvious rule to most of us is to control the SSN and don't give out a correct one except when absolutely necessary. One of the banks in Minneapolis refuses to pay interest at all if you don't have your SSN on file. I toyed with the idea of manipulating birthdates, but it wasn't clear what the benefit was. Also, it required my wife's help, and I'll defer to Tim May's recent discussion of his'n'her anarchy if you wonder why this might be an impediment. If the kids know their "real" birthdate they'll *always* report it to their teachers. And if it's consistently incorrect in school records, then what does it mean for it to be different? When faced with peculiar situations I try to choose a disclosure that meets whatever the immediate requirements are but doesn't make it easy to automatically match up records. Often the best you can do is reduce certainty and increase the likelihood of multiple matches with other records. It doesn't hurt if you last name is Smith here in the U.S.A. Rick. smith(a)sctc.com

3 2

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear Sir, >>problem avoiding the photo (and thumbprint) on the license. You mean you guys have to have a thumbprint on your drivers licences as well? That is a real entry into the system! Appearances can be changed, but fingerprint changing isn't quite as easy for the average Joe. But who was it who said: "How can you convince people of the need for privacy when they are willing to leave detailed records of their shopping habits for 1/10000th of a flight to somewhere"? I think it may have been Mr.Schneier in his article on why Cryptography is difficult, I can't remember, but it definitely has the ring of truth to it. Yours Sincerely, Benjamin Grosman

1 0

[URGENT] Accounts payable
by nobody＠replay.com 17 Dec '03

17 Dec '03

What a joy to make a public mockery of Tim Mayonnaise!

1 0

RE: So how does the crypto crackdown go?
by nobody＠replay.com 17 Dec '03

17 Dec '03

> >One question is whether they would also try to make it illegal to use >(rather than to distribute) crypto software. On the one hand, if they >don't do that, they have a problem with all the installed base of code. >But the legalities of stopping people from encrypting code on their own >computers, or writing crypto programs for personal use, seem a lot more >questionable to me, and I don't know how much precedent there would be >for that kind of restriction. Not at all questionable. A ban on crypto would follow the current trend in regulating technology. Consider the case of Bernie S. who is in jail for possessing electronic parts that could be used for telco fraud. Any government action towards banning crypto will include possession of crypto as a crime. The "cat's out of the bag" argument is ineffective as well as the governments just don't care. They'll just say in effect: "It's illegal. Destroy it if you got it." Now it's doubtful if enforcement would make unprovoked searches and arrest people solely for possession of crypto. And it is also unlikely that DA's (except perhaps the most bored) would follow up on "My neighbor is using crypto" tips. But it is not uncommon for prosecutors to heap additional charges on criminals (alleged) such as the case in robbery: 1 count robbery, 1 count using a gun in robbery. or perhaps 1 count tax evasion, 1 count using crypto to commit tax evasion. While the former charge may end up being unproven the later often sticks. > >So as I see it the main target of the ban would be distributors of >software rather than end users. This would be in line with the often >stated goal of the law enforcement people that their main concern is with >crypto that is built in, transparent, and trivial to use, rather than >hacker's crypto. Hmmm. Hackers built the ubiquitous CryptoFS for Linux, no? And the nascent S/WAN too. I don't see a distinction between popular and subculture crypto. The two invariably mix. A program may have it's origins in the subculture but it will often meet the needs of the popular culture as well and be adopted, accepted, and so on. Consider PGP and such add-ons as Brainless-PGP, WinPGP, and the various auto PGP tools. It seems to me that banning distribution would just be too generous. What is distribution? Are time share accounts distribution? I created it but many can use it but the actual bits (well are there actual bits?) never left my single computer. But the nature of "distribution" is to move something from one person to another. Now nothing really moved but a few electrons. But multiple people did use it. Book 'em. Distribution is an archaic term here and the regulations will involve controlling what software may be run on personal computers. The stated goal is a posture designed to sound reasonable. Only time will tell if the actual goal is the regulation of computer uses as I suspect. The security establishment fears crypto. Fears loss of control. I suspect that with Clinton back in the White House (was there a choice?) we will enter a period where the Clipper chip seemed like a good idea. In comparison. Unless some fundamental changes occur to the Security, Intelligence and Law Enforcement agencies (a new acronym? SILE? Pronounced with a long E of course <g>) we will see more business as usual and some completely draconian steps taken against strong encryption. The only recourse is to take an active role now. We must go on the offensive and : 1) Deploy S/WAN 2) Write more strong ubiquitous crypto 3) Attack the SILE agencies directly by challenging their purpose, gutting their budgets, exposing their falacies (umm is that almost freudian or what), flooding international communications with strong crypto messages (content need not apply), and of course ridiculing their every effort. 4) Finding allies in the legal community and educating fence sitters, critical judges, legislators, and so on. Now is the time to act. diGriz

1 0

Remailer Abuse Solutions
by ph＠netcom.com 17 Dec '03

17 Dec '03

What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com

1 0

Federal Reserve Bank is ILLEGAL?
by Doug Renner 17 Dec '03

17 Dec '03

http://feustel.mixi.net/GOV/DEPTS/fedres.html Most list members would be very interested in the above link.

4 6

Re: WebTV a "munition"
by Sean Roach 17 Dec '03

17 Dec '03

At 11:56 AM 11/11/96 -0800, Pablo Calamera wrote: ... >The WebTV Network is currently using a 128 bit encryption system that >gives our U.S. subscribers the most sophisticated security protection of >any online service today. It is our intent to offer our customers the most >secure environment for transactions and transmission with their WebTV >Network service. Our units, sold by Sony and Philips, include a sticker >that states that the product is not to be exported outside of the United >States. > >However, the government restriction does not prevent us from exporting our >product outside of the United States. WebTV Networks has always intended to >announce its expansion plans in early 1997, providing global communication >using either 40 bits, now authorized by the government, or 56 bits which >Bill Clinton recently endorsed. ... This may prove my ignorance, but I thought that the WebTV systems were going to use a propiatory service. I am assuming that this is true in this post. If the WebTV product is using a propietory ISP for its operation, I assume that WebTV sets sold outside of the United States will not be dialing up the same phone number. As the chip could easily communicate with the ISP, and the ISP communicate, perhaps through standard credit validation systems, with the merchants, why does the international version even need U.S. developed encryption. The international version could most likely be fitted with the locally available strong encryption. Since the WebTV ISP will probably have a virtually private wide area network, the "foreign" encryption could be replaced with a more standard type inside of the U.S., at the main offices. Why give the U.S. government the ability to look at the transaction information of non-U.S. citizens, off of U.S. soil. If, however, the WebTV system does not have the ability to maintain contact with its over-seas offices, this could be unfeasable. Granted, this idea would mean that some computer would have access to all of the relevant data,for the purpose of "trading" crypto, but I would rather put my trust in a company, which I could easily quit dealing with, than the U.S. government, which might easily institute an international sales tax system. Can PGP be compiled to an EEPROM? If so, PGP is well distributed and might easily be accepted for online transactions, also, Mr. Zimmerman might be willing to agree to a bulk liscense sale for the implemention of this idea. Just make sure that the chip is loaded outside of U.S. borders.

1 0

Re: two bogus messages to this list
by Sean Roach 17 Dec '03

17 Dec '03

At 11:08 PM 11/11/96 -0500, Ted Garret wrote: ... >Microsloth has, at the heart of it's system, a call which traps ALL >KEYSTROKES and EVENTS. This call exists from Win32s on, and can be >placed inside of a DLL which most users would have no idea was loaded. >Even under NT, this DLL can be made to remain resident and trapping >Keystrokes, events, and window contents. > >Does this just BEG to be exploited? ... I use Windows 3.11. Look at the Recorder in it. Its designed to create Macros. It can be set up, by anyone, to capture passwords in Eudora. I've tried it in a controled environment (my own machine), it works. The only defense is if the person were to have h[is,er] password left in Eudora, which is a serious mistake, or if that person Alt,Tabs through all of the resident programs to make sure it wasn't running. Half of the people I've told this to didn't even know that you could switch between windows programs, (one didn't even know that more than one windows program could be active at the same time). In an open lab environment, where the machines are left on, and the common user can't navigate outside of windows, and then only with the mouse, this would be a serious threat to privacy.

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 08:26 AM 11/11/96 -0800, Hal Finney wrote: ... >I have two kids entering their teens, and I'm sure other list members are >parents as well. What can we do for our children to help them enter their >adult lives with better chances to retain privacy? Unicorn mentions keeping >them absent from school on picture day, although I'm not sure how much this >helps. I suppose it makes it harder for an investigator to find out what >they look(ed) like. Then when they get old enough to drive you have a new >problem avoiding the photo (and thumbprint) on the license. ... As far as the drivers linscense goes, there are religions that do not allow its members to be photographed, and the government honers this,(at least the Tag Offices do). I don't know the name of the religion but I believe it is a Christian one. Convert once every four years to get your drivers liscense, and convert back within the week. No photograph on that little piece of plastic. P.S. In Oklahoma, there is no thumbprint on the current liscense. P.P.S You can always send your child to school with a note saying that you do not want your child in the class picture, I know of someone who did that, (on a side-note, we always wondered why.)

3 2

A really short one time pad.
by Sean Roach 17 Dec '03

17 Dec '03

Actually, here are ten. 2^.5 3^.5 2^(1/3) 5^.5 5^(1/3) 7^.5 11^.5 13^.5 17^.5 Pi For that patter the nth root of any prime number. A lifetime of "pads" could be distributed in one trip. Of course this still means that you have to make the trip, and write down all of the above with a referring codeword or number. Cheap, I know. Wonder if this type of "one time pad" is as foolproof as truly randomly generated ones.

3 2

Re: Small question about the list
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

>I would be realy happy if someone could tell me the adress to remove my name >from the distribution list. >Could anyone send me the procedure on how to remove my name of the list ? The two usual ways to do this on the internet are 1) Use the same address you used to join the list (you _did_ save it?) 2) somethinglist(a)somewhere.com is administered by somethinglist-request(a)somewhere.com (though this is often a frontend for some mailbot like majordomo or listserv @somewhere.com , and may just send you instructions for finding the real mailbot.) # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk

1 0

Code of Practice for the Internet
by Benjamin Grosman 17 Dec '03

17 Dec '03

Dear All, Found something I thought you all might find interesting..... www.intiaa.asn.au/codeintro.htm A body in Australia is attempting to introduce a "Code of Practice" in Australia Yours Sincerely, Benjamin Grosman

1 0

Re: Taxation Thought Experiment
by azur＠netcom.com 17 Dec '03

17 Dec '03

>The crypto-relevance is via crypto anarchy: we need to undermine the tax >system enough that _everyone_, not just us, loses faith in it. (There could >be a "straw that broke the camel's back" effect, if people lose confidence >in the system. Even if most people are _not_ using anonymous digital cash >to hide income, if _enough_ are (and this "enough" could be a visible >minority, visible through recounts of their deeds), then confidence could >be lost. As in Italy and other such places, where compliance rates on taxes >are very low.) > >--Tim May > I've posed similar questions to friends and aquaintences. The working-class stiffs (who can't easily hide from the IRS) feel taxes are an unwelcome but necessary burden in order to provide the blanket of government protection they feel exists. They resent and oppose widespread tax fraud. Self-employed tend to be more open to 'alternative' income structuring. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Steve Schear | Internet: azur(a)netcom.com Lamarr Labs | Voice: 1-702-658-2654 7075 West Gowan Road | Fax: 1-702-658-2673 Suite 2148 | Las Vegas, NV 89129 | --------------------------------------------------------------------- Internet and Wireless Development Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne, Libertarian, for President. http://www.harrybrowne96.org

1 0

Re: Secrecy: My life as a nym. (Was: nym blown?)
by Sean Roach 17 Dec '03

17 Dec '03

At 10:14 PM 11/11/96 -0600, Igor Chudov wrote: >This is an interesting topic. I apologize if my questions are too trivial, >but here they are: > > 1) Can a person without an SSN have a credit record? Some > may say that a credit record is a bad thing to have, > but I am still interested in a possibility. > 2) Will private lenders (such as credit card issuers or > mortgage companies) agree to extend credit to a person > without an SSN or to someone who refuses to give out his SSN? > 3) Will the state issue a driver's license to someone who does not > have/does not wish to give out their SSN? > 4) Will states' police (where applicable) approve purchases of > firearms if purchasers do not state their ssn (misstating it > may be a crime) on an application? > 5) Employers are required to pay certain taxes and therefore > they, in my understanding, need to know their employees SSNs. > How can people get around that (unless they do not need to work)? > 6) Can someone without an SSN obtain various kinds of insurance? > >It is my understanding that the law does not regulate use of social >security numbers between private parties. Businesses are free to refuse >to do business with someone who does not present them an SSN. In real >life, how inconvenient is life of a privacy-concerned individual? > >Say, John Anonymous is a young 15 years old who anticipates to become an >engineer and have a middle class life. He wants to get married, have >children, drive a car, obtain insurance, work at some big company, >travel around the world, invest in mutual funds or buy stocks, and so >on. Reliance on government help is not important to him, so he would not >apply for an SSN solely to get Social Security, welfare and such. > >His parents are cypherpunks and did not obtain an SSN for John. How much >effort would it cost him to live a life outlined above? He couldn't, at least not in Oklahoma. In Oklahoma, students in public schools are now required to have SSN's. This may not apply to private schools, but I imagine that it does, at least to some degree. Having a high school education is certainly necessary to gain the Masters necessary to be an engineer. However, getting a drivers liscense should be easy. My sisters drivers liscense number is one that was randomly generated, all because she did not know her SSN off of the top of her head. My drivers liscense number is the same as my SSN, all because I know my state mandated serial number. For all practical purposes, I am Roach, Sean 447-xx-xxxx. Note, 447 refers to the state of my birth. My sisters record is at least a little more convoluted.

2 1

RE: Taxation Thought Experiment
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May The crypto-relevance is via crypto anarchy: we need to undermine the tax system enough that _everyone_, not just us, loses faith in it. ......................................................... Having more of the facts about how taxation works - how it affects an individual in certain examples, providing the kind of calculating which both Tim and Joseph have gone through, should do it (bring about the loss of faith). And Ross Perot would be the right person to communicate it, with his charts and his detailed explanations (so would Harry Browne, but he doesn't yet have the cash for such advertising). Ross doesn't want to do away with taxes completely, but he is at least interested in their making sense. .. Blanc

1 0

Down-Under Bounce Attack halted
by David Lesher / hated by RBOC's in 5 states 17 Dec '03

17 Dec '03

The postmaster of that AU site running the bounce attack assures me he has been able to vanquish the daemon running the box in question; despite the fact he did not even know it was there ;-} [Don't ask..] -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

RE: Taxation Thought Experiment
by Blanc Weber 17 Dec '03

17 Dec '03

From: azur(a)netcom.com I've posed similar questions to friends and aquaintences. The working-class stiffs (who can't easily hide from the IRS) feel taxes are an unwelcome but necessary burden in order to provide the blanket of government protection they feel exists. They resent and oppose widespread tax fraud. Self-employed tend to be more open to 'alternative' income structuring. ..................................................... Just before the elections I heard on NPR and read in an article in a local newspaper, some people's stories of how they converted from Democrat to Republican. Most of them said that athough they were originally idealistic about all the good things which government can do, when they started their own businesses they were suddenly confronted with all the excruciating regulation and rigmarole which any business must deal with on a daily basis while just trying to get some work accomplished. Very quickly they realized the consequences of a lot of the government proposals which they had heretofore supported. So I realized that experience is not only the best teacher, but it is also the best argument against bad cases of faith in government-run economies. Sometimes a person can't understand what the problem is unless they've "been there", and once a person becomes self-employed, starts a business, or becomes an investor in an enterprise, the light dawns and they Understand. I'm happy when I read that more and more of those people who are "down-sized" or layed off are turning to self-employment and starting their own companies, because this means that more people will acquire through direct experience (that is, confrontation with govmt agencies) the details of real-life economics which were left out of high school & college. And this means more economics&tax-savvy voters in existence for govmt candidates to face in the elections. .. Blanc

1 0

December Cypherpunks Meeting at PGP Inc.
by Dave Del Torto 17 Dec '03

17 Dec '03

Cypherpunks December Meeting Notice (1 of 3) I'm pleased to announce that PGP Inc will be hosting December's Cypherpunks physical meeting at our offices in Redwood Shores (mid-peninsula). We really hope to see you here physically, both to present existing/new topics and projects and also to briefly check out what we're doing. If you want to mark your calendars in advance (there'll be two more reminders), here's the basic info: HOST: Pretty Good Privacy, Inc. (Dave Del Torto) TIME: 14 December 96 (Saturday) 12 Noon - 6 PM LOCATION: Pretty Good Privacy, Inc. 555 Twin Dolphin Drive Suite 570 Redwood Shores CA 94065 USA (directions will follow in the next reminder) Please email me your presentation ideas as soon as possible so I can draw up the agenda for everyone (including some idea of how much time you think you'll need). We'll provide a fast TCP/IP hookup, a workstation (Win95/Mac/UNIX) as needed, an RGB projection device, an overhead projector for transparencies/etc, and any other reasonable equipment you might need (assuming you warn us at least a week in advance). Bagels/Chips will be provided by us, but bring your own beverages. We will pause for a "keysigning moment" near the end of the meeting. If anyone has any early questions, please contact me via email, telephone or even PGPfone (by appointment). My key is available via the URL in the header above. dave ________________________________________________________________________ Dave Del Torto +1.415.65432.31 tel Manager, Strategic Technical Evangelism +1.415.631.0599 fax Pretty Good Privacy, Inc. http://www.pgp.com web

1 0

Re: Child Protective Services and Political Views
by Dale Thorn 17 Dec '03

17 Dec '03

Duncan Frissell wrote: > At 11:26 AM 11/12/96 -0800, Timothy C. May wrote: > >Who knows, it may even be a > >technical crime ("contributing to the delinquency of a minor"?) to even > >discuss basic libertarian ideas with a minor. And as I said, Child > >Protective Services could quite possibly seize a child whose parents were > >sufficiently vocal about their beliefs.) > One shouldn't be vocal to public employees in any case. Avoid them. If > you are going to be vocal use a non government forum. Separate your > personal life from your political life. It's not too hard to break most of > the pointers between your physical presence and your ideological presence. > Even though an investigator could find where I sleep at night, they would > have to actually expend the resources. My neighbors and the local cops are > unlikely to make the connection because they and I move in very different > circles and I minimize my database presence. [snip] Those people who live a very simple life [no TV, or at least no Cable TV, sleep on the floor with a small, thin mattress, use very little power outside of what's necessary for the laptop AC adapters, drive the smallest cheapest car available, wear old clothing, wear a beard to cut down on shaving, eat mostly veggie and mostly fresh, avoid doctors and drugstore products, stay away from large-corporation jobs, move frequently, rent but never buy, .... (you get the picture)] will get by just fine, and will have the flexibility to make large-scale adjustments rather easily. People who consider the opposite of some of the things mentioned above as very important to them will have to deal with the bad news.

1 0

Secrecy: My life as a nym
by azur＠netcom.com 17 Dec '03

17 Dec '03

>At 10:14 PM 11/11/96 -0600, Igor Chudov wrote: > >>This is an interesting topic. I apologize if my questions are too trivial, >>but here they are: >> >> 1) Can a person without an SSN have a credit record? Some >> may say that a credit record is a bad thing to have, >> but I am still interested in a possibility. >> 2) Will private lenders (such as credit card issuers or >> mortgage companies) agree to extend credit to a person >> without an SSN or to someone who refuses to give out his SSN? >> 3) Will the state issue a driver's license to someone who does not >> have/does not wish to give out their SSN? >> 4) Will states' police (where applicable) approve purchases of >> firearms if purchasers do not state their ssn (misstating it >> may be a crime) on an application? >> 5) Employers are required to pay certain taxes and therefore >> they, in my understanding, need to know their employees SSNs. >> How can people get around that (unless they do not need to work)? >> 6) Can someone without an SSN obtain various kinds of insurance? >> Some recent congressional actions or court rulings regarding the mandidate for SSN (Source: National Organization for Non-Enumeration (NONE), http://ime.net/none) * Public Law 104-193 President Clinton Signs Welfare Bill. The bill includes a number of sections attempting to expand the use of the Social Security number and creates new state and federal databases for personal information. * H.R. 3598 Prohibits certain misuses of the Social Security number. Prohibits any person from utilizing any person's Social Security number for purposes of identification of such person without the written consent of such person. * H.R. 3110 Disclosure of Social Security number. Provides for disclosure by the Social Security Administration of Social Security numbers and other records to judgments, or orders issued by courts of competent jurisdiction. * H.R. 4209 Requires applicants registering to vote to provide Social Security number. Amends the National Voter Registration Act of 1993 to require each individual registering to vote in elections for Federal office to provide the individual's Social Security number. * S. 580 Illegal Immigration Control and Enforcement Act of 1995. Provides for a reduction of acceptable employment-verification documents. * S. 999 Illegal Immigration Control Act of 1995. Provides for the issuance of enhanced social security cards for citizens and mandates employer verification of the number. * Olympia, Washington. Court rules no "right to labor" without social security number. * Bar None New Hampshire attorney, was suspended from the Maine Bar because he refused to disclose his Social Security number. Reinstated after agreeing to Consent Decree. * Texas Tech Texan was terminated from his employment for failing to provide a social security number. Filed a religious discrimination claim with EEOC. Rehired under provisions of Consent Decree. * Stop The Press Washington state youth was fired from his newpaper route for not having a Social Security number. Rehired after proving federal law does not require enumeration as a condition of employment. * Vote! Vote! Virginia's law requiring all citizens to provide their Social Security number in order to become registered to vote imposes "an intolerable burden" on their right to vote. * Taco's Are His Life Ohio teenager fired by Taco Bell for refusing to provide a Social Security number. Rehired after proving there is no requirement to provide number to employer. * Social Security Number Not Needed For Licenses Virginians can choose not to have their SSN appear on their driver's license. * Driver License District of Columbia law requiring applicants for driver's license to provide their Social Security number held invalid. -- Steve

1 0

RE: Taxation Thought Experiment
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Blanc wrote: >Just before the elections I heard on NPR and read in an article in a >local newspaper, some people's stories of how they converted from >Democrat to Republican. > >Most of them said that athough they were originally idealistic about all >the good things which government can do, when they started their own >businesses they were suddenly confronted with all the excruciating >regulation and rigmarole which any business must deal with on a daily >basis while just trying to get some work accomplished. Very quickly >they realized the consequences of a lot of the government proposals >which they had heretofore supported. > A case in point: A small company which manufactures premium, hand-rolled, cigars received a bill from the ATF for an unpaid tax and penalties. The notice indicated that the particular tax was over 5 years delinquint. When asked where in the over 500 pages of ATF regulations this tax was documented the investigator said he didn't know and indeed didn't find it after weeks of trying. Finally and expert in D.C. found the obscure reference. The company wanted to know why they were being billed for this tax after almost a decade of operation. They were told that althought the tax has been on the books the ATF had only recently programmed its computers to access the tax. Nevertheless, the tax and penalties were owed, billed or not.

1 0

NRC Crypto Report Supplement
by John Young 17 Dec '03

17 Dec '03

As Herb Lin noted here last week, the final printed version of the NRC Cryptography Report is available. It's a handsome and bountiful volume; and belongs in all the world's libraries. The main difference from the May 30 pre-publication version is about 190 pages of reference documents, now provided in a new Appendix N. The book claims all came from the Internet. We've put 13 of the documents listed below on our site, and will finish the last 2 tomorrow. The Executive Orders, MOUs and MOAs may be of interest. The contents are at: http://jya.com/nrcnidx.htm Here's they are: Appendix N Laws, Documents, and Regulations, Relevant to Cryptography N.1 STATUTES N.1.1 Wire and Electronic Communications Interception and Interception of Oral Communications N.1.2 Foreign Intelligence Surveillance N.1.3 Pen Register and Traffic Analysis N.1.4 Communications Assistance for Law Enforcement Act of 1995 N.1.5 Computer Security Act of 1987 N.1.6 Arms Export Control Act N.2 EXECUTIVE ORDERS N.2.1 Executive Order 12333 (U.S. Intelligence Activities) N.2.2 Executive Order 12958 (Classified National Security Information) N.2.3 Executive Order 12472 (Assignment of National Security and Emergency Preparedness Telecommunications Functions) N.2.4 National Security Directive 42 (National Policy for the Security of National Security Telecommunications and Information Systems) N.3 MEMORANDUMS OF UNDERSTANDING (MOU) AND AGREEMENT (MOA) N.3.1 National Security Agency/National Institute of Standards and Technology MOU N.3.2 National Security Agency/Federal Bureau of Investigation MOU N.3.3 National Security Agency/ Advanced Research Projects Agency/ Defense Information Systems Agency MOA N.4 REGULATIONS N.4.1 International Traffic in Arms Regulations N.4.2 Export Administration Regulations

1 0

Re: More snake oil: ENIGMA
by attila＠primenet.com 17 Dec '03

17 Dec '03

In <v02140b07aeaed1f1f746(a)[10.0.2.15]>, on 11/12/96 at 05:20 PM, azur(a)netcom.com (Steve Schear) said: . Attila said: . .> I wonder if anyone told them the data recovery teams can pull .> multiple layers of data off a disc after it has been stripped? .I've often wondered how effective disk encryption programs, like DiskCrypt, .are at hiding data from a Class III adversary (e.g., NSA). These programs .offer a means of 'cleaning' the data and directory space using randomized .patterns applied one or more times, but this might be insufficient for .removing data written slightly off-track by a previous write cycle. . I don't have any direct experience with 'serious' error recovery either; however, over a few years span listening to some my friends who have not come in from the cold, I received the very definite reading the key is a differential measurement on flux and organization which expands the 'hearing' range exponentially -even if it is multiple destructive formatting. I written software programs for C2 and B1 clearance, including primitives which wiped as they went. I used a pattern which shifted and repeated itself --not too ridiculous on unix if you are using type 2 read/write primitives. messy? yes, in its own simple way. The software was certified by multiple fairly sensitive regula- tory agencies, plus the usual few for whom there is no name. you don't expect, and you do not receive, anything more than a yes/no. but it was in these circumstances I 'heard' the comments on recovery. and their ability to measure that differential gets better every year! No, I do not consider 'erased' disks safe from a determined federal agency. I keep sensitive stuff on zip drives which are removable, and easily crippled forever. that and our principal [a]vocation: stronger cryptography than the hardware can bruteforce or trick. -- Cyberspace and Information are Freedom! FUCK your WIPO, too. -attila

1 0

Re: Censorship on cypherpunks?, from The Netly News
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 9:33 AM 11/12/96 -0800, Declan McCullagh wrote: >The Netly News >http://www.netlynews.com/ >November 11, 1996 > >Cypher-Censored >By Declan McCullagh (declan(a)well.com) >... > That is, until recently, when Dimitri Vulis was given the boot. > After he refused to stop posting flames, rants and uninspired personal > attacks, Vulis was summarily removed from the mailing list. > >... > > Thus began a debate over what the concept of censorship means in a > forum devoted to opposing it. Did Gilmore have the right to show Vulis > the virtual door? Or should he have let the ad hominem attacks > continue, encouraging people to set their filters accordingly? The > incident raises deeper questions about how a virtual community can > prevent one person from ruining the forum for all and whether only > government controls on expression can be called "censorship." There is a serious error here. Gilmore did nothing to prevent Vulis from posting to the list. He only prevented Vulis from receiving the list under his own name. And, the as hominem attacks continue. ------------------------------------------------------------------------- Bill Frantz | The lottery is a tax on | Periwinkle -- Consulting (408)356-8506 | those who can't do math. | 16345 Englewood Ave. frantz(a)netcom.com | - Who 1st said this? | Los Gatos, CA 95032, USA

4 3

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by jim bell 17 Dec '03

17 Dec '03

At 02:11 AM 11/13/96 +0000, The Deviant wrote: >On Tue, 12 Nov 1996, jim bell wrote: > >> At 11:57 PM 11/11/96 -0500, Michael Froomkin - U.Miami School of Law wrote: >> Indeed, if Congress chose to license >> >private mints, that would, IMHO be legal. The point here is that the >> >states don't have the power to coin money. >> >> But, apparently, during the 1800's states (?) and individual banks did >> indeed print their own currency. >> >> The way I see it, a positive statement in the Constitution that the Feds >> have the power to coin money does not necessarily exclude other >> people/banks/states/foreign countries from doing likewise. >> > >Hrmm.. One might point out that the only thing required for someone to >"mint" (and I use this term loosely) money is for popular belief that the >money is worth something. What do you think a cashier's check is? Other >notable versions are (and I'm sure somebody is going to say "but its >represintative of the US Dollar", even though its all dealing with money >that really isn't there) is AmEx, MasterCard, Visa, etc. This is yet another reason the Federal government is going to find it so difficult to ban or regulate digital cash. With the collective precedents of paper money, then checks, then credit cards, then traveler's checks, then debit cards, and so forth, the addition of yet another medium of exchange doesn't appear to be a really new concept. Also, as far as I understand it, there is nothing illegal about spending (or accepting) foreign money inside the US, and in many if not most countries it is, likewise, not illegal to spend foreign money there as well. Obviously, the precedents allowing digital cash far outweigh those which could be marshalled to prohibit it.\ Jim Bell jimbell(a)pacifier.com

2 1

FW: Returned mail: User Unknown
by Butler, Scott 17 Dec '03

17 Dec '03

Can whoever is responsible for this please stop. This is about the 30th one that I have received. Thanx Scott >>The address you mailed to is no longer valid. >>This is probably because the user in question was an >>old Open Net subscriber. Open Net is NO LONGER an ISP, >>and has not been since May 1996. > >>We have no redirection address for that user. Please >>remove them from any mailing lists you might have. > >>This response was generated automatically. > >

1 0

Re: Not. [Was Re: Federal Reserve Bank is ILLEGAL?]
by Richard L. Field 17 Dec '03

17 Dec '03

At 10:35 AM 11/12/96 -0800, Jim Bell wrote: >...The way I see it, a positive statement in the Constitution that the Feds >have the power to coin money does not necessarily exclude other >people/banks/states/foreign countries from doing likewise. No need to turn this into Constitutional Law 101, but you might wish to look at Article I, Section 10. - Rich

1 0

Q: where is `/etc/passwd' on WindowsNT
by Thomas Vogler 17 Dec '03

17 Dec '03

hi all, i am looking on information where WindowsNT stores its database of hashed passwords (in the registry ? below the key \\hklm\security\sam\domains\account\users ?) and how they are stored / hashed (md4 ?) ? any information welcome... ttfn thomas -- +-----------------------------------------------------------------------------+ | jolifanto bambla o falli bambla / gro_iga m'pfa habla horem / egiga | | goramen / higo bloiko russula huju / hollaka hollala / anlogo bung / blago | | bung blago bung / bosso fataka / | || | / schampa wulla wussa olobo / hej | | tatta gorem / eschige zunbada / wulubu ssubudu uluwu ssubudu / tumba ba-umf | | / kusa gauma / ba - umf // hugo ball, 'karawane' | +-----------------------------------------------------------------------------+ | Thomas Vogler, tvo(a)software-ag.de, http://pcool/~tvo/ | |-----------------------------------------------------------------------------+ | Phone: [49]-(6151)-92-2484 FAX: [49]-(6151)-92-2610 | +-----------------------------------------------------------------------------+ | statements in here are my own and not neccesarily those of my employer | +-----------------------------------------------------------------------------+

1 0

Data leak in Estonia
by Jüri Kaljundi 17 Dec '03

17 Dec '03

The following are some news clips from Baltic News Service about a scandal in Estonia, where some government and private databases were sold on black market on CD-ROM disks. This brings up an interesting question, who should own information like police and IRS databases, and is it illegal to copy such information once it is available. Juri Kaljundi jk(a)stallion.ee --- SECRET INFO IS SOLD ON BLACK MARKET, ESTONIAN POLICE SAY TALLINN, Nov 09, BNS - Classified information of important state institutions is available on the black market, according to Estonian security police and central criminal police officials. A database containing information on hundreds of thousands of people, collected by the Tax Department, Estonian Mobile Telephone and Radiolinja companies, the Social Affairs Ministry and several other state agencies and large companies, has hit the black market, the Eesti Paevaleht daily reported on Saturday. Supposedly, also Customs Department and national car registry databases have been secretly copied. The CD-ROM with the confidential informations costs about 50,000 kroons, according to the daily. Security Police Director General Juri Pihl and acting deputy director of the central criminal police, Andres Anvelt, confirmed that numerous institutional databases are available on the black market. Anvelt said he had happened to see a pirate copy of the buildings registry showing all transactions with buildings and their owners. "I've also heard that information on who owns which telephone number has leaked from mobile telephone companies," he added. Pihl said security police would investigate information leaks only when they concerned security police itself. Looking into database thefts is not directly the province of security police, he said. Such a secret database is a powerful weapon in the hands of organized crime, the daily said. Criminals have managed to take advantage of the insufficient protection of electronic databases and are sometimes better informed than the police, Anvelt confessed. Baltic News Service --- ESTONIAN COMMITEE CLAIMS IT HAS NO INFORMATION ON DATABASES ON BLACK MARKET TALLINN, Nov 11, BNS - Chairman of the Estonian parliament's security police committee, Vahur Glaase, said he had not enough information on allegedly illicit trafficking in classified databases. "I have too little information to draw any conclusions," chairman of the parliamentary committee controlling the activity of the Estonian security police told BNS. The Eesti Paevaleht daily Saturday claimed that a database containing information of the taxation department, the Eesti Mobiiltelefon and Radiolinja mobile telephone companies, the social affairs ministry and some other agencies and companies on hundreds of thousands of people had arrived on the Estonian black market. Presumably, the illegally copied database also contains data of the customs department and the motor vehicles registration center. Glaase said that while a large proportion of the official information is open to the public, the publication of a classified telephone number is a crime. "This seems to smack of misprision, and police must start investigating it when an application is filed," Glaase said. According to the Eesti Paevaleht report a CD-ROM with the illegal database costs about 50,000 kroons. The paper claimed that the pirated information is a powerful weapon in the hands of criminals. Security police general director Juri Pihl and central criminal police acting assistant director Andres Anvelt confirmed there was black-market traffic in many institutions' databases. Pihl said that the security police would launch an inquiry into the information leak if it also concerned the security police. He said investigation of database theft was not an immediate task of the security police. According to the criminal code, the potential punishment for destroying or manipulating with other people's electronically recorded information is punishable with a prison sentence for a term of up to one year. Baltic News Service --- ESTONIAN CABINET EXPRESSES SHOCK AT GOVERNMENT DATA LEAK TALLINN, Nov 12, BNS - The Estonian Cabinet is shocked by the appearance on the black market of government information, foreign minister and acting prime minister Siim Kallas said. "It is a complicated problem and the Cabinet is shocked by it," Kallas told reporters on Tuesday. Kallas said Interior Minister Mart Rask had known about the information leak since two months ago. "Investigation of the leak has started at the Interior Ministry and by today criminal proceedings have been taken in the first case," Kallas said. Kallas said that in the nearest future the Cabinet would adopt a decision obliging state institutions to protect the information at their disposal. "The security systems and leaking connections must be checked," he said. The acting prime minister said that it was important to establish how, by which channels and through whom the information came to the black market. Baltic News Service --- ESTONIAN POLICE QUESTION FIRST PEOPLE IN DATABASES LEAK CASE TALLINN, Nov 13, BNS - Estonian police Tuesday questioned several people in connection with criminal action brought in the databases leak case. An interview with an alleged author of the black market databases, Imre Perli, has been scheduled for Wednesday. Tallinn police deputy prefect Peeter Sults told BNS that investigators had contacted Perli by telephone and he had promised to come for an interview. "Perli is not a suspect," Sults said. "Criminal action was brought concerning the fact of the leak, not any concrete person." Sults said the perons interviewed were connected with institutions from which information had allegedly leaked out. The Tallinn criminal police brought criminal action in the classified information leak case on Tuesday. The action was taken concerning violations of regulations of government register keeping or of the use of the information contained in such registers. The punishment stipulated for this in the criminal code is a fine or a prison sentence for a term of up to two years. The press has claimed that most of the classified databases were compiled by Perli, until September an Eesti Mobiiltelefon mobile telephone company employee. He may also have compiled the motor vehicles register database by which car owners can be established. Databases containing thousands of mobile and ordinary telephone numbers, traffic offences, as well as data of the motor vehicles and companies registers are currently being offered for sale in Estonia. Such databases are of high value for organized crime. Baltic News Service

1 0

Re: pgp3
by Gary Howland 17 Dec '03

17 Dec '03

> Gary Howland wrote: > > > > > Someone suggested to me that Derek posted a draft spec for PGP 3.0. > > > Anyone know of the whereabouts of this document. > > > > Yes. That document has evolved to RFC 1991: > > > > 1991 I D. Atkins, W. Stallings, P. Zimmermann, "PGP Message Exchange > > Formats", 08/16/1996. (Pages=21) (Format=.txt) Hmm - I don't know I managed to make this post - I had started writing a reply, but exited my mailer, and for some reason it decided to send a cut down version of the unfinished mail anyway ... > Nope. This RFC is merely a rehash of the pgformat.doc file in the PGP > 2.6.? distribution. I'm doing an independent implementation of the PGP > 2.6 message formats, and found this document unclear in a few spots. For > example, can anyone else figure out the weird CFB variant mode from this > document? I used a debugger on the PGP code to help me figure it out. Exactly - I spent ages on the same thing. Then there's the problem that packet length headers must be specific lengths for various types (eg. key certificates must have a 2 byte length, even if only one is required). It is also not clear what the exported key certificates should contain, the spec simply mentioning that there should be no trust packets etc. etc. > The PGP 3.0 "spec" that you're referring to is actually a draft for a > PGP library API. A couple of those got circulated on some PGP mailing > lists, but none have been publicly released, another example of the > secrecy surrounding the whole PGP effort. > > Now that PGP Inc. is happening, it's not exactly clear whether the PGP > 3.0 release is going to include an API closely resembling these drafts. I agree with your comments. For example, we are developing PGP compatible libraries in both Perl and Java, and are going to add SHA, Blowfish, T-DES, etc., along with a better key ring format, encrypted key rings, and features such as key generation from a passphrase, and we would very much like to remain compatible with the new PGP, but how can we when there is so little information available? I think we need a forum to discuss PGP development issues - I would be happy to set one up if there was interest. Best regards, Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

Re: Taxation Thought Experiment
by Gary Howland 17 Dec '03

17 Dec '03

> o TAXES THOUGHT EXPERIMENT > > 1) I generate $100 of productivity for my company > 2) Company is taxed %30, $70 left > 3) Company pay shareholders and costs, $30 is left > 4) Company pays me > 5) I pay 40% in taxes, so $18 left > 6) With $18 I can buy a $16.82 object (%07 sales tax). > > Results: > 1) I see $16.82 realization from $100 productivity increase. > * Govt. gets $49.26 of my productivity, or nearly 3 times the amount I get. The government gets $59.26, not $49.26 (30+16+12+1.26). That leaves you with 16.74 (not 16.82) - they get nearly four times as much. In other countries the situation may be worse, not only due to different rates of tax, but because of social security contributions, employers tax, and the like. Then if you spend your money on beer or fags, you may be paying even more tax, due to taxes on alcohol and tobacco, leaving the government with perhaps 10 times as much money as you. Many imported goods also have a tax on them (eg. motorcycle import tax is around 50% in the UK). It is probably more fun to do these calculations without involving the shareholders, since they are, after all, earning their "cut". [ Crypto relevance? Assasination taxation? ] Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

FW: Returned mail: User Unknown
by Butler, Scott 17 Dec '03

17 Dec '03

> >>The address you mailed to is no longer valid. >>This is probably because the user in question was an >>old Open Net subscriber. Open Net is NO LONGER an ISP, >>and has not been since May 1996. > >>We have no redirection address for that user. Please >>remove them from any mailing lists you might have. > >>This response was generated automatically. > Can whoever is responsible for this please........STOP IT ! Thanx ScOtT >;-D

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Foulmouthed Timothy May rehashes his lies like a rabid parrot choking on a stale mantra stuck in its poisonous beak.

3 2