December 2003 - cypherpunks-legacy

Linux and PGPsendmail
by blane＠squeaky.free.org 17 Dec '03

17 Dec '03

X-Secure: add-key I now have my system somewhat kludged into the net. I can now EASILY send and receive PGP messages from my home box. I am connected to my shell account at free.org throught a local xyplex terminal server and term 2.0.4 I use popclient to get my mail from my host(a better way may be possible), and I have my local smtp service redirected to squeaky.free.org so that I can send mail out without a hassle. Anyone who needs help getting set up like this can e-mail me. PGP messages are welcome! Brian

1 0

Re: Is Off-Line Digital Cash Dead?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Different businesses have different attitudes toward off-line cash and similar things. For instance, Bart/Metro magnetic subway tickets, and the similar scrip that supposedly is popular in Japan are all semi-electronic money, half-offline (don't know if the subway tickets get reported to central locations or if all the processsing is done locally...), and yet there's nothing more than honesty and the technical difficulty of forgery that keeps them from being forged. Postage meters are also off-line, and unlike subway rides, which are hard to make lots of money accumulating (:-), mail-oriented businesses could save lots of money using fake ones. The main similarities I see between the above kinds of money is that they're mainly issued, either directly or indirectly, by the providers of specific services, and they're hard to use for other kinds of service. Since they use physical tokens, though they may have digital information on them, they're obviously hard to email across the internet, but anybody you can send email to is already online... As I see it, there are three main reasons for wanting offline cash - - avoiding the need to wire your cash register equipment - avoiding the per-event communication costs for the transaction - avoiding the time delay for the communication Per-event costs may be low, but in the non-wired world they're non-trivial. A phone call typically costs at least one message unit, say 5 cents. A CDPD cellular packet, according to some pricing I've seen, is similar. That's not much money when you're selling cars, but it's a lot for newspapers. Here at the former National Cash Register company, we've found that retail stores really like wireless communications to the cash register; in stores without datacomm wiring, it means you don't need to install any, and even if there's wiring in place, being able to move point of sale terminals around can be worth a lot, and if you only have to find a location with AC power wiring and not data, you're more flexible. The time delay for credit card verification is also an issue - modem-based systems typically take 15-20 seconds, while on-line systems take 2-3 seconds when the network isn't busy. That's an important issue at a retail store, when you can spend the transaction time putting merchandise in bags - it's far more important for things like road tolls or subway turnstiles. And waiting three days for your remailer network to bounce back an acknowledgement on your retail cocaine transaction will just _not_ do :-)! If you can accomplish all these successfully with offline systems, great! Too bad it's hard to do while retaining anonymity. Bill Stewart

1 0

Re: DigiCash ???
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Jim Dixon writes: > In message <9408281521.AA13945(a)ua.MIT.EDU> Jason W Solinsky writes: > > > I would like somebody to explain how I would go about using an anonymous > > > digicash system to buy a automobile? [ new car at local dealer ] ... > Do we care that you can't get it on the road without insurance in most > states, and that the registration must be in someone's name? Unfortunately, the government has gotten away with nearly banning non-anonymous automobile use and ownership, for various reasons including ability to tax, keeping insurance companies happy, controlling the population's behavior, etc. However, by the time digicash is well enough established that a car dealer will _accept_ N thousand dollar payments in it, if the rules for being allowed to own cars or money aren't much nosier, you want to walk into the dealership on a rainy night in February, offer them an annoyingly low price for the car, they accept, you refuse the offers to lease or finance the car, and they say "Foo Bar Holding Company? We won't take your corporate check without bank certification, but we'll take Star/Plus/Sanwa/Mac ATMs, Western Union digicash, credit cards for an extra 3%, or Federal Reserve notes for an extra 1% cash transaction reporting fee." Bill

1 0

Re: Online cash, Internet, Pizza Hut
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

> > > http://www.pizzahut.com > > demo is pretty lame I'm guessing it actually faxes the pizza order to the guessed-nearest store? Wonder if they're guessing by zipcodes, or doing a lookup by street address? > Is there any indication they will move to some kind of online pay system? It makes it tougher to tip the driver when payment is done in advance, since getting out your wallet is no longer an integral part of the transaction and you don't have paper change around. Of course, their pizza is even less inspired than Domino's. (Still wishing I could find decent pizza on this side of the hills; the only decent pizza I've had on this side of the _continent_ has been a couple places in San Francisco....) Bill Now, if you order from Uncle Enzo's, you know it'll arrive on time guaranteed! :-)

1 0

The Effects of Thinking & Writing
by blancw＠pylon.com 17 Dec '03

17 Dec '03

Responding to msg by nobody(a)ds1.wu-wien.ac.at >I think that writing and thinking is the only thing any >of us can do that will have impact. The only coding >effort I can see paying off is helping to make PGP >better. Maybe that's what I'll do. > >Thoth .................................................... I have read in public & private, comments about cypherpunks and how there is really little to be expected from the list in terms of practical solutions to governments, surveillance, the new world order, etc. It sets me to reflect upon what people could really expect to get from a mailing list; why it is that there is disillusionment about what the members seek to accomplish, such that there are discrediting comments about what will really happen as a result of its existence: what is it that leads some people to expect that reading other people's mail is going to change the NSA's mind, or the world at large? Is it because "real" cypherpunks write code? Perhaps the expectations for the range of the efficacy of coding are a little too high in some people's estimation? (Just because criminals & the NSA think it's important, doesn't mean e-v-e-r-y-b-o-d-y else will think so, too. Okay, so you're going to disagree with me about that. So flame me.) I must reflect upon the fact that this is, after all, just a list - just reading material and interchange from anyone who feels sufficiently motivated to reply or comment or just send in their .02 cents. Perhaps someone's intellect could supply imaginative inspiration, perhaps their knowledge could provide missing pieces to a puzzle, perhaps their style could bolster a failing courage towards autonomous thinking & therefore acting. What could really be realized from a voluntary gathering of various & sundry assorted strangers who subscribe for their own self-decided particular reasons, which they don't divulge to all, to get what they will and contribute what they may at such time as they feel sufficiently motivated to do so? Is this the Cypherpunk Savings & Loan Division? or did I reach the wrong department. Blanc

1 0

Re: Is pay-per authentication possible absent trust?
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408251545.AA22928(a)ua.MIT.EDU> Jason W Solinsky writes: > > Here is the situation. Charles runs a certification agency. He might be > certifying that you have some basic competency so that people will hire > you. [etc] > Either way, Charles's certification is worth money to you. But the value to > you isn't a constant amount. Each time you use the certification, you derive > additional value from it. So Charles figures that it makes much more sense > to sell his certifications on a per use basis... [etc] > To do this Charles adopts a protocol in which his signatures are time > dependent. Everybody can verify that his signatures a valid for the time > at which a signature is required, but only Charles can figure out what > the correct signature is for time T in polynomial time. [etc] > Enter Ingve the insurance salesman. Ingve will guarantee to others that you > are certified by Charles by offering them bets. So suppose that Microsquish > sends you its advertising agent and the agent is offering a 10 nano-slinkys > [a cyberspatial monetary unit] bonus if you can produce one of Charles's > certifications. Charles is charging 8 nano-slinkys. In steps Ingve. You've > told Ingve that you are certified by Charles as a frequent purchaser of big > brother inside computers. So Ingve says: "I'll convince Microsquish to accept > my word that you have Charles's certification in exchange for just four > nanoslinkys. But if at my request you ask for the certification and Charles's > says you aren't certified then you owe me 64 nano-slinkys." Since you are sure > that you are certified you accept the deal. Then Ingve goes to Microsquish > and offers to insure your certification. Each time Microsquish accepts a > certification from Ingve for you, Ingve will pay Microsquish 2 nano-slinkys > but will be able to get your business (and thus offset that with the four > nano-slinkys). But, if it turns whenever Microsquish wants to it can check > up on your certification from Charles at cost (8 nano-slinkys). If Charles > certifies you all is well. Otherwise, you owe Ingve 64 nano-slinkys and > Ingve has to pay up Microsquish's insurance claim (which could be quite large > depending on the policy. > > The result of all this is that Charles is cheated out of his revenue. Ingve, > You and Microsquish profit, but Charles fails to reap the benefits of his > certification. The question is: Is there a secure method that charles can > use to prevent the "Ingve the insurance salesman attack"? This is one of these problems where there is less there than meets the eye. First, a distinction is made between Charley's type of certification and Ingve's: Charley provides absolute assurance and Ingve provides a guess. But in actuality nearly all certification is probabalistic. That is, Charley goes through some sort of process and decides that he takes very little risk in offering a certificate. But you can rarely be certain that anything is true. So both Charley and Ingve guess. Secondly, when Ingve makes a similar guess, he takes a quantifiable risk. If he guesses wrong, he pays a penalty to MS. You imply that Charley takes no similar risk. In fact he must. The risk may be quite visible (he posts a bond which he can lose, or the customer may sue for damages) or it may be less visible (customers will stop coming to him if his certifications are false). So Ingve and Charley both face a penalty if they guess wrong. Finally, you throw in a payment to MS so that Ingve pays something when he issues a certificate, but by omission you imply that Charley's certificates are cost free. However, if they were, than Ingve's rational course of action would be to do whatever cost-free mumbo jumbo Charley does and issue his own certificates. So Charlie's certification process must have a cost, and so we suspect that in fact Charlie is sometimes behaving just like Ingve. Sometimes Charlie just skips the expensive precertification steps and issues a certificate anyway, making an extra profit. This is a form of self-insurance. So they are both in the insurance business. At this point, the distinctions between Charlie and Ingve have largely vanished. Ingve is just a competitor. MS pays less for Ingve's certificates because Ingve is known to guess a lot, whereas Charlie is generally trusted more. You pay less to Ingve for the same reason. -- Jim Dixon

1 0

Re: Zimmermann/NSA debate postponed
by Mark Grant 17 Dec '03

17 Dec '03

On Sun, 28 Aug 1994, Carl Ellison wrote: > Anyone else out there with their own mailer? Yep, there's Privtool for Sun workstations (or anything else that uses the XView toolkit). It's only a beta at the moment, but I'll hopefully have time to finish it off before the end of the year, it's available from ftp.c2.org and ftp.dsi.unimi.it, and the documentation is available on the WWW at http://www.c2.org/~mark/privtool/privtool.html (I posted that here and on Usenet a few months ago). Mark

1 0

Re: In Search of Genuine DigiCash
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <9408290556.AA28298(a)ah.com> Eric Hughes writes: > The law and the enforcebility of agreements is what makes financial > instruments exist. Their behavior is a direct result of their legal > underpinnings. > > This is absolutely false. Both a promissory note and a bond can have > identical financial structure, but the legalities are completely > different. This is absolutely illogical. He says, laws underlay financial 'behavior'. You say, [law1] -> [behavior1] and [law2] -> [behvarior1], and THEREFORE the proposition fails. He did not say "there is a one to one relationship between laws and financial instruments". What he says permits an N:1 relationship, or an N:M relationship. -- Jim Dixon

1 0

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://kiwi.cs.berkeley.edu/pub/raph/premail-0.20.tar.gz This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 10-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"chaos"} = "<remailer(a)chaos.bsu.edu> cpunk hash ksub"; $remailer{"vox"} = "<remail(a)vox.hacktic.nl> cpunk oldpgp."; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk oldpgp"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"kaiwan"} = "<ghio(a)kaiwan.com> cpunk pgp hash latent cut"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk hash"; $remailer{"wien"} = "<remailer(a)ds1.wu-wien.ac.at> cpunk pgp hash nsub"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric pgp."; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)hacktic.nl> cpunk pgp hash latent cut"; $remailer{"leri"} = "<remail(a)leri.edu> cpunk pgp hash"; Last ping: Mon 29 Aug 94 6:00:01 PDT remailer email address history latency uptime ----------------------------------------------------------------------- kaiwan ghio(a)kaiwan.com ####*+**+*** 4:21 99.99% portal hfinney(a)shell.portal.com #####*#***+* 4:54 99.99% jpunix remailer(a)jpunix.com ####******+* 6:35 99.99% wien remailer(a)ds1.wu-wien.ac.at ####*****-** 10:32 99.99% alumni hal(a)alumni.caltech.edu ####******+* 7:30 99.99% usura usura(a)hacktic.nl ##*#-******* 13:35 99.99% bsu-cs nowhere(a)bsu-cs.bsu.edu ##-#**##**++ 18:22 99.99% extropia remail(a)extropia.wimsey.com ****++++--++ 1:13:54 99.99% vox remail(a)vox.hacktic.nl ----------- 7:04:23 99.99% c2 remail(a)c2.org ***++-+-.-++ 2:33:05 99.97% chaos remailer(a)chaos.bsu.edu ### *###*#** 0:58 99.56% ideath remailer(a)ideath.goldenbear.com ###+*+****-* 40:42 99.27% leri remail(a)leri.edu ###*++*--+* 1:41:41 99.03% soda remailer(a)csua.berkeley.edu +*-+++++++++ 1:30:41 97.61% rebma remailer(a)rebma.mn.org ----+ 5:46:02 64.79% penet anon(a)anon.penet.fi __ ._. 45:04:39 26.55% Suggested path: jpunix;portal;kaiwan For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. special Accepts only pgp encrypted messages. History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Note to remailer operators: this script generates hourly ping messages. If you don't want that, let me know and I will take your mailer off the list, or increase the interval between pings. Raph Levien

1 0

Re: Cypherpunk U
by Ryan Lackey 17 Dec '03

17 Dec '03

I think any of the schools which have been mentioned are great for undergrad. After being at MIT for a while (and now being eited by financial reasons, hopefully to be resolved before fall...), I learned to really appreciate the research programs offered by some universities to undergrads -- MIT has a really good program in that area, I'm not sure about the others. I think if there were one thing which I used to pick an undergrad school again, it would be the potential to get involved in faculty research. At MIT, the media lab does a fair amount of applied cryptology, and there is of course the theoretical computing lab which does a lot of application and theory. It's not that hard to get in, either. After all, I got in. There are a few useful tricks for your application -- email me if you'd like help. One of the big annoying parts of going to MIT is that firearms are banned from college campuses (except at ranges) in the state. Sigh. --- Ryan Lackey rdl(a)mit.edu 3 Ames St http://mit.edu/rdl/www/ Cambridge, MA 02142

1 0