December 2003 - cypherpunks-legacy

Anonymous Credit Cards
by geoffw＠nexsys.net 17 Dec '03

17 Dec '03

Anybody know anything about this?... ----- Begin Included Message ----- Path: internex.net!thumper.bellcore.com!owner-imp-interest From: dmk(a)allegra.att.com (Dave Kristol) Newsgroups: mlist.imp-interest Subject: Anonymous Credit Card on the Internet Date: 24 Feb 1994 14:57:19 -0800 Organization: InterNex Information Services, Inc. Lines: 71 Sender: daemon(a)internex.net Message-ID: <199402242247.RAA25510(a)thumper.bellcore.com> NNTP-Posting-Host: gaia.internex.net The anonymous credit card (ACC) protocol (paper available at research.att.com/dist/anoncc/anoncc.ps.Z and collude.ps.Z) is meant to be used the way a conventional credit card is - at the Point-of-Sale. (Awhile back) Gingery correctly pointed out that it can be extended to make an anonymous mercantile protocol on the Internet. We have made such an extension that can be used on the Internet to perform two functions: anonymous funds transfer from a customer to a seller, and anonymous delivery in the reversed direction. The delivery can be made either over the Internet, e.g. files, or otherwise, e.g. books, CDs. The following gives an overview of the protocol; a more detailed description of the protocol, including motivations for anonymity, can be found in a working paper available at research.att.com:/dist/anoncc/accinet.ps.Z. Overview of Protocol --------------------- A customer can purchase multiple files in a single session. How the customer chooses files of interest is outside the scope of our protocol. A session proceeds in three phases. In phase 1, a customer transfers funds anonymously from his/her bank account to the seller's bank account. The customer obtains a receipt from the seller's bank certifying the deposit, which he/she presents to the seller to open a session account at the seller. In phase 2, the customer makes possibly multiple requests of files from the seller. The seller deducts the purchase prices from the session account and delivers the files without knowing the identity or address of the customer. Phase 3 is entered when the customer finishes all desired purchases (or when the session account runs out of money). Any balance in the session account is refunded anonymously to the customer's account. Information separation and cryptographic techniques are applied to hide from each party the information the party does not need to perform its function. After a protocol session, 1) the customer's bank only knows that money has been withdrawn from (and deposited to) the customer's account, but knows neither the purpose nor the source (and destination) of the transfer(s); 2) the situation at the seller's bank is similar; 3) the seller only knows that it is paid for the purchase of certain files, but not the identity or the address of the customer. Differences from Gingery's Scheme --------------------------------- Although Gingery's scheme and ours have much in common, there are also several differences between them. For instance, in Gingery's scheme, the customer communicates directly with the seller, whereas in ours, they can communicate through an intermediary that hides one's identity from the other if the customer desires a higher degree of anonymity. In our scheme, the customer initiates a funds transfer by sending a message directly to his/her own bank; in Gingery's, the request (in encryption) is instead passed to the seller, and then forwarded to the seller's bank, and finally forwarded to the customer's bank. Hence, our scheme requires less communication (and the communication can be further reduced if anonymity requirement is relaxed to the same degree as in Gingery's scheme). Finally, unlike Gingery's scheme, the seller is provided with a key and an encrypted address by the customer so that the seller can encrypt and deliver the purchased files without knowing who the customer is. The encryption not only guarantees secrecy to the customer, but also protects the seller's interest since otherwise any eavesdropper can obtain the information for free. Dave Kristol ----- End Included Message -----

1 0

No Subject
by nobody＠jarthur.claremont.edu 17 Dec '03

17 Dec '03

A continual subject of debate has been the privacy of swiss accounts... and lichenstein and luxemborg banks... according to a recent text I read on the subject the hot way to conduct banking in privacy by mail is to a. use a canadian PO Box to avoid US mail covers on swiss postmarked incoming mail... b. if the money is derived honestly(i.e. legitamate but underground businesses simply underground for tax-avoidance) and NOT drug dealing derived or from an offence that is also an offense in Switzerland, then all privacy laws on swiss banks apply...tax avoidance is specifically excluded as an area where US. TLA can obtain cooperation of swiss authorities. c. Swiss Banks issue credit cards on accounts... :) d. further privacy is derived via a trust or corporation in Lichenstein and transferring the mony to said trust or corp from a swiss bank... e. A list of Swiss Banks to start with: Union Bank of Switzerland Bahnhofstrasse 45 8021 Zurich, Switzerland Telephone: 29-4411 Swiss Bank Corporation Aeschenborstadt 1 4002 Basel, Switzerland Telephone: 23-2323 Swiss Credit Bank Paradeplatez 8 8021 Zurich, Switzerland Telephone: 29-2811 Foreign Commerce BAnk Dept 284 Bellariastrasse 82 8022 Zurich, Switzerland Telephone: (01) 45.66.88 Foreign Commerce BAnk Dept 42 3 Rue de Marche CH-1211 Geneva 3 Rive, Switzerland Telephone: (01) 21.42.33 Bank Indiana Suisse Attn: F.C. Mishari 50 Ave. de La Gare 1001 Lausanne, Switzerland Telephone: 20.47.41 Bank Leu Postfach 8022 Zurich, Switzerland Cambio & Valorenbank Postfach 535 8021 Zurich, Switzerland Ueberseebank, A. G. Limmatquai 2 8024 Zurich, Switzerland f: All of the above was derived via "Personal Privacy through Foreign Investing..." and "How to determine Undisclosed Fianacial Interests" "a Manual for financial investigators.. both by loompanics press.... I am checking the above banks to see if ANY are internet connected and would be willing to receive orders via signed PGP messages If the above is positive I will get back to the group anon

1 0

RE: Civil Rights
by Blanc Weber 17 Dec '03

17 Dec '03

As I read the contribution from Jim Choate on the subject of "rights", I had some further thoughts & comments on the subject. Please delete if you don't care; it doesn't address cryptology directly, but some of you *are* interested, and if you have further comments please just send to me and copy only those others who also have expressed interest. ~ Blanc ---------- >From Jim choate: Seems to me that a 'right' as is being discussed should be 'Civil Right'. When used in this context I believe a suitable definition would be the following: Civil Right A characteristic granted to a citizen of a country which is beyond the normal law making ability of that countries governing body. In effect it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government. It in effect says that there are certain facets of an individual which are outside the normal operations of a government and can not be regulated or otherwise controlled through legistlative means. ........................................................................ It is true that the term a "right" can mean different things, depending on how one is considering the word & its meaning; in terms of a governed society, the meaning should be considered within the context of action as limited by agreement/consent, as something that involves the group's assessment of what is to be allowed (or not) within the organization; what permission will be granted and by whom, for what purpose, considering the consequences to all involved. The ability to determine what shall be considered a "right" depends upon the knowledge and intelligence of those who can make such decisions, who can achieve a comprehensive view of the situation and put individual action into perspective within this sweeping view. Given such a requirement, I would question the order of things, in concluding what the proper source is for the establishment of what these right should be, and give serious examination to the interpretation of what the actual nature of our circumstance is, (within the context of a society "under" government, but with liberty & justice for all, etc.). It is a bit difficult to make a succinct sentence which comprises all of my thoughts into a few sentences, I hope the above is not too difficult to understand. Not to make an example of Jim's contribution, but it just so happened that going through the sentences in the paragraph offered by him, I found concepts which I see as sources ripe for confusion & contention: A characteristic granted....... . So, the origin of this 'right' is from the decision-making of those elected to make considerations of this kind, which no one else is permitted to make. And I wonder: what qualifies them for this, the exclusive right to determine what it is all right to do within the context of a governed body of people, to be the ones who "grant" permissions to move, to do, to act. i.e., the source of an allowance to movement comes not from the ability to think correctly about it, to make valid judgements, but only from a permission *granted* to one by another. This immediately puts an individual's own thinking in danger; there is created the possibility of having one's own decisions categorized as without merit because they do not serve the purposes of the government, or because they do not serve the purpose of the governed society (the significance of which is seen as more important than that of being an individual of a singular character - compared to, say, an amoeba which absorbs all, as societies often begin to imagine themselves to be and presume themselves to have the right to demand utter mindless conformity on account of their numerous fears of what wanton individuals might do). It is unreal, that the determination for what is a 'right' is thought to come not from the ability to think successfully about life, liberty & the pursuit of happiness, but from the position one has been awarded over other citizens. This is like the right to a position over their minds, as well. And the ability to think and to serve the purposes of one's own interest are seen, then, as a crime, unless first submitted to the State for review and authorization as politically acceptable and therefore allowable. ...it grants a citizen the ability to make decisions and act on them without regulation or permission being required by the government...... . who are all honorable men..... :>) who recognize the merit of being an individual, not simply a "member" or society; i.e., not a lesser being, a minor "element" of the greater good, the Great Society, but, au contraire, who is expected to engage (to the max) in the pursuits explicity named in the Constitution (or was it the Declaration of Intent, Know What I Mean, George). ...there are certain facets of an individual which are outside the normal operations of a government . . . . . . As an exception to the rule? where most of the facets of being an individual are *within* the "normal" operations of a government? This concept does not represent they way that I think of the activities or the boundaries of my life, nor what I would wish to impose on others (or no one that I could admire). I'm sure government employees would agree with this, where I would not. It really is necessary to consider what is "normal" for a human being first, rather than what is normal for a government. First there must be someone to be governed......and a satisfactory reason why they should be governed. ...certain facets of an individual... cannot be regulated or otherwise controlled through legistlative means . . . . So there are a "few" things to be acknowledged, after all, as existing outside the atmosphere of governmental control. You know, "legislative means" are only the precursors to action; legislation only arranges verbally the threat of what will later be done physically to someone if they do not comply. This statement implies that one is only free secondarily, but primarily exists within an environment of control (external to one's own). I don't think it was intended that citizens of the US think of themselves as regulated first and freemen second. I don't think this is the correct way to think about life per se, or about "rights" within the context of an organization. Furthermore, the truth of the matter is that legislation alone does not control my (or anyone's) actions from some power of its own, and it alone does not automatically convince me of what I ought or ought not do, simply because it has been written, and voted agreeably upon, by members of an electorate. They could all be wrong. The control which exists as brought about by legislative means is only the effect upon the mind of those who will fear the consequences, delivered by "enforcement personnel" armed with weapons of subjugation. And as we all know, legislators themselves have ways of getting around this fear and its expected consequences. But this does not necessarily do any justice to reality, the cause/effect that we live with in the 'real world', which it is our responsibility to come to terms with if we want to live and have a quality existence. And this is what is left out of legislation: that we have to come to terms with it (reality) independently, not only in association with each other, and that we have to do this first in regard to our own lives, before we worry about those of others. The direction of the concept of a 'right' is set towards group thinking (the collective), whereas the Constitution would set it in the other direction. Gosh, I'm so glad everyone on this list is crypto-anarchist and can appreciate the fine details of anti-government analyses. ~ finis ~

2 1

T-shirt update...
by Christian Void 17 Dec '03

17 Dec '03

We are slightly behind schedule... I've been swamped by work and everything else. The shirts will be screened starting this week, and should be done by next week. I'll keep everyone updated. Thanks to everyone who ordered. This project has been a lot of fun to put together, and despite the few mishaps, has gone almost flawlessly (aside from being behind schedule!). Christian Void /T71 | "I don't like it, and I'm sorry I | V/M/Research, Inc. cvoid(a)netcom.com | ever had anything to do with it." | P.O. Box 170213 Tel. 1+415-998-0774 | -Erwin Schrodinger (1887-1961) | SF, CA 94117-0213 * PGP v2.3a Public Key Available Via Finger *

1 0

Re: I have FOIA'd the Clipper Key Escrow databases
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Steve Bellovin writes: > Good strategy. I still wonder if the decrypted keys are (all) classified, > while the encrypted ones aren't. After all, the local cops' magic decoder > boxes can strip off that layer of encryption (as, of course, anyone > who steals one of those boxes or bribes a local cop). I'm puzzled by the applicability of "classification" here. The NSA can classify stuff, since they're part of the military, and a few other government agencies can (State Dept., I think?), but are NIST and Treasury able to do so? (Assuming, of course, that we maintain the charade that the NIST and NSA are separate for crypto purposes.) I don't think they can, and if they could, they wouldn't be able to give any of the classified stuff to regular local cops. If things become classified by the NSA handling them at key-setting time, then they can't give them to the so-called escrow agencies, or if they do, those agencies can't give them to uncleared people. Perhaps the NSA's secret backdoor mechanisms in the key-setting process are classified, since the nation would feel very insecure if they knew about them, but that's a separate issue. Keys for batches of chips the NSA burns for use by Defense Department users are a different story, and probably have a different Family Key than civilian-wiretapping keys, but they're probably handled under entirely different rules anyway. > Anyway, I hope the idea works, or at least drives them a bit crazy... Bill

2 1

Re: standard for steganography?
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

Doing a pnmstego isn't quite the right approach, since it's a special-purpose tool that advertises its presence. A more appropriate general-use tool would be something like pnmbitplane, which would let you do something like extract a specific bitplane from a ppm or pgm as a pbm, and a reverse tool which would let you substitute or xor a pbm into a pgm or ppm, with appropriate options for the ppm versions that let you do one color, all three, etc., and for both ppm and pgm to let you pick which bitplane. You'd also have to add something appropriate for padding, like a random-fill vs. 0- or 1-fill option, or else provide a tool that makes a string of bytes into a bitmap shaped like a given pnm. Some advantages - it's more general, there are other uses for it (such as adding titles to ppm pictures), it's not much more work to write, and only the NSA agents reading cypherpunks will know that's why it's there :-). A disadvantage, of course, is that potential users may not guess, unless people tell them things like "Oh, yeah, you could use ppmbitplane to do that, of course". This also lets you reserve the name ppmstego for translating between ppm and Stego Mac format. Bill # Bill Stewart AT&T Global Information Solutions, aka NCR Corp # 6870 Koll Center Parkway, Pleasanton CA, 94566 Phone 1-510-484-6204 fax-6399 # email bill.stewart(a)pleasantonca.ncr.com billstewart(a)attmail.com # ViaCrypt PGP Key IDs 384/C2AFCD 1024/9D6465

2 1

MEET: NE Ohio
by Derek Atkins 17 Dec '03

17 Dec '03

I'm going to be in Cleveland, March 3-7 this weekend (all day Friday-Sunday inclusive), so if anyone would like to meet, possibly echange signatures, or just chat, please send me personal email before 4pm Thursday! Hope to hear from some of you... -derek

1 0

Anybody heard of "The SLED"? (long)
by mcb＠net.bio.net 17 Dec '03

17 Dec '03

On ba.internet I got a pointer to something called "the SLED", a database of e-mail addresses, and requested the info file, which is appended. While the people offering the system seem to be interested in privacy, encryption, and PGP key service, there are some strange thing about it, especially where they require *you* to identify yourself to *them* when registering your address. My comments to the newsgroup appear at the end. -- Michael C. Berch mcb(a)net.bio.net / mcb(a)postmodern.com -------------------------------------------------------------- Date: Sun, 27 Feb 1994 18:56:21 -0800 From: Stable Large Email Database <sled(a)drebes.com> Message-Id: <199402280256.SAA10575(a)drebes.com> To: mcb(a)net.bio.net References: <199402280247.SAA16850(a)net.bio.net> In-Reply-To: <199402280247.SAA16850(a)net.bio.net> Subject: Sled Info ----------------------------------- SLED : Stable Large Email Database ----------------------------------- SLED is an attempt to provide a reasonable mechanism to maintain and search email addresses for individuals and companies that make up the on-line community. SLED is intended for those who have one or more mailboxes that are generally checked on a daily basis, and are addressable from the internet. --- What does it provide? --- I. Timely maintenance of current email address: Over a period of time a person may have many different email addresses, which come and go with the changing of jobs, internet providers, schools, and so on. Maintenance also means pruning the list for those who no longer interact on-line (and are perhaps dead). II. Realistic search parameters: Current email databases such as whois & netfind provide a search granularity that is useful only if you already know the person's email address. The data set is crafted by each individual user. It can contain entries for schools, occupations, research areas, nick names, and so on. See note below on how this data is kept private. III. Protection against the enemy: SLED is intended to provide a high quality data set which provides flexibility in searching, but yields protection against the enemies of large address books. The enemy can be one of the following. - Head Hunters/Body shops - Anonymous and Fake user accounts - Commercial Junk mailers IV. A repository for PGP public keys: SLED provides an alternative to the huge, very public "public key" rings on some of the foreign key servers. (If you don't know what PGP is, don't worry.) --- How? --- It costs a few $$, and it requires the use of snail mail ( USPS ) at least once. There are several reasons for charging a small (very small in this case) fee for this service. 1. Authoritative ID. For your data to be included in the database we require that you write a personal check. For the initial sign-up, we verify that the name on the check matches the name in the database. A signed check which clears the banking system provides very good authentication. A semantic note: we don't actually wait for the check to clear. We get the check, eyeball the data, update the computer and then send the check to the bank. If the check turns out to be bogus we go back and zap you. (So you see, there is a way to get a couple days of free time.) 2. By charging a small fee, we can help offset the cost of the resources used to maintain & back up the database. With the fee structure, no one will get rich or poor, but there is an increased likelihood that this database will be around for years. 3. By tacking on a few dollars to the initial fee, we hope to discourage people who would fail to maintain their data, and then drop out of the database, then re-join, then drop out, then re-join. 4. Every 5 months (or so), we email an invoice (typically for $5.00 US) for the next 5 months of service. This invoice must be printed and sent to us, with a check, via US mail. This procedure keeps all data reasonably current ( +/- 5 months), which is about as good as it's going to get for such a remote service. The point being, you can not just write a check for $50.00 and be covered for the next 4 years. --- Well, how much does it cost? --- Fee to add your data to the database: $4.00 US Fee to maintain your data: $1.00 US / per month --- Trivia --- - The database is meant to be hold REAL names, no aliases, anonymous, or otherwise bogus id's. - In order to search the database, users must themselves exist in the database. - The dataset you enter for yourself can never viewed as a whole. You are encouraged to enter data for previous & current schools, occupations & other organizations/institutions, but a match on a single item will not reveal the others. For example, you used to work at AT&T, and now you work for IBM. If an old friend was trying to track you down, they might search on parts of your First and Last Name and AT&T. If you were found, it would only show your one line entry corresponding to AT&T. The point being that although your data might be read as a personal resume, it won't be shown that way. Of course that won't stop your nosy friend from sending you email asking where you are working now. - People keep asking why the database doesn't have fields for phone & address. No! That kind of data is too personal for a large database like this. If you want someone's address, send them email and ask for it. - The searching criteria make it really hard to use this database for something like head hunting or generating a junk mail list (this is by design). --- Interface --- The interface is via email. This allows the database to span all services (cis, prodigy, aol,...) which have gateways to the internet. Also, it allows each user to craft their data with their own editor, in a flexible time frame. Searching the database via email, while very functional, is a bit more kludgy than is desirable. A searcher accessible via telnet will be put online once we get an idea of the bandwidth & cpu needs. It would certainly be cool to have interfaces to gopher and www also. Additionally, the future will make further use of PGP (ViaCrypt PGP in our case). --- How To Start --- Send Mail to: - sled(a)drebes.com subject 'info' for a (this) text - sled(a)drebes.com subject 'add' to add yourself to SLED - sled(a)drebes.com subject 'change' to alter your data - sled(a)drebes.com subject 'search' to search the SLED - bugs(a)drebes.com To report a bug. - comments(a)drebes.com To send a comment that isn't quite a bug. --- The End --- ------------------------------------------- From: mcb(a)umberto-eco.postmodern.com (Michael C. Berch) Newsgroups: ba.internet Subject: Re: NetPages Coming Date: 28 Feb 1994 03:07:20 GMT Organization: Postmodern Consulting, San Francisco, California USA Lines: 37 Sender: mcb(a)umberto-eco.postmodern.com Message-ID: <940227.185716.mcb(a)umberto-eco.postmodern.com> References: <mcculleyCLI2AI.DI9(a)netcom.com> <2k7a3b$lhp(a)usenet.ins.cwru.edu> NNTP-Posting-Host: remarque.berkeley.edu Summary: The SLED In the referenced article, cx132(a)cleveland.Freenet.Edu (Cliff Gillespie) writes: > [Response to Aldea NetPages] > Oatmeal! Not a flame, but this a pales in comparison to what the > folks running the SLED are doing. They have a setup where you > can store & search all sorts of stuff (where you sent to school, > where you used to live, jobs, books you've written, multiple > email addresses...), but only matched items are displayed. > You can send mail to sled(a)drebes.com with info in the subject > for a summary. I requested (and read) the SLED info file and was not that impressed. First of all, you have to PAY to be included in the SLED database. It is only $5 plus $1/month, which is not a whole lot, but the problem is that will so sharply limit the number of people who list there, so the value of the database is limited as well. And there is the pain-in-the-ass factor of having to pay them every few months or so. Plus, the SLED people seem to claim to be interested in subscriber privacy (by offering PGP [future?] and making the DB hard to make into a marketing list), yet seem to be totally anal-retentive about the DB being only "REAL NAMES", to the point of REQUIRING a real live personal check from you (not cash). There is also no provision for entering street addresses or voice telephone numbers, even if you WANT to, since they claim that is much too personal. Shouldn't users make that choice for themselves? This also makes the DB that much less useful, plus you have to search it BY EMAIL only, which is slow and clunky. Thanks, but NetPages sounds more useful to me. Or even "whois", for that matter. (The SLED people also claim that to use whois you have to know someone's email address, which is completely bogus.) -- Michael C. Berch mcb(a)postmodern.com / mcb(a)net.bio.net / mcb(a)remarque.berkeley.edu --- END ---

1 0

pgp and multiple recipients
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

Hi, pgp allows to encrypt a message for multiple recipients by listing all recipients at the command line arguments. If there are no recipients at the command line, pgp asks for the recipient. Is there any way to give multiple recipients to this question? pgp doesn't separate on comma or space. I need this for calling pgp in a script where it is difficult to put the recipients into the command line. Thanks Hadmut

3 2

standard for stegonography?
by marc＠tanda.isis.org 17 Dec '03

17 Dec '03

Jef Poskanzer <jef(a)ee.lbl.gov> writes: > Is there a standard for stego yet? I just added stego and de-stego Given that the whole object of steganography is to hide the very existence of a message, wouldn't a standard be counter-productive? Cheers, Marc --- Marc Thibault | Any warming, global Automation Architect | or otherwise, is Oxford Mills, Ontario, Canada | welcome. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQA9AiyT2YcAAAEBgKVboQejsR2t2U70HoWOXTIqlWUCRGkTht8Yn/4kuzWby/e3 Z9tT8RHJbAx9us7QZwAFEbQdVGFuZGEgTWFpbCA8bWFyY0B0YW5kYS5vbi5jYT4= =aFhG -----END PGP PUBLIC KEY BLOCK-----

1 0