December 2003 - cypherpunks-legacy

exponential relationship of crytographer and cryptanalyst
by Peter F Cassidy 17 Dec '03

17 Dec '03

- I'm writing a piece on the politics of surveillance/privacy technologies for OMNI, essentially a survey of their advance since the 1967 proposal for the National Data Center. I cover cryptography, deriving the narrative from Clipper Chip initiative. The point I'm trying to make is that given the market forces pushing commerce onto the public networks and the increasing power of available encryption, the cold war national apparatus will have to mobilize quickly a la digital telephony to stomp it - yet the nature of computing puts them in a loosing position in the long run. Toward the latter part of this thesis, I've been told - and want check with youz - of the exponential relationship of crytographer and cryptanalyst. The heart of this relationship has been explained to me as follows: Increasing the key by one bit effectively doubles the number of keys and proportionally increases the power required to break it in a brute force attack. Is this true? Is there a truer way of stating it? Are there complicating factors this excludes that I should discuss? - Regards, - Peter Cassidy

1 0

(Fwd) Re Anonymous posting
by John Young 17 Dec '03

17 Dec '03

For those interested in the anonymity issue there is a lively debate on list Cyberia-L (a legal list) which was stimulated, in part, by Peter Lewis's articles on anonymity and the LaMacchia case dismissal. For participation send message to: listserv(a)listserv.cc.wm.edu subscribe cyberia-l Your name Provocatively, I forward the following: Forwarding mail by: jsilverm(a)reach.com (Jared Silverman -- NJ Bureau of Sec. - Newark) on Mon, 2 Jan 11:58 AM ------------------- On January 1, 1995, Buford Terrell wrote: >Anonymity is very much a core 1st Amendment value and at the >center of both political speech and the right to assemble. [Snip] >Often times, the only way weak or unpopular minorites can speak >is anonymously. There have been many times when to couple one's >name to one's writings would be to invite martyrdom. I had >rather risk a few perverts than to stifle this most important >channel for dissent. It is one thing to claim First Amendment protection to shield political speech, IMHO it is another to shield fraud and criminal behavior. Besides the First Amendment runs against the government, not in favor of individuals in actions brought by private parties. In the sexism thread, would anyone claim that an individual has the right to harass or stalk a person under the guise of the First Amendment? Would the First Amendment be a defense in a defamation suit? Of course not (Times v. Sullivan aside). Doesn't an individual have the right to know the identity of someone who is trying to communicate with him/her on a private basis? To a certain extent, the question was crystallized in the caller ID debate -- Who has the superior right, the calling party to anonymity or the called party to knowing who is calling? One of the areas of my professional concern is the use of cyberspace for securities fraud and manipulation. Cyberspace is an ideal medium for these activities because of the availability of anonymity and pseudonymity. Even on commercial BBSs, where "member lists" are available, posting to these lists is voluntary and those who draw my attention are rarely on these lists. Does all of cyberspace become off limits to conventional private rights and law enforcement under the rubric of "freedom of speech and assembly?" |--------------------------------------------------------------| |A. Jared Silverman, Chief-New Jersey Bureau of Securities | |jsilverm(a)reach.com | 201-504-3600 (phone) | 201-504-3601 (fax)| |**************************************************************| | My purpose holds to sail beyond the sunset - Tennyson | |**************************************************************| |The foregoing is the personal opinion of the sender and is not| |the official position of either the Bureau of Securities or | |the New Jersey Attorney General and the Department of Law and | |Public Safety. Affiliation given for identification only. | |--------------------------------------------------------------|

1 0

Re: Anonymous payment scheme
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Samuel Kaplin wrote: >Let's suppose myself and 10,000 of my closest friends form the First >National Cypherpunk Bank and Trust. We go through all of the hassles in >order to be the issuer of a Master Card or Visa. Now instead of having a >credit line, it is set up as a debit card. The card's limit is how ever >much you have prepaid the bank in advance. Once you have hit your prepaid >amount the card no longer gets approved. Now because everything is prepaid, >there is no risk to me, so I'll put any name you want on the card. The >questions I have are: > >Is this legal in the U.S.? > >If so, is anyone doing it? This type of card is issued with just about every checking accunt in Oregon. I don't know about other states, except that here in California I know of only two that are doing it: Charles Schwaab and Glendale Federal. There may be more, but I have yet to hear about them. In Oregon you get such an ATM/Visa card instead of your regular ATM card. Good credit, bad credit, no credit. Now if I could just remember what its called... -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Anonymous payment scheme
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 07:42 AM 1/3/95 -0800, bmorris(a)netcom.com wrote: >With a debit card you can't be anonymous, because your money resides in >the bank. With digital cash, and the ability to transfer money to >another digital cash card via phone lines, I don't see how they can >successfully trace everything. They will try, no doubt. Unless you open a bank account in a nome de guerre. In the Inter-mountain West and in small towns elsewhere, it is often possible even today to open a bank account with "soft ID." Such ID would include employment ID and student ID. Since anyone can be an employer or a school, anyone can issue such soft ID. These items work very well if backed up with a secured VISA card from one of the many issuers. Some of the issuers of secure credit cards want references but many will issue their cards if your name comes up as having no credit record. Made up people are the most likely to have no credit history. Even though a VISA card is not meant to be ID, most people (even state DMV offices) treat it as ID. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0

Re: Anonymous payment scheme
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 03:52 AM 1/2/95 -0600, Samuel Kaplin wrote: >... I was looking at at the bigger picture. Any merchant who accepts Visa or MC >could now accept anonymous payments. No hassle at all on their part. They >probably wouldn't even know that it was an anonymous account. It fits into >the existing infrastructure very nicely. If you can convince BankAmerica or MasterCard International to deal with you. > ... Walk into the issuing authority, plunk your $9999.99 on the counter and > ask for your card. When you've spent it all, toss the card. Right there you imply one of the requirements you'd need to fulfill--the reporting requirements on cash transactions over $10K. If you accepted many deposits over $5K, you probably get asked a lot of questions about how you're preventing people from structuring transactions to avoid the reporting requirement. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Anonymous payment scheme
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This idea just popped into my head, just as I was about to fall asleep. Being the idiot that I am, I had to get up to write it down. This idea has probably been presented before...but I haven't seen it here yet. Let's suppose myself and 10,000 of my closest friends form the First National Cypherpunk Bank and Trust. We go through all of the hassles in order to be the issuer of a Master Card or Visa. Now instead of having a credit line, it is set up as a debit card. The card's limit is how ever much you have prepaid the bank in advance. Once you have hit your prepaid amount the card no longer gets approved. Now because everything is prepaid, there is no risk to me, so I'll put any name you want on the card. The questions I have are: Is this legal in the U.S.? If so, is anyone doing it? If it's not legal in the U.S., is it legal anyplace else. If this is a gray area, why wouldn't this scheme work? If this scheme was set up, it appears to me that the infrastructure for anonymous payments/netcash is already in place. Of course the issuer would get a healthy fee for issuing the card...but then again, there truly is no such thing as a free lunch. As my 10,000 friends and I have no plans to set this up, feel free to pick it apart at will. (which I'm sure it will be) Sam ============================================================================== There is an order of things in this universe. -- Apollo, "Who Mourns for Adonais?" stardate 3468.1 ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwe/6clnXxBRSgfNAQGZBAf9FAHHsI63OJ1uQo4SGAggs6Mk7BAe8Ysm oxibQfvNMN0dSPdyLjHutEm5/rtyTrRjU731QRQSDLUi0LSC9I0N5/cQsGeI+VV8 kAIiuHDq1eF4oZmZTuKIcKz42THliSAhSTkmpL8dZvcU3sJVPwIfGK5dNbQyUQHw J33h74Vg1jRIkeoodnAtTXPeUKi5HkcAp95zt8C/tGpke4+fx8QhqHSAvJgJoGdL a8clRTdilqwDfrdQlpgKHt33T5aLiYuQA8m9NpMiDKw/wEF+XvMrHYrksIUyQ2ZD gllxFl0WJcarRZTnIgtgAdA+hzQCbkfG10kcZUVTzquGcrgiKnp9ug== =l5Mr -----END PGP SIGNATURE-----

9 10

RFC: Key Capture Utility Survey
by KEY-CAPTURE＠lsd.com 17 Dec '03

17 Dec '03

REQUEST FOR COMMENTS ON KEY CAPTURE UTILITIES --------------------------------------------- Key capture utilities present a serious threat to the security of passwords on individual and networked computing systems, especially when novice users are unaware of their presence. Well-educated users and administrators help make all systems on and off the Internet more reliably safe for everyone's data. If you are a: -- privacy, system security or cryptography advocate/activist -- network admin concerned with the password-hygiene of your users or -- computing professional with an appreciation of good security, then please complete and return this quick survey. By contributing to the knowledgebase on the subject of password protection, you can help educate yourself and many novice/intermediate users about a common weakness -- utilities that may capture their keystrokes unseen as they enter their *password* -- in ALL secured systems (a user's encryption app, your network or its dial-in access, your company's email system or database fileserver, etc.). The intent here is to create a *central list of all key-capture utilities* which will help people to at least be aware of their existence or operation on a given system and describe in simple terms how to disable the utility. The results of the survey will be tabulated and put in the public domain on the Internet. If your reply is included, your name will be acknowledged in the resulting document, which will be: part of the new "Beginner's PGP FAQ" for new users of the PGP (Pretty Good Privacy) application; a msg posted on various Internet lists and online services and; a text file available by anonymous FTP as: ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/key_cap_util.txt Please forward this survey to anyone you think can/will help - and thanks in advance for your contribution! _______________________________ THE KEY CAPTURE UTILITY SURVEY: The survey is very easy to participate in. Just send as much information as you can, even if you're only partially able to complete the form. Every piece of information that can lead us to the utility - even just a fragment of a name and an email address of someone who might know more about it - will help us compile a fairly exhaustive list. To assist us in easily tabulating the incoming mail on this topic, please send your reply to: - - <KEY-CAPTURE(a)lsd.com> - - Format your answer as follows: ******* PLEASE RETURN ONLY THIS INFORMATION ******* TO: KEY-CAPTURE(a)lsd.com SUBJ: PLATFORM/Utility Name MSG BODY: [1] OPERATING-SYS <--- i.e. WIN/DOS/MAC/OS2/UNIX, etc. [2] "Utility-Name" (utility-package-name, if not a stand-alone product) [3] Developer-Name (company-individual) [4] <developer-email-address> [5] Type <--- i.e.: system extension, autoexec, TSR [6] Path-to-file-location-when-loaded. [7] How to disable the utility's key capturing operations (step-by-step if possible). Please be brief, but aim for a novice level user. If disabling the key capturing is too complex to describe easily, then just explain what the user should ask a sys admin to do for them (while they watch, if applicable). *************************************************** (Here's an Example:) SUBJ: MAC/Now Save MSG BODY: [1] MAC [2] "Now Save" (Now Utilities v5.x), "NowSave" (Now Utilities v4.x) [3] Now Software, Inc. [4] <support(a)nowmail.nowsoft.com> [5] System extension/Control Panel device (CDEV) [6] [startup HD]:System Folder:Control Panels:Now Save (or :NowSave) [7] How to Disable: Open the "NowSave" (v4.x) or "Now Save" (v5.x) Control Panel. v4.x: Click the "Preferences" button. Click the "Key Capture..." button. Click the "OFF" radio button (upper right corner of dialog). Click the "OK" button. v5.0: Click the "Key Capture..." button in the button-bar. Click the "OFF" radio button (in upper right corner of dialog). Click the "OK" button.

1 0

Reminder: January 14th "Tools Demo Day" Meeting
by tcmay＠netcom.com 17 Dec '03

17 Dec '03

This is a reminder that the January 14th "Tools Demo Day" meeting is coming up, standard place and time at the Silicon Graphics building in Mountain View, CA. I described this several weeks back and asked for folks interested in demonstrating any sort of software tools, crypto code, languages, etc., to get in contact with me. One person, Henry Strickland (Strick), has done so. In any case, the meeting will go on. I'll have my PowerMac 7100 there, and will demo some things like Mathematica, SmalltalkAgents, MacPGP, etc. An SGI Unix box is of course available. An Intel box running something of interest will presumably be brought by someone. Anyone planning to demo something should either plan to run on a machine they know will be there, or bring their own. A video projector is sometimes usable, and I plan to bring my video camera. The idea is that laptops and other non-video out systems can still be seen by lots of folks. (Someone mentioned also that an LCD projector may be available.) The normal meeting time is 12-5, but people usually spend the first hour shmoozing and eating their burritos, so I plan on starting the formal meeting at 1 (but don't get there at 1 and _then_ expect to shmooze/eat for the next hour!). The machines should be ready to go by 1:30 at the latest, so that demos can begin. If we have a lot of demos--not likely based on current information--then I'll propose parallel tracks. Please don't be bashful about doing a demo! The idea is to educate and expose people to tools and software they might otherwise only vaguely know about. Demos don't have to polished and professional. And please send me a brief note if you want to demo something. --Tim May -- .......................................................................... Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)netcom.com | anonymous networks, digital pseudonyms, zero 408-688-5409 | knowledge, reputations, information markets, W.A.S.T.E.: Aptos, CA | black markets, collapse of governments. Higher Power: 2^859433 | Public Key: PGP and MailSafe available. Cypherpunks list: majordomo(a)toad.com with body message of only: subscribe cypherpunks. FAQ available at ftp.netcom.com in pub/tc/tcmay

1 0

RE: Reminder: January 14th "Tools Demo Day" Meeting
by Johnathan Corgan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Some may recall an idea I wrote about a couple weeks ago to provide transparent encryption/signing/remailing facilities to users of Windows Sockets based mail agents on PC's (e.g., Eudora). I have completed an initial portion of the program as a "proof of concept." All it does right now is act as a SMTP server and accepts mail from a mail agent, performs requested encryption/signing operations on received messages, and puts RFC 822 compliant outbound messages in a directory for submission to a 'real' SMTP server. (No remailing features present). Of course, the next module to write is the SMTP client that takes this outbound message queue and sends it off to the actual SMTP server. It is a bare bones app with no user interface, fault tolerance, or configuration options, and probably only works on my machine at the moment :) I don't expect to make any significant progress on the program between now and the Jan. 14 meeting, but if anyone is interested I will bring it to the meeting and "demo" what little there is at the moment. == Johnathan Corgan "Violence is the last refuge of the incompetent." jcorgan(a)scruznet.com -Isaac Asimov WWW: ftp://ftp.netcom.com/pub/jc/jcorgan/www/homepage.html -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwhxw+lPfVlQ1n99AQH6CAf8DJmXqtuP24C39k3/qk4mRuGxm4IehWdQ zdFjTgrzMuTXuM4SOtkV1k+JGZrjAW5G+tqiNLbNHDDzCWC/75G/8HMjUdWMSINq gOHXUl3oKtm6R27ClGhIZKuWJwLF0UH4XpUDWvawj5lFdWhKmSThuuF3WG1RKivQ PZjRh6Iq7wHf9wFI+rFRi8UHu311ZcyW4jR4h5R7siFeTd9GcBCEJ9CCQy+j+Vsu AbplhNZVztooLVitsAkYdcNu2gcAdun5u7WOPuEIM/Mwsokg53z4+AoUrYCkjqmu sqeAVr/S+1fwKXjMTSxt7qpIEUkErzTzhgQeQgLWYcUcnHg71A8AiA== =rOcl -----END PGP SIGNATURE-----

1 0

key servers list
by dave.hodgins＠canrem.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Does anyone have an up-to-date list of pgp keyservers available? Is there a fingerable keyserver, like wasabi(a)io.com used to be? Thanks in advance, Dave Hodgins. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBLwh0YJbACHtihSGlAQGxAwQAmCTfolPaXfyRIKWl+u8fzSrlLxv25GjB k/+50n11ErwRbJHRPsSAS8okZ9xq8CiVuCUiiOdFe3R7K3idCLVSVQeYWpBcy7ZO F1vUqcUrsqiar3IxUDAW0UAK5eIf/B5CIsN9TgYMxj7gd0r1UkSXjfgXq+PR9Iqf tMyBOICzwpU= =4FTc -----END PGP SIGNATURE----- **EZ-PGP v1.07 --- * RM 1.3 00820 * Internet:Dave.Hodgins@Canrem.com Rime->118 Fido(1:229/15)

1 0