December 2003 - cypherpunks-legacy

Hardware generators was: your mail
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sat, 18 Jun 94 19:30:35 EDT, Adam Shostack <adam(a)bwh.harvard.edu> writes: > Making it PC only shuts out the Mac/UNIX market for your > devices. There are probably lots of folks in the research/scientific > community who use UNIX & would buy a random number dongle that hangs > off the serial port. For $25, I'd probably get our lab to buy 3 or 4. > > If you put it on a PC card, you're cutting out all other > computers from using it. Adam's points are correct, and I thought of them before I posted the initial message. My thinking was that about 90% of all computers sold are Intel PCs, and to get my manufacturing costs down, I need volume and simplicity. So by addressing the 90% solution first, I have a larger market without the complexity of multiple platforms. Once I've sold thousands of Hardware random number generators, then I can afford the design effort for other platforms, if they still exist then :-) Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

5 5

rec.radio.scanner #7670 - Re: OJ's Cellular
by smb＠research.att.com 17 Dec '03

17 Dec '03

This article, reposted with permission from rec.radio.scanner, sheds a bit of light on the topic. In article <2u47fl$18no(a)hermes.acs.ryerson.ca>, cal(a)ee.ryerson.ca (Calvin Henry-Cotnam) writes: > > I just heard an interview on the radio with a representitive from the > "umbrella group" that represents the cellular industry. He explained > how position tracking is done, and stated that call content is not > involved. A court order is needed to track position, but another court > order, presumably one more difficult to get, is needed to intercept the > conversation. The location tracking basically locates which cell site > the call is being picked up by plus monitoring of actual signal strength > which usually can get to within a mile of the location. The original poster mentioned that he's not an expert on cellular; the person he cited is from an ``''umbrella organization'' for the cellular industry in D.C.

1 0

Re: Decline and Fall
by dmandl＠panix.com 17 Dec '03

17 Dec '03

At 8:55 AM 6/19/94 -0700, Sandy Sandfort wrote: >Chomsky's error is that he equates governments with democracy. Not true. Chomsky is an anarchist. He would never make a statement like that. Just for the record... --Dave. -- Dave Mandl dmandl(a)panix.com

2 1

Re: Hardware generators
by Pat Farrell 17 Dec '03

17 Dec '03

In message Sun, 19 Jun 94 10:50:14 EDT, Adam Shostack <adam(a)bwh.harvard.edu> writes: > Understood, but its not a matter of addressing 90% or the > other 10%, its a matter of "Is the security gain in building a card > that only hands out each number once worth cutting out 10% of the > market?" I think that if you are worried about rouge code on your > machine, you aren't going to run on a computer that can't protect its > memory from random browsing. (I can still access all of a PC's memory > from normal code, can't I?) Thus, building a PC card doesn't really > afford you a gain in security if I can use my hostile code to read > PGP's memory locations. If you agree with that, then there is no good > reason not to build a serial port dongle, and include me in your > potential customers. :) I think I'm a bit confused. Your first post suggested that I was ignoring an important part of the market, and I acknowledge that this was delibrate. Now you seem to be arguing that the paranoia that I addressed in my fourth question is justified. I'd like more backup for this, as all I have is speculation at this point. I don't know if it is paranoia or prudence. Yes, if you are running DOS/Windows, you can address the world. Sigh. And lots of other/better OS fix this, but they haven't got the market penetration. So I'm back to addressing lots of folks, or a few ones with real computers and real operating systems. I'd rather not degrade into that religion, I started with TOPS-10 and moved to Tenex... The problem with the serial port dongles are: 1) while parallel port dongels are known technology, making it work on a serial port is more problematical. 2) Most PC serial ports are junk. Getting reliable data rates above 2400 baud is non-trivial for low end PCs. If I could claim that the users had to have 16560AFN uarts, or better, then I could get decent rates, but then I lose market size. 3) PCs typically don't have a spare serial port. It is interesting that my mail is so far favoring an internal board approach. Given that, and the forthcomming Plug-n-Plan spec from Microsoft/Compaq/Intel/... and the hidious hassles of seting up IRQs, port addresses, etc. Does this suggest that a Plug-n-play board would be more attractive? The key is that they would be more expensive, at least at first. Compaq probably has the volume that can allow the cost difference to be offset by lower tech support costs. I haven't got that volume yet. Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

2 1

Didn't anyone note the A5 posting?
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

Didn't anyone notice that someone posted a putative source code for the secret A5 algorithm as used in GSM phones? (It was on sci.crypt xposted to uk.telecom, on Friday). Seems someone was going to give a talk on ways of hacking the algorithm, at some university, and he got stomped on by CGHQ. So another guy has come out in sympathy and posted his reconstruction of the algorithm in C as reverse engineered from a hardware description he received in a plain brown envelope! This is *significantly* more of a coup on the net that the NSA handbook. Now, all I need is for you guys to explain coherently *why* it's a good coup and what the political implications are, and I'll feed the story to the UK press. (I don't think anyone here has it yet...) G

1 0

mail hacking
by perry＠imsi.com 17 Dec '03

17 Dec '03

Some nice person today decided to hack my mail account at the free software foundation to assure that all my mail in the world would bounce. There have beens some complaints recently from others that I know about similar activities of late. I would say that people should watch out for this sort of thing. Perry

1 0

e$, Liquidity, and Economic Granularity
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Flame-bait warning. The last week or so, I've been trying to cobble together some business models for electronic commerce, particularly how the banking system fits in. I'm posting some of the more far-out stuff for discussion here. To get here, I've had to thrash some stuff that's probably obvious to the cypher-gerontocracy. I beg their indulgence in advance, because some of the stuff I'm going to yak about probably has been been said here numerous times in prehistory. I'd like pointers to those discussions, FAQs(?), etc. as I couldn't find specific mention of them in the file heirarchy at soda. As it is, I've bumped into some interesting stuff to me, and thought I'd share... Hokay... Here goes. One of the things I like about e$ is that strong crypto provides the linkages to disperse it into quite small units and still reunite quite usefully into big batches for the purposes of financial markets. This is necessary, because like all technology, successful new stuff usually creates a superset of the old stuff. It has to offer the same functionality and add a significant improvement. Here's how. Let's start with where people keep their money. It can be said that given the size of a bank's average retail demand deposit account, and the interest and fees on those accounts, it might at some time behoove people to keep their disposable money *in cash* on a personal hard drive somewhere, probably at home, and probably backed up offsite for security. The principal reasons that people have checking/savings accounts these days are pretty much as follows: 1. to protect that money from theft, 2. to be able to conveniently safely spend that money in small increments with checks or with ATM cards, 3. (recently) to be paid through direct-deposit mechanisms, 4. to get interest on the money while it sits there. I think that reasons 1,2, and 3 can be taken care of with e$ protocols, and that for most demand deposits, 4 is not meaningful because fees outweigh interest most of the time. You might as well keep your money at home. Like a lot of other things, retail demand deposits are largely an industrial phenomenon. With e$, information technology does to banking what it did with the industrial telephone network. A heirarchical network is replaced with a geodesic one, and demand deposits, except as concentrator points for large institutional cash distributions, cease to be meaningful in an economic sense for individuals. When people accumulate surplus money (:-)) and want to sell that money to an entity in the financial community, the transaction can be taken care of with automated secure transmissions of e$. Organizational concentrations caused by efficiencies of scale would tend to dissapate as well. Imagine if Peter Lynch's replacement(s?) could run Magellan as he saw fit and had all his fund concentration and distribution activity taken care of automatically without the cost of the Fidelity administrative armature. He'd still drive a multi-billion dollar fund. His customers would still hold shares of Magellan. However, those customers would be doing business with an automated digital cash transaction server, which would take their money or redeem their digital shares of Magellan for it's current market value following whatever redemption criteria exist in the funds prospectus and deposit agreement. The disbursement/concentration code's already there in Sybase and on the Heavy Iron (yes, it's still there...). The user interface just needs changing. With a digital cash transaction server, there is no need to train a cast of thousands of clean-scrubbed young econ majors to answer the phone. (Fidelity Joke: "Camp Fido. It's a great place to work if you're parents can afford to send you there.") Grove's Law tells us the iron keeps getting smaller. So, our Lynch-analog could (in theory) have a small cash transaction server handling his client relations while spent his time looking out the window at Marblehead, at his Quotron-replacement, or at his collection of Ren-n-Stimpy cartoons. With e$, the capital markets could still operate the way they always do, but with more functionality. The growth of communications technology originally allowed financial information to move more quickly. Then, centralized information technology allowed transactions to be processed more quickly. Finally, distributed information technology allowed decisions to be made more quickly. The increased functionality contributed by strong crypto enables decision-making ability to be pushed out of investment firms and onto the network, the same way that automated switching technology created more more nodes in the telephone network. Here's how that could happen. Most serious individual equity investors know what p/e ratios and book values are, and what they mean. Software can allow them to understand and manipulate fixed-income concepts like duration, convexity and total return. This means that people can do more and more sophisticated things with their money and get better returns. The first limitation for sophisticated individual transactions is small transaction size. However, it's possible to see how if they're trading on their own, investors could take "physical" delivery of e$-based investment instruments. A person's "portfolio" could consist of various "securities" physically resident on a storage medium that they physically control. Because of the automation of transactions allowed by this kind of "physical delivery", the minimum certificate sizes could come down for the most common securities. For uncommon securities or market strategies, it is possible to envision the ability to anonymously concentrate large purchases of various positions, much in the way odd-lot trades are consolidated in the equity markets today. The second limitation is the ability to securely communicate these transctions with the markets. I suppose that's a straw man to those on this list, but as you've probably guessed, this is the most important part. Strong crypto allows you to send money and money equivalents over the network with the confidence that it doesn't get waylayed. Thats *real* important for the efficient function of capital markets. ;-). I bet that the roles of the really important players in the capital markets won't really change much. Portfolio managers still function like editors. They add value by synthesizing information. The people on the sell side, the investment bankers, securitizers, and pool-builders, etc. all still create securities so that markets can cope with technological change in information technology. (A charitable way of looking at *those* guys, anyway...) The thing that holds this all together is strong encryption and it's various offspring, including digital cash and other forms of e$. This crypto-stuff has a lot of really spiffy applications in finance and financial operations. I *love* this place.... ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Having your own computer means never having....
by Jonathan Rochkind 17 Dec '03

17 Dec '03

> Beyond that, unrestrained encryption is dangerous to corporations, > because what's to stop a ticked off employee from encrypting > everything in the office as revenge for some imagined slight? If the bozo has write-priveledges to everything in the office, sounds like a problem with or without encryption. Or were you just suggesting that he was going to encrypt it all and mail it to a competitor? This too seems to be a problem with or without encryption; he can just copy to floppy and snailmail to a competitor. Same with industrial espionage of just about any kind; sure it makes it _easier_ for the hypothetical spy to do his dirty work, but it doesn't actually enable him to do anything fundamentally different then he could before. I can't think of any real security risks introduced by allowing employees the use of encryption, that weren't present already. Certainly none mentioned thus far fit the bill. Obviously properly used encryption can enable the corporation to keep info in the "hands", of only those people who are supposed to have it, actually. Although of course I'm not accusing you of suggesting that corporations shouldn't have access to good cryptology; you probably wouldn't be on the list if you thought that. I'm not completely sure how different it is to say that individuals give up their right to good cryptology upon being employed by a corporation, however.

2 1

MAIL: anon mailing list
by Karl Lui Barrus 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Has anyone tried to write some mailing list software that uses > PGP-anon-remailers to implement a double-blind anon system? > a standard mailing list. But has this already been done? It seems > like such an obvious idea, that it's hard to believe no one has > thought of it first, but I haven't heard of anything so far. Comments? Well, Hal Finney offered a service by which people could subscribe to an encrypted version of this list... which is something similar. Say somebody wants to run a mailing list as you propose. I think they should just run the list at the same address unless the remailers can suitably pad, delay, and randomize incoming messages and redirect them to the true list site (but then delay and randomization may lead to loss of coherency on the list ;). If not, surely external observation of the contact point will show where all the messages are headed. The resources needed would be higher than a normal list since each incoming message would need to be checked for a digital signature (or the list could become victim to an anonymous mail bomber, and you can't filter out anonymous remailers since of course everybody is using them to submit posts!), encrypted to every other member, and remailed. Which isn't to say impossible, just maybe impractical for a large mailing list. Take this list, with say 500 members - every incoming post digitally signed and arriving via anonymous remailer, and upon arrival, checked for a valid signature, encrypted with the public keys of the pseudonyms subscribing to the list;), and remailed out... This may work if you have a small group of people dedicated to this setup, but otherwise, no go. I mean, most people on this list don't even sign their posts, most don't submit via anonymous remailer, etc. It would take much work to make it convenient enough to do this. I think a higher priority is finding the bug that keeps unsubscribing everybody ;) Karl Barrus klbarrus(a)owlnet.rice.edu -----BEGIN PGP SIGNATURE----- Version: 2.6 iQCVAgUBLgTdeMSF/V8IjI8hAQHeTwQAjDPXzJgrwubLkxq0Kz6ETM7chR4Ci5kG XbzWrFc3jwT57xpOfHIeeTTWn73Sls7C5UsFAT1sE4hxHRZO2HG6a7psLRa5/82V bhjnW+6KMOByCZb01h4b0toVR+7vF22EzPME0lnlsW+SjBqlAcNYPb+rSnjbnahG g9zzaCL6nJ8= =1WIZ -----END PGP SIGNATURE----- -- Karl L. Barrus: klbarrus(a)owlnet.rice.edu 2.3: 5AD633; D1 59 9D 48 72 E9 19 D5 3D F3 93 7E 81 B5 CC 32 2.6: 088C8F21; 97 73 9E 8B 98 3E DD B5 E8 97 64 7E 20 95 60 D9 "One man's mnemonic is another man's cryptography" - K. Cooper

2 1

Re: Another Cellular Victim
by Phil G. Fraering 17 Dec '03

17 Dec '03

I was on a trip out of town a while back... as soon as I crossed into another cellular network boundary, I got a call from the provider's sales droid, telling me how to use their service. They _are_ tracking individual phone movement, IMHO. pgf

3 2