December 2003 - cypherpunks-legacy

Re: Anonymous payment scheme
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 1:21 PM 1/2/95, Hal wrote: >I'm not sure what you do in this situation if they ask to see some ID >when you try to use the card. This would be rather embarrassing, it >seems to me. Sorry, I guess I left my drivers license in my other >pants... Or, never mind, try this card. That other one was from before I >changed my name... Why not, "It's a pseudonym."? Looks like an evangelistic opportunity to me. Pseudonyms can't be illegal, or Mark Twain and Bob Dylan would have written from prison. ;-). I also don't believe that you are legally required to produce ID for a credit card purchase. That was the point about those pictures on the front of Citibank cards. Citicorp did that to get around the legal restrictions on demanding ID to cope with the much larger issue of fraud. Most (smaller) vendors hardly check the signature on the back, much less validating it against a state ID, however. Hmmm. What if you produced a pseudonym card *with* your picture on the front? I smell a market opportunity. Or not... >And personally, I am more concerned about the >bank and gov't tracking my spending patterns than whether the guy I buy >gas from knowing my name. The bank has a lot more information about me >which is much more threatening to my privacy. A nom de guerre VISA or >debit card does not seem to help this problem. Indeed. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

Re: Why I have a 512 bit PGP key
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> A compiler can recognize one specific piece of code or a few > specific peices of code and do something perverse. It cannot > recognize functionally equivalent code, this > being a high order artificial intelligence problem. It's enough to recognize DES tables or PGP procedures. Hadmut

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail, which is available at: ftp://ftp.csua.berkeley.edu/pub/cypherpunks/premail/premail-0.30.tar.gz For the PGP public keys of the remailers, as well as some help on how to use them, finger remailer.help.all(a)chaos.bsu.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"vox"} = "<remail(a)vox.xs4all.nl> cpunk pgp. post"; $remailer{"avox"} = "<anon(a)vox.hacktic.nl> cpunk pgp post"; $remailer{"extropia"} = "<remail(a)extropia.wimsey.com> cpunk pgp special"; $remailer{"portal"} = "<hfinney(a)shell.portal.com> cpunk pgp hash"; $remailer{"alumni"} = "<hal(a)alumni.caltech.edu> cpunk pgp hash"; $remailer{"bsu-cs"} = "<nowhere(a)bsu-cs.bsu.edu> cpunk hash ksub"; $remailer{"rebma"} = "<remailer(a)rebma.mn.org> cpunk pgp hash"; $remailer{"jpunix"} = "<remailer(a)jpunix.com> cpunk pgp hash latent cut post ek"; $remailer{"c2"} = "<remail(a)c2.org> eric pgp hash"; $remailer{"soda"} = "<remailer(a)csua.berkeley.edu> eric post"; $remailer{"penet"} = "<anon(a)anon.penet.fi> penet post"; $remailer{"ideath"} = "<remailer(a)ideath.goldenbear.com> cpunk hash ksub"; $remailer{"usura"} = "<usura(a)replay.com> cpunk pgp. hash latent cut post"; $remailer{"desert"} = "<remail(a)desert.xs4all.nl> cpunk pgp. post"; $remailer{"nately"} = "<remailer(a)nately.ucsd.edu> cpunk pgp hash latent cut"; $remailer{"xs4all"} = "<remailer(a)xs4all.nl> cpunk pgp hash latent cut post ek"; $remailer{"flame"} = "<tomaz(a)flame.sinet.org> cpunk pgp hash latent cut post ek"; $remailer{"rahul"} = "<homer(a)rahul.net> cpunk"; $remailer{"mix"} = "<mixmaster(a)nately.ucsd.edu> cpunk hash latent cut ek"; $remailer{"q"} = "<q(a)c2.org> cpunk hash latent cut ek"; catalyst(a)netcom.com is _not_ a remailer. Last ping: Mon 2 Jan 95 6:00:02 PST remailer email address history latency uptime ----------------------------------------------------------------------- nately remailer(a)nately.ucsd.edu +++++++++++* 32:53 99.99% mix mixmaster(a)nately.ucsd.edu +++++++++-+ 41:39 99.99% rahul homer(a)rahul.net --***#***#** 9:40 99.98% penet anon(a)anon.penet.fi ********+*** 26:09 99.99% vox remail(a)vox.xs4all.nl .-..------- 12:53:05 99.99% soda remailer(a)csua.berkeley.edu .-.._-.-.. 8:50:49 99.67% usura usura(a)replay.com *****+- -- * 22:53 99.33% flame tomaz(a)flame.sinet.org ** *-*-*-** 32:52 99.09% jpunix remailer(a)jpunix.com ** *-#-*-** 32:26 99.06% c2 remail(a)c2.org --__.-+*--** 2:50:57 98.95% rebma remailer(a)rebma.mn.org ---*----* 7:52:32 99.27% ideath remailer(a)ideath.goldenbear.com ++* ++** - 2:09:26 98.05% bsu-cs nowhere(a)bsu-cs.bsu.edu +* --#+##** 1:40:45 96.01% q q(a)c2.org --_ . --+ 6:03:15 92.56% alumni hal(a)alumni.caltech.edu *****#*++ *- 27:00 89.60% portal hfinney(a)shell.portal.com #*#**#*** *- 21:31 89.60% extropia remail(a)extropia.wimsey.com +.-+* +++ 12:38:44 77.66% xs4all remailer(a)xs4all.nl *** *-- 20:22 75.57% desert remail(a)desert.xs4all.nl ----____.-- 40:43:30 71.96% For more info: http://www.cs.berkeley.edu/~raph/remailer-list.html History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). Options and features cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. oldpgp Remailer does not like messages encoded with MIT PGP 2.6. Other versions of PGP, including 2.3a and 2.6ui, work fine. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. special Accepts only pgp encrypted messages. ek Encrypt responses in relpy blocks using Encrypt-Key: header. Comments and suggestions welcome! Raph Levien

1 0

exponential relationship of crytographer and cryptanalyst
by Peter F Cassidy 17 Dec '03

17 Dec '03

- I'm writing a piece on the politics of surveillance/privacy technologies for OMNI, essentially a survey of their advance since the 1967 proposal for the National Data Center. I cover cryptography, deriving the narrative from Clipper Chip initiative. The point I'm trying to make is that given the market forces pushing commerce onto the public networks and the increasing power of available encryption, the cold war national apparatus will have to mobilize quickly a la digital telephony to stomp it - yet the nature of computing puts them in a loosing position in the long run. Toward the latter part of this thesis, I've been told - and want check with youz - of the exponential relationship of crytographer and cryptanalyst. The heart of this relationship has been explained to me as follows: Increasing the key by one bit effectively doubles the number of keys and proportionally increases the power required to break it in a brute force attack. Is this true? Is there a truer way of stating it? Are there complicating factors this excludes that I should discuss? - Regards, - Peter Cassidy

1 0

(Fwd) Re Anonymous posting
by John Young 17 Dec '03

17 Dec '03

For those interested in the anonymity issue there is a lively debate on list Cyberia-L (a legal list) which was stimulated, in part, by Peter Lewis's articles on anonymity and the LaMacchia case dismissal. For participation send message to: listserv(a)listserv.cc.wm.edu subscribe cyberia-l Your name Provocatively, I forward the following: Forwarding mail by: jsilverm(a)reach.com (Jared Silverman -- NJ Bureau of Sec. - Newark) on Mon, 2 Jan 11:58 AM ------------------- On January 1, 1995, Buford Terrell wrote: >Anonymity is very much a core 1st Amendment value and at the >center of both political speech and the right to assemble. [Snip] >Often times, the only way weak or unpopular minorites can speak >is anonymously. There have been many times when to couple one's >name to one's writings would be to invite martyrdom. I had >rather risk a few perverts than to stifle this most important >channel for dissent. It is one thing to claim First Amendment protection to shield political speech, IMHO it is another to shield fraud and criminal behavior. Besides the First Amendment runs against the government, not in favor of individuals in actions brought by private parties. In the sexism thread, would anyone claim that an individual has the right to harass or stalk a person under the guise of the First Amendment? Would the First Amendment be a defense in a defamation suit? Of course not (Times v. Sullivan aside). Doesn't an individual have the right to know the identity of someone who is trying to communicate with him/her on a private basis? To a certain extent, the question was crystallized in the caller ID debate -- Who has the superior right, the calling party to anonymity or the called party to knowing who is calling? One of the areas of my professional concern is the use of cyberspace for securities fraud and manipulation. Cyberspace is an ideal medium for these activities because of the availability of anonymity and pseudonymity. Even on commercial BBSs, where "member lists" are available, posting to these lists is voluntary and those who draw my attention are rarely on these lists. Does all of cyberspace become off limits to conventional private rights and law enforcement under the rubric of "freedom of speech and assembly?" |--------------------------------------------------------------| |A. Jared Silverman, Chief-New Jersey Bureau of Securities | |jsilverm(a)reach.com | 201-504-3600 (phone) | 201-504-3601 (fax)| |**************************************************************| | My purpose holds to sail beyond the sunset - Tennyson | |**************************************************************| |The foregoing is the personal opinion of the sender and is not| |the official position of either the Bureau of Securities or | |the New Jersey Attorney General and the Department of Law and | |Public Safety. Affiliation given for identification only. | |--------------------------------------------------------------|

1 0

Re: Anonymous payment scheme
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

Samuel Kaplin wrote: >Let's suppose myself and 10,000 of my closest friends form the First >National Cypherpunk Bank and Trust. We go through all of the hassles in >order to be the issuer of a Master Card or Visa. Now instead of having a >credit line, it is set up as a debit card. The card's limit is how ever >much you have prepaid the bank in advance. Once you have hit your prepaid >amount the card no longer gets approved. Now because everything is prepaid, >there is no risk to me, so I'll put any name you want on the card. The >questions I have are: > >Is this legal in the U.S.? > >If so, is anyone doing it? This type of card is issued with just about every checking accunt in Oregon. I don't know about other states, except that here in California I know of only two that are doing it: Charles Schwaab and Glendale Federal. There may be more, but I have yet to hear about them. In Oregon you get such an ATM/Visa card instead of your regular ATM card. Good credit, bad credit, no credit. Now if I could just remember what its called... -- Lucky Green <shamrock(a)netcom.com> PGP encrypted mail preferred.

1 0

Re: Anonymous payment scheme
by frissell＠panix.com 17 Dec '03

17 Dec '03

At 07:42 AM 1/3/95 -0800, bmorris(a)netcom.com wrote: >With a debit card you can't be anonymous, because your money resides in >the bank. With digital cash, and the ability to transfer money to >another digital cash card via phone lines, I don't see how they can >successfully trace everything. They will try, no doubt. Unless you open a bank account in a nome de guerre. In the Inter-mountain West and in small towns elsewhere, it is often possible even today to open a bank account with "soft ID." Such ID would include employment ID and student ID. Since anyone can be an employer or a school, anyone can issue such soft ID. These items work very well if backed up with a secured VISA card from one of the many issuers. Some of the issuers of secure credit cards want references but many will issue their cards if your name comes up as having no credit record. Made up people are the most likely to have no credit history. Even though a VISA card is not meant to be ID, most people (even state DMV offices) treat it as ID. DCF ************************************************************************* ATMs, Contracting Out, Digital Switching, Downsizing, EDI, Fax, Fedex, Home Workers, Internet, Just In Time, Leasing, Mail Receiving, Phone Cards, Quants, Securitization, Temping, Voice Mail.

1 0

Re: Anonymous payment scheme
by pstemari＠erinet.com 17 Dec '03

17 Dec '03

At 03:52 AM 1/2/95 -0600, Samuel Kaplin wrote: >... I was looking at at the bigger picture. Any merchant who accepts Visa or MC >could now accept anonymous payments. No hassle at all on their part. They >probably wouldn't even know that it was an anonymous account. It fits into >the existing infrastructure very nicely. If you can convince BankAmerica or MasterCard International to deal with you. > ... Walk into the issuing authority, plunk your $9999.99 on the counter and > ask for your card. When you've spent it all, toss the card. Right there you imply one of the requirements you'd need to fulfill--the reporting requirements on cash transactions over $10K. If you accepted many deposits over $5K, you probably get asked a lot of questions about how you're preventing people from structuring transactions to avoid the reporting requirement. --Paul J. Ste. Marie pstemari(a)well.sf.ca.us, pstemari(a)erinet.com

1 0

Anonymous payment scheme
by skaplin＠skypoint.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This idea just popped into my head, just as I was about to fall asleep. Being the idiot that I am, I had to get up to write it down. This idea has probably been presented before...but I haven't seen it here yet. Let's suppose myself and 10,000 of my closest friends form the First National Cypherpunk Bank and Trust. We go through all of the hassles in order to be the issuer of a Master Card or Visa. Now instead of having a credit line, it is set up as a debit card. The card's limit is how ever much you have prepaid the bank in advance. Once you have hit your prepaid amount the card no longer gets approved. Now because everything is prepaid, there is no risk to me, so I'll put any name you want on the card. The questions I have are: Is this legal in the U.S.? If so, is anyone doing it? If it's not legal in the U.S., is it legal anyplace else. If this is a gray area, why wouldn't this scheme work? If this scheme was set up, it appears to me that the infrastructure for anonymous payments/netcash is already in place. Of course the issuer would get a healthy fee for issuing the card...but then again, there truly is no such thing as a free lunch. As my 10,000 friends and I have no plans to set this up, feel free to pick it apart at will. (which I'm sure it will be) Sam ============================================================================== There is an order of things in this universe. -- Apollo, "Who Mourns for Adonais?" stardate 3468.1 ============================================================================== skaplin(a)skypoint.com | Finger skaplin(a)infinity.c2.org for | a listing of crypto related files PGP encrypted mail is accepted and | available on my auto-responder. preferred. | (Yes...the faqs are there!) | E-mail key(a)four11.com for PGP Key or | "...vidi vici veni" - Overheard Finger skaplin(a)mirage.skypoint.com | outside a Roman brothel. ============================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBLwe/6clnXxBRSgfNAQGZBAf9FAHHsI63OJ1uQo4SGAggs6Mk7BAe8Ysm oxibQfvNMN0dSPdyLjHutEm5/rtyTrRjU731QRQSDLUi0LSC9I0N5/cQsGeI+VV8 kAIiuHDq1eF4oZmZTuKIcKz42THliSAhSTkmpL8dZvcU3sJVPwIfGK5dNbQyUQHw J33h74Vg1jRIkeoodnAtTXPeUKi5HkcAp95zt8C/tGpke4+fx8QhqHSAvJgJoGdL a8clRTdilqwDfrdQlpgKHt33T5aLiYuQA8m9NpMiDKw/wEF+XvMrHYrksIUyQ2ZD gllxFl0WJcarRZTnIgtgAdA+hzQCbkfG10kcZUVTzquGcrgiKnp9ug== =l5Mr -----END PGP SIGNATURE-----

9 10

RFC: Key Capture Utility Survey
by KEY-CAPTURE＠lsd.com 17 Dec '03

17 Dec '03

REQUEST FOR COMMENTS ON KEY CAPTURE UTILITIES --------------------------------------------- Key capture utilities present a serious threat to the security of passwords on individual and networked computing systems, especially when novice users are unaware of their presence. Well-educated users and administrators help make all systems on and off the Internet more reliably safe for everyone's data. If you are a: -- privacy, system security or cryptography advocate/activist -- network admin concerned with the password-hygiene of your users or -- computing professional with an appreciation of good security, then please complete and return this quick survey. By contributing to the knowledgebase on the subject of password protection, you can help educate yourself and many novice/intermediate users about a common weakness -- utilities that may capture their keystrokes unseen as they enter their *password* -- in ALL secured systems (a user's encryption app, your network or its dial-in access, your company's email system or database fileserver, etc.). The intent here is to create a *central list of all key-capture utilities* which will help people to at least be aware of their existence or operation on a given system and describe in simple terms how to disable the utility. The results of the survey will be tabulated and put in the public domain on the Internet. If your reply is included, your name will be acknowledged in the resulting document, which will be: part of the new "Beginner's PGP FAQ" for new users of the PGP (Pretty Good Privacy) application; a msg posted on various Internet lists and online services and; a text file available by anonymous FTP as: ftp.netcom.com:/pub/dd/ddt/crypto/crypto_info/key_cap_util.txt Please forward this survey to anyone you think can/will help - and thanks in advance for your contribution! _______________________________ THE KEY CAPTURE UTILITY SURVEY: The survey is very easy to participate in. Just send as much information as you can, even if you're only partially able to complete the form. Every piece of information that can lead us to the utility - even just a fragment of a name and an email address of someone who might know more about it - will help us compile a fairly exhaustive list. To assist us in easily tabulating the incoming mail on this topic, please send your reply to: - - <KEY-CAPTURE(a)lsd.com> - - Format your answer as follows: ******* PLEASE RETURN ONLY THIS INFORMATION ******* TO: KEY-CAPTURE(a)lsd.com SUBJ: PLATFORM/Utility Name MSG BODY: [1] OPERATING-SYS <--- i.e. WIN/DOS/MAC/OS2/UNIX, etc. [2] "Utility-Name" (utility-package-name, if not a stand-alone product) [3] Developer-Name (company-individual) [4] <developer-email-address> [5] Type <--- i.e.: system extension, autoexec, TSR [6] Path-to-file-location-when-loaded. [7] How to disable the utility's key capturing operations (step-by-step if possible). Please be brief, but aim for a novice level user. If disabling the key capturing is too complex to describe easily, then just explain what the user should ask a sys admin to do for them (while they watch, if applicable). *************************************************** (Here's an Example:) SUBJ: MAC/Now Save MSG BODY: [1] MAC [2] "Now Save" (Now Utilities v5.x), "NowSave" (Now Utilities v4.x) [3] Now Software, Inc. [4] <support(a)nowmail.nowsoft.com> [5] System extension/Control Panel device (CDEV) [6] [startup HD]:System Folder:Control Panels:Now Save (or :NowSave) [7] How to Disable: Open the "NowSave" (v4.x) or "Now Save" (v5.x) Control Panel. v4.x: Click the "Preferences" button. Click the "Key Capture..." button. Click the "OFF" radio button (upper right corner of dialog). Click the "OK" button. v5.0: Click the "Key Capture..." button in the button-bar. Click the "OFF" radio button (in upper right corner of dialog). Click the "OK" button.

1 0