December 2003 - cypherpunks-legacy

Re: AOL monitoring
by stevenw＠iglou.com 17 Dec '03

17 Dec '03

>Ohhh-God, not again... > >Can anyone remember the Prodigy rumor? How IBM was snooping around >your hard disk, and it turned out to be nothing but a swapfile. Does >"Good times" ring a bell? And don't get me started on MicroSoft >Network rumors... > >1) 90% of the FTP sites I use mention that they log xfers. > >2) My .newsrc file can tell anyone that I read alt.hackers and alt.2600 > >3) My address book shows who I send mail often enough to warrent me > putting in a nickname. > >4) My sent-mail folder shows who I sent mail to in the past year. > >5) My bookmark file shows that I read the NYC-Speedtraps page one or > two time a week. Zterm and Anarchie both default to logging transfers. AOL on the Mac has a button on the download manager that lets you view a list of items you have downloaded. It's everywhere. ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more +1 415 390 9732 | than just a place to find pictures | of people having sex with dogs." stevenw(a)iglou.com | -- Time Magazine, 3 July 1995

1 0

Re: taxonomies of 'real money' and e-cash
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:33 PM 9/18/95, P.J. Ponder wrote: ... > Maybe I'm missing the larger point, but isn't it accurate that in the >digital world, one protocol or procedure may take the place of perhaps >several of the 'real-world' procedures or protocols? An effective >mechanism of signing with non-repudiation that was recognized as binding >on the signer would permit 'checks', 'promissory notes', 'IOUs', and I wasn't saying they are all on the same footing, or are all separate and compartmentalizable things. Clearly some of them are just slightly different "flavors" of other things. I listed a bunch of them not as a taxonomy or ontology, but as an illustration that there are many kinds of financial dealings, many kinds of roles played. That the real world has so many flavors of financial things could of course be due to inertia and ignorance, partly. But there are also different functionalities, and costs. Fitting the different needs, the different roles of the players. I won't go on and on, as my last post on this I think hit the main points, but consider how many flavors we have just of "checks": the "ordinary" checks we write, counter checks, dual-endorser checks, traveller's checks, and so on. (If you are arguing that only "digital cash" is a real issue, and all other constructs are "small matters of programming," then we disagree profoundly.) >'warrants'. Some of the other species listed in your post aren't really >money, anyway. They are things you can buy with money, like stock >certificates or Maseratis. One could conceivably buy convertible >debentures with e-cash, the same as one could buy them with 'real money', >but it doesn't follow that there should be some one-to-one mapping of real >money objects and classes onto electronic analogues. Once again, i've >probably missed the forest, but a couple of the trees distracted me. I don't get your point at all. I didn't claim they were all "money," whatver we may mean by _that_ loaded term, but that they are "things" with important features. And even your example of a thing like a "stock certificate" is not quite as simple as a thing like a "Maserati." My belief is counter to yours: I believe many or even most of the financial things and instruments we deal with today will be mapped into "digital economy" versions, albeit with new wrinkles and perhaps new names. (I could cite many examples of protocols that cannot be automated for use by agents if the only carry-over is "digital cash." Voting of shares, endorsements on instruments, various kinds of guarantees, reputations, and so on.) --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Caribbean Internet Services?
by tcmay＠got.net 17 Dec '03

17 Dec '03

A brief note, though the hardship to the Caribbean islands will not be brief. St. Thomas, St. Croix, and other islands were hit extremely hard by hurricane Marilyn. Previous hurricanes, including Luis, also hit some of the islands. Power in St. Thomas may not be back for a year in some parts. The roads, sewers, power lines, phone system, etc. will likely have to be completely rebuilt. (Yes, there have been more hurricanes this year than in most years...not clear if it's just a Poisson fluctuation, or symptomatic of deeper weather pattern changes.) ObCypherpunks Relevance: A couple of past or current list members have nascent Internet plans in some of these islands. (I think one of them is way south, just off Venezuela.) I suspect "Caribbean Data Havens" and "Internet Sites" are further off than they were a few months ago. --Tim May ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

3 2

Re: PGP for Linux 1.2.8
by David K. Merriman 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 04:39 AM 9/19/95 +0000, you "wrote": >Attachment Converted: D:\DOWNLOAD\MIME\RePGPfor.8 > I, for one, don't need Mystery MIME Attachments cluttering up my drive. If it's worth saying, then *say* it. Thank you. Dave Merriman -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMF49HsVrTvyYOzAZAQE9aQP+JYa+eglyQCWWHxt5AexhapWyURziXX31 UN97I287MtJw62us1Usr3rpgSbm/7C1LaIZP4ucY0rEXXfvSRzbOPnaa0nPb18e/ Axf/5RzjsrgjvHiXsXm8e2/7z6fe+dByA6qSKLaE77yOkKNEoEPbUeJrjzX7PKSR qLFotWpaYvs= =VGzR -----END PGP SIGNATURE----- This is a test (3 UUE lines) of the unconstitutional ITAR - 1/713th of the PGP executable. See below for getting YOUR chunk! ------------------ PGP.ZIP Part [015/713] ------------------- M=$<(&L`#*IPP",(G6(,,S,`P](<2RWU96XCW86/JBYV8A\D8@X'HB_9H#&\X MX'PCUB.,13B"X8`R?^J-:UB.M_`U\>[#)BS&5$0C,Y#^1CS>1`\T1QTXX6!3 M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/ <><><><><><><><><><><><><><><><><><><><><><><><><><><><><><><> My web page: http://www.geopages.com/CapitolHill/1148

2 1

Automatic E-Mail
by Rick.Sciorra＠hudson.lm.com 17 Dec '03

17 Dec '03

Does anyone know of an E-Mail package that will automatically connect to the Internet and retreive mail at specific intervals?

1 0

Brute Force and Smart Force
by Adam Shostack 17 Dec '03

17 Dec '03

I think its worth pointing out that instead of taking (arguably) $10,000 worth of computer time to brute force SSL, Goldberg-Wagner's attack exploits a weakness in the system to spend maybe a few dollars to crack it. Clever attacks on cryptosystems like this are the bread and butter of 'practical' cryptanalysis. It might take until slightly after the heat death of the universe to break IDEA or your 2048 bit RSA key, but there exist other attacks, and they are the ones which will be exploited. (Also, as Robert Morris pointed otut, never underestimate the time, money or effort your opponent will put into cryptanalysis. Cypherpunks, collectively, have put a great deal of time, effort, and CPU into proving SSL bogus, and I don't think anyone here made any money doing it.) Perhaps we should refocus our efforts on attacking PGP, to see if there are holes there? (I'm not suggesting there are, but it would be nice to see some code written to extend Crack to phrases, do some more code review, etc.) Adam -- "It is seldom that liberty of any kind is lost all at once." -Hume

3 2

VeriSign Introduces the First Digital ID Issuing Service
by Chris Claborne 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I thought the folloing would in interesting. It looks similar to what SLED whanted to do. Would be interested to see what their method of verification is. - ------------- [Begin forwarded message ] VeriSign Introduces the First Online Digital ID Issuing Service; Users Get Unique Digital IDs to meet the Security Needs of Commerce and Communications REDWOOD CITY, Calif.--(BUSINESS WIRE)--Sept. 18, 1995--VeriSign today announced the World Wide Web's first Online Digital ID Issuing Service. Being released in conjunction with Netscape Navigator 2.0, this service will allow users to directly enroll and receive their own unique Digital IDs. VeriSign defined today the class structure of its Digital ID brand of public identification certificates, establishing four classes of identification to meet the varying security needs within different environments. The service will begin Beta testing in late October. A company or a consumer will be able to get a unique Digital ID online through VeriSign's Online Digital ID Issuing Service located on the World Wide Web. A user can register for a non-commercial Class One Digital ID at no cost, or a commercial version for $6, through an online autoresponder. This unique Class One Digital ID is designed for casual World Wide Web browsing and secure e-mail and is used by Netscape Navigator 2.0 to allow users to communicate securely and identify themselves to other users, as well as merchants on the Internet. "The Online digital ID Issuing Service was created to provide a one-step process for obtaining a Digital ID for our corporate and individual users," said Stratton Sclavos, President and CEO of VeriSign, Inc. "We are offering non-commercial users Class One Digital IDs at no cost to introduce the concepts of authentication and privacy to the market. We will also offer higher classes online using higher assurance policies. We believe Digital IDs will help everyone in the online community safely conduct their business or personal transactions over public and private networks." Public identification certificates Working closely with application developers, service providers and affiliates, VeriSign issues and manages multiple classes of Digital IDs supporting a wide range of public identification certificate-enabled products like Netscape Navigator 2.0. VeriSign's public identification certificates can be issued for individuals as well as entities such as merchant servers. These public identification certificates, categorized into four classes with escalating levels of identity assurance, can be obtained from VeriSign directly or through the Online Digital ID Issuing Service. Class One Digital IDs: These IDs insure the uniqueness of a name or e-mail address. Class One Digital IDs are primarily used for casual World Wide Web browsing and secure e-mail. VeriSign offers non-commercial Class One Digital IDs at no cost or VeriSign supported commercial versions for $6. Class Two Digital IDs: These IDs provide a higher level of assurance regarding a person's identity by involving third-party proof of name, address and other personal information provided in the registration process. Class Two Digital IDs are primarily used for inter-company e-mail, online purchasing from electronic malls and online subscriptions. Class Three Digital IDs: These IDs further raise the level of identity assurance by involving personal presence or registered credentials. Class Three Digital IDs are used primarily for transactions demanding a higher level of assurance of the identity of an individual. Typical applications include electronic banking, large-sum purchases from electronic malls and membership-based online services. VeriSign additionally offers Class Three Digital IDs for electronic commerce servers such as Netscape's Commerce Server and Open Market's Secure WebServer. Class Four Digital IDs: These IDs are for individuals and companies requiring a maximum level of identity assurance. To obtain these IDs, the individual and/or organizations they represent is more thoroughly investigated and personal presence is required. Typical applications include access to confidential information, authorization to trade financial securities, and access to corporate databases. VeriSign is the only company 100% committed to the digital authentication market. Home banking, electronic payments, and subscription based services are some of the areas in which VeriSign is working, with clients that include NASA, TRW, Netscape and Apple. VeriSign's public identification certificates offer multiple levels of identity assurance. In addition, VeriSign is extending its certificate issuing technology to include new X.509 version 3 format, which greatly expands the flexibility and capability of Digital IDs. Navigator 2.0 users will be the first customers to receive version 3 compatible Digital IDs. Being X.509 compliant, VeriSign can include authorization parameters in a Digital ID allowing both corporate and individual users to customize them according to their electronic commerce and communications needs. X.509 certificates are becoming the internationally recognized standard form of "I.D." on public and private networks. Pricing and Availability Netscape Navigator 2.0 users will be able to download Class One Digital IDs from VeriSign's new Online Digital ID Issuing Service on the World Wide Web beginning in late October. Non-commercial Class One Digital IDs will be offered at no cost, or if users desire a VeriSign supported commercial version, the cost is $6 annually. Class Two Digital IDs are available for $12 annually. Class Three Digital IDs are available for an individual for $24 annually. Corporate site license discounts are available. Class Three Digital IDs for an entity such as a corporate server are available for $290 for the first Digital ID and $95 for additional IDs at the same site annually. To obtain pricing on Class Four Digital IDs users should contact VeriSign directly. VeriSign, Inc. VeriSign provides Digital ID products and services for the electronic commerce marketplace. VeriSign's Digital IDs play a key role in ensuring the privacy and authentication of electronic transactions and communications. VeriSign, founded in 1995 as a spin-off of RSA Data Security, is working with its investors including Ameritech and Visa International, and partners such as Netscape and Apple, to open the digital marketplace to all consumers. VeriSign's goal is to provide consumers with the confidence necessary to conduct electronic commerce worldwide. For more information, contact VeriSign at 415-508-1151, or visit their Web sit at http://www.verisign.com. Note to Editors: Copyright 1995 VeriSign, Inc. 100 Marine Parkway, Redwood City, CA 94065. All rights reserved. VeriSign is a service mark and trademark of VeriSign, Inc. Digital ID, Providing Driver License for the Information Superhighway and Certificate Issuing System are all trademarks of VeriSign, Inc. All other trademarks are properties of their respective owners. CONTACT: VeriSign Inc. Web Augustine, 415/508-1151 web(a)verisign.com or Niehaus Ryan Haller Public Relations Marcos Sanchez, 415/615-7912 marcos(a)nrh.com 07:35 ET SEP 18, 1995 -----BEGIN PGP SIGNATURE----- Version: 2.7.1 iQCVAwUBMF3nBFzvpSsKhLftAQHBSQP+PCmXw9P2EWjweTIWoT65BYKgmhnxZbx0 Ig0Zi7dVgFS+dIAxTnc23p4BBBapfZMrN2Ho/zhm7csPB4+XQ65y+vDVlDH8ehvA d/b7gAtsE9tOe1YglNeeNaxba/xB2OuGN6XJHH2A8wojIPw7ALK66XMPJ6YGn24T N7eychxo61A= =xgjH -----END PGP SIGNATURE----- ... __o .. -\<, Chris.Claborne(a)SanDiegoCA.ATTGIS.Com ...(*)/(*). CI$: 76340.2422 http://bordeaux.sandiegoca.attgis.com/ PGP Pub Key fingerprint = A8 FA 55 92 23 20 72 69 52 AB 64 CC C7 D9 4F CA Avail on Pub Key server. PGP-encrypted e-mail welcome!

2 1

Re: Automatic E-Mail
by Bill Stewart 17 Dec '03

17 Dec '03

[This isn't quite on topic, though you could stretch it to deal with remailers. Can the winsock remailer do this?] At 10:50 PM 9/18/95 GMT, Rick.Sciorra(a)hudson.lm.com wrote: >Does anyone know of an E-Mail package that will automatically connect >to the Internet and retreive mail at specific intervals? Sigh. Folks have gotten too used to PC-market email systems, which are generally braindamaged by having been around operating systems where you can't just run a listner program that waits for somebody to call you when they want to send you mail, which of course fits in very well with letting ISPs avoid having to make outgoing phone calls instead of just receiving, plus the market reluctance of many of them to forward mail for you to competing mail services and the client/server-orientation that makes peer-to-peer services harder to implement. Unix systems did this job just fine on PDP11/70s, which could support a dozen or two users on a machine with about the horsepower of a PC/AT. And Henry Spencer could do that on a /44 :-) Just about anything that does UUCP can be set to do that, if you've got an ISP who doesn't charge you lots extra for using UUCP. Most high-end terminal emulation packages have scripting languages that let you call up and do stuff, which you should be able to call from timer programs; you can probably even find a free Kermit version that will do it. I use Eudora Light with Trumpet to call Netcom's newbie-friendly Netcruiser service; when I hit the menu item for send or retrieve mail, it pops through all the layers and dials, and hangs up when it's done. If Commercial Eudora can't already do that automagically, it should - ask Qualcomm to add it to the next version... Alternatively, Winsock programming isn't really all that hard, and POP3 is a pretty simple protocol, so you could roll your own. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: MIME attachments and ranting.
by Bill Stewart 17 Dec '03

17 Dec '03

>> >Attachment Converted: D:\DOWNLOAD\MIME\RePGPfor.8 >> I, for one, don't need Mystery MIME Attachments cluttering up my drive. If >> it's worth saying, then *say* it. >I really don't know why any mailers call a monopart MIME message an >"attachment". Mail readers come in three basic flavors of unMIMEificationness: 1) Ignorance+bliss - the mailer doesn't know or care about MIME headers, and you can ignore them when you read them, and may be able to configure the reader not to bother you with most of them (e.g. BSD Mail.) 3) Intelligence - the mailer does something genuinely useful to help you read the attachment, like letting you pop up some appropriate reading tool. 2) Naive friendliness - the Sirius Cybernetics approach. "Your mail file has been tastefully shredded into little pieces and sprinkled around your disk drive. Thank you for making a humble mail system so _very_ happy." Free Eudora versions offer you several choices of tastefulness and shredditude, partly intended to provide artistic functionality and partly to encourage you to buy the commercial version which gives you a more flexible user interface for extensions like MIME. So buy it, or cope with it, or tell Eudora to use your RAMdisk for its attachments where they'll soon go away and not bother you. There's also another approach, typified by a vendor whose name will be omitted but they'd know who they were if they had a <perjorative deleted> clue.... 0) Downright hostile - Not only does it _pretend_ to be Intelligent, while only really doing the right thing with its own proprietary data formats*, though generally doing something reasonable with uuencoded documents with names that it understands, but it chokes and dies on messages that have even moderately large amounts of simple, basic, non-attachmentized _text_, and if you _do_ try to package text up to send to some poor sucker who's stuck with one of these <perjorative deleted> systems, it hands it to a brain-damaged user-friendly mouse-editor that _also_ chokes on more than 64KB of text.... [* where "the right thing" allows it to mindlessly run arbitrary code handed to it as macros in the proprietary data formats that the company encourages its users to use instead of real text....] #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0

Re: NYT on Netscape Crack
by Bill Stewart 17 Dec '03

17 Dec '03

> The New York Times, September 19, 1995, pp. A1, D21. > ...... > "The good news and the bad news of the Internet is that > when you put something up there, many more people can test > it," said Mike Homer, the vice president of marketing at > Netscape. "You also give yourself the opportunity of having > people point things out which you can fix quickly." That's a good, and realistic, attitude. > Netscape officials said today that they would strengthen > the system, by making it significantly harder to determine > the random number at the heart of their coding system. They > said they would no longer disclose what data would be used > to generate the random numbers. I do hope this is just John Markoff's simplification of what Netscape's folks said and not an endorsement of security-by-obscurity. I realize that some data does need to be kept around on disk or in the program, since obtaining a lot of random bits at the beginning of every transaction either requires annoying user interactions or takes too long to get decent quality, and certainly this data ought to be kept private by the algorithms involved. One concern I've had about the popular "crunch some bits repeatedly through MD5" approach to random number generation is that knowing one sample from the stream (e.g. by doing a transaction with the victim) gives you the rest of the stream. There's a way to improve that. let X(0) be some number you keep around from a previous session, modified by whatever hardware randomness is available, and seeded by user input the first time. let X(i) = MD5(X(i-1)) let Y(i) = hash(X(i)), where hash is something like MD5(key,X(i)) use Y(i) as the output random number. This eliminates the ability to determine X(i) or Y(i+1) as a function of Y(i), since the search space of X(i) is presumably too large to reverse (unlike the number of bits you can cheaply get in one session). Keeping some of the bits of Y(i) around to use in addition to the other key for the hash, or to key the MD5(X(i-1)) with, may be useful as well. #--- # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0664 Pager/Voicemail 1-408-787-1281 #---

1 0