December 2003 - cypherpunks-legacy

FW: your financial transactions posting (fwd)
by Light Ray 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 29 Dec 1995 00:02:50 -0800 From: Bud Aaron <bud(a)checkmaster.com> To: "'privacy(a)ftc.gov'" <privacy(a)ftc.gov> Cc: "'hwg-business(a)daft.com'" <hwg-business(a)daft.com> Subject: FW: your financial transactions posting ---------- From: Greg Metcalfe[SMTP:biosphere@proaxis.com] Sent: Thursday, December 28, 1995 9:35 PM To: bud(a)checkmaster.com Subject: your financial transactions posting Bud, I've seen some well thought out messages in the commercial transactions listserver, but you are the first that I've seen with real numbers. Would you do us all a favor and make sure that you get some of this information to the privacy(a)ftc.gov discussion? I hope I'm not impertinent for asking. But numbers are probably our only hope. The gov has never really been into quantitative thinking... TIA --- Greg Metcalfe | The secret is getting E-mail biosphere(a)proaxis.com | enough sleep. URL http://www.proaxis.com/~biosphere | Usually. The following is a copy of the information mentioned above: The following article is quoted directly from Bank Technology News "Are Internet Security Fears Unfounded? Just how safe is the Internet? Pretty darn safe, according to Forrester Research, Inc., Cambridge, MA. Forrester predicts Internet fraud will occur far less frequently than current rates of fraud with cellular telephones, toll calls and credit cards (see chart). Cellular telephone fraud costs the phone industry almost $20 per $1000 in revenue, Forrester says, and toll-call fraud eats up $16 per $1000 in revenue. Meanwhile, credit-card fraud cost MasterCard almost $1.50 per $1000 in revenue in 1993. In contrast, Forrester says companies can expect to lose only $1 per $1000 of transactions on the Internet. Forrester's contentions on the safety of the Internet are backed up by some of the judges in this year's Best of the Newest bank technology survey. While many of the judges expressed concern over security issues, quite a few were also confident that the Internet will become a stalwart transaction system. See page one for further analysis of all the newest banking technologies." The chart accompanying this article shows the fraud levels in graphic form. You folks keep making drafts as a collection system seem more and more attractive. The fact that drafts MUST be deposited (not just cashed) and that the bank is going to want to know the depositor quite well means that tracking is excellent. The requirement added by the FTC that those whose accounts are being drafted must be notified by mail makes the system even safer. Let me add this - some level of security is obviously needed but regardless of the level of security, fraud will occur. All of these arguments for high levels of security remind me of the need for virus protection. Yes, virus attacks are real but virus protection vendors certainly make money by raising greater fear than may be realistic. Bud Aaron bud(a)checkmaster.com http://www.checkmaster.com/internetchecks/ The privacy list is run automatically by the Majordomo list manager. Please mail questions/problems to owner-privacy(a)ftc.gov

1 0

Revocation of Zimmermann's fossil key
by Philip Zimmermann 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- To whom it may concern: I have revoked my oldest PGP key, keyID FF67F70B, user ID "Philip R. Zimmermann <prz(a)sage.cgd.ucar.edu>" which should no longer be used. Instead, use my newer key, keyID C7A966DD, with user ID "Philip R. Zimmermann <prz(a)acm.org>" The new key has been distributed with all PGP versions since version 2.3a in 1994. My old email address at the sage site will soon disappear, so I'm revoking my old key. I keep getting mail at my old address at sage because people get that old address from my old key. I can't just revoke my old userID, so I have to revoke the whole key to get people to stop using it. Below is my revocation certificate, which I created shortly after I generated my new key in 1994. Please discontinue the use of my old key and my old email address. Note that this revocation does not imply that my old key has been compromised. -Philip Zimmermann prz(a)acm.org Here's my old public key with the revocation certificate... - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAipt8iwAAAEEALGKgLblEQCfcZEiQ+jBFnw5g0B+o16GMPssYBKI7bWgjGbB DqnkQoMGagNJpcG5tX2bKpJdegi01Sp22QOMpZbdrv/KXRWHp/JjrNLAZHp9B+nl osbRrPLhGZZA/OgyU6D2GsGnMDcTacPD43wo1g+RUpDv+UjMr+J13g7/Z/cLAAUR iQCVAgUgLIUrAOJ13g7/Z/cLAQHThQP+NtEJ2yPCXPA+Em45HDWQLwb3X0AM61K0 Mt0Woq54eaC1U5A03oVqV5wEPM6mfrhH18FB6NwO5eROKOdXY1xz7nCggJ9eYfoX ZH6wfXCqGFSB4oLJU97nFHrqvh69IYSrrlKM/dJ29F5CKVxJApstpnRmfHddrZLP yfR2y6dxGeW0LFBoaWxpcCBSLiBaaW1tZXJtYW5uIDxwcnpAc2FnZS5jZ2QudWNh ci5lZHU+ =9UCt - -----END PGP PUBLIC KEY BLOCK----- Here's my new public key, generated in May 1994... - -----BEGIN PGP PUBLIC KEY BLOCK----- mQCNAiv8ZoAAAAEEAKc4d45hN5qFM79nWGLkrGWputWmtdxJk0BZEbi0kNRbJBC2 p10ASImd//cCDwLR2alBUSt8O2WGik9PBZgthjMOenoDmzKiG8BkE9AFKonyxvD2 lDnqbydXi+YQmOTsWSw4jTTSb3cflhVkf8hVUVpMFQThafV0CmV5hLjHqWbdAAUR tCJQaGlsaXAgUi4gWmltbWVybWFubiA8cHJ6QGFjbS5vcmc+iQCVAgUQLB48XPTK AIGN5yLZAQHWtwP/RBiLPN4dnt8sm9qZtK0HPYV0hfdZ4IiSfR0V52uKKMQsIrBJ x2c5Z2vurBLeKkh8Oecf/X+Zh2mEenrymR/urBCf8xGQnyTPew4t/3IQ5KXsqi2b uOTysk9Pkk+cqxZTEXJQWixB3fVKrCkR02xbWcRXQ/pPs0ObOE4VLtQT1G2JAGAC BRAsHUvayj2h/YZap/MBAcRRAliFU3EgFQdOGkC2nCupBAitm/R6CkKtayTZHQrd e5I/pCY0bGUc6alEnSuqZUyA9HC1fMg0iqsqM4vrQ6PZr2qV0IXDY4miyYNRJyKJ AJUCBRAr/GdG4nXeDv9n9wsBAYr/BACh4r3DZsq9IOy2mcd+0D0qKV0Ymb887Lw0 KjIBKLmUIqXUw2Rbn8bAnr+GF0qGE61oAHdSSN7pLROmfjl7nMVaODXHOxYuLHAn HZ0Z/AQsLc5U055Pm6rQ5lKrSaL4z9mEKJTWM9hQDYMZpH4oAC8hIz+apYH+/hBj ZR9w7AKluw== =1jM9 - -----END PGP PUBLIC KEY BLOCK----- -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMOOo+WV5hLjHqWbdAQHhaQP/SW02cLbkAtHq6cdNHtcJ4YqSlKqxumyR BYpjKrNatLiVAFQP8njiLRFqPi8rgf6809nnQETIVcyt3BzURakyJLd4UuL3vvqD lluyGdj9MoaQiQkWIbBMADFdNGFDvRCQkcxhS78hHwXSY7viCSWNnfCdJcpaFNCk QPfqPsMErMo= =uH7K -----END PGP SIGNATURE-----

1 0

Re: Employer Probing Precedents?
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:12 PM 12/28/95 -0800, Tim May wrote: >However, corporations aren't given the luxury of disassociating themselves >from the actions of their employees. (Contract workers are a further issue, >and the issue of whether they supply their own tools/computers, workspace, >etc., enters in.) I think this point about "contract workers" is going to become a lot more interesting as people move away from the traditional "employee for life" model and towards working at home/telecommunity, or working as subcontractors/consultants, etc. Further, it's becoming more common for employees to own their own communcations tools, and bring them to work. Arguments about a right to eavesdrop as being derived from workplace property ownership don't seem to work where an employee is talking on their personal cell phone, getting/sending messages on the SkyTel two-way pager that they pay for, using their laptop/Newton/PDA to get/send E-mail (using their private ISP/POPmail provider mailbox), and so forth. The concerns (about disclosure of secrets or wasting of time) raised to justify the invasions of employee privacy are still present, of course, but not the convenient "it's not your phone so you have no privacy" excuse. Employee/contractor ownership of work tools (or non-work related communication tools in the workplace) is probably going to get even more interesting; recent Ninth Circuit decisions re copyright law and licensing agreements have been sharply restricting the right of software licensees to allow third parties to use the licensed software. (e.g., _MAI v. Peak_ and _Triad Systems_, see http://darkwing.uoregon.edu/~gbroiles/triad for more on this and pointers to other analysis and the opinions themselves) I think this may lead to software licenses (or hardware ownership) which follows employees from home to work, and from job to job. Employees may get a credential from Microsoft, or Borland, or Mathematica or Word Perfect saying that they're allowed to be using a set of software tools; professionals will probably pay for those credentials themselves, or have them paid for as a fringe benefit of employment. An easy connection is to training related to the "software-right" - the licensor would also certify that the employee has been subjected to X hours of training and knows at least Y buzzwords and Z fancy tricks relating to the software. Retired or unemployed workers may work in a "black market", using software they're trained on but not licensed/certified for, logging on with the credentials of licensed users who have died recently or are sleeping. (Similar to the network of unlicensed uninsured under-the-table contractors, framers, electricians, drywall installers, etc., who exist at the fringes of construction activity.) And so on. >I maintain that my employees are beholden to me as to what they run on >their computers. They can always choose not to work for me. (And the same >applies to hotels, actually. Were a hotel to have stringent rules on >in-room behavior, such as the YMCAs and religious retreat hotels have, then >customers have little right to complain about bed checks, mixed sex bans, >etc. That most hotels have no such rules says more about where the >Schelling points are than it does about the efficacy of rules and laws. Subscribers to the Coase theorem would suggest that (modulo transaction costs) it doesn't matter who is initially assigned the right to determine whether or not surveillance will occur - the party who most values that right will bargain for it in the end. Then again, that party may lose something in exchange - and that's what makes this interesting. (And, I think, much too complex to simply be dismissed as a matter of "property rights". Then again, property looks to me like something that law creates, not something which exists pre-law which law is created to protect. YMMV.) I'd rather see the right to control surveillance assigned to employees, and let employers pay extra for it if they think it's necessary to their business situation. (Some might argue that this is the current situation, or at least that surveillance is something that market participants bargain over. My impression is that the current situation is legally murky absent a clear statement re "we're going to monitor you on the phone and search your briefcase when you enter and leave" and that a clear resolution re the legal baseline of surveillance would be useful to bargainers. And if we were to set a baseline for further bargaining, I'd rather see it set to favor employees.) -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

ideath remailer permanently down / PGP key changes for Greg Broiles
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I don't think that the local freenet folks are ever going to get my domain name again, so I'm officially announcing the closing of the remailer formerly located "remailer(a)ideath.goldenbear.com". Mail to the goldenbear.com domain has been bou for almost three weeks now, and I expect that to continue. Sorry for any inconve I predict about a year of erratic net access and moving around while I finish la school, take the bar exam(s), and find a job or get a business started. When eve settles down I plan to find a reliable net connection and run a remailer again. Due to the loss of my domain name and UUCP connectivity, other changes are happe I'm now using a Windows box, not a Unix box, for my net access; have switched to for DOS and Private Idaho (nice job, Joel!). Am also using a new PGP key, since my old one (0x58ddf30d) was almost 3 years ol updated the MIT PGP keyserver with an "obsolete" marker for the old key, as well new key (signed by my old key). The new key is appended to this message. Am using a new long-term E-mail address, "gbroiles(a)netbox.com". Re my discussion weeks ago of alternatives for mail storage/forwarding, I have settled on netbox. can receive mail as "gbroiles(a)darkwing.uoregon.edu" but I expect that address to working sometime this coming May. The netbox.com address will ideally keep worki years to come. - -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud | -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMOPafv37pMWUJFlhAQGnhAf/XrHe38eww+sMf0/mmqKFzT9xX9USCCBO 5yMteRAmAsEiiTo8TPcRPlB6eKqCrCiJJqDMfxm3UaWhhqBilRhQoB8BqdCvjTLY 87/HsHKV3Iv4IPvud+ojk9GEXwUf204U9m/CgVF17HKO+XTCK5GVN7gmsqWWxsLr a5gNccpentcFiy0KJVUWfLguOXA20I+nGnkZjMBK/RAPotBg4gezE2jqjbYyQ1rC y0SLX843ufEfRaePC1X8IyWH32gqiyrW5rZuTo8B2usbR96Y2VXXX6Oprrd5CD38 AuUhjkOXVEsCFVP5bt6uQbM81Uhvxc1mFYHYKKJyuWPWo5E6tBwXZA== =Heo3 -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAy8+sdEAAAEH/2YvMvdRxoxAIpNp1W88EGq4EMOVhpucjGjZByoJATpDoU+x sqZl6lwzWh7yhHbLfuUZhWZVhLlLGxOAcHkZ3o6Tao+T/qCLKUnyFtw3Q/Wpzfiw YIGbXkbKvSaI7U3PTMHraimiZNAW/QAhIuLanVEkl/rko/aIdvyIfOJSFHW9Bjml ArZmyrsT8PiA+Eiqa+JyRv/JnWiJJ00FYHhG1GkcAvBovQJxxLzqq9PcB8nVlVfS t4aV2z1OfmjXHq4pgUye6CwdjzXnMz3e70FT1erkoP+/iC56iSkb/4J67y8NnKgq RNQ8lt+X2+vnq3Fa8r8EhhqZFZcV/fukxZQkWWEABRG0IkdyZWcgQnJvaWxlcyA8 Z2Jyb2lsZXNAbmV0Ym94LmNvbT60KUdyZWcgQnJvaWxlcyA8Z3JlZ0BpZGVhdGgu Z29sZGVuYmVhci5jb20+iQCVAwUQLz8tYn3YhjZY3fMNAQGOkwP/cYeYdbTj9H0C BVI9nw70avUIGYUWT1HdQaK6YqdOvV4Eg56rpKdFEFlwUdOBg8MbuFaLMbbAnKxH EvGsQBtu0N1kyIebMAuEniT/22yVlVGHHS+uGxyBKq1i7Nv5uRXl2WSdQDUCHN0W 9YAzReRI1F6ExnVXJHuHo4EY7lQ3P94= =yJO8 -----END PGP PUBLIC KEY BLOCK-----

1 0

practical annoyances from multi-level security?
by Simon Spero 17 Dec '03

17 Dec '03

Does anybody have any pet peeves and gripes about using systems with a compartmentalised security model- things that took ages to do even though they didn't really impact security, features that just got in the way or were too complicated to really use, etc? I'm currently working on a problem that seems to have some analogies to the compartmentalised problem, running code with various levels of trust were deliberate read-up and accidental write-down could be a breach. I've personally never used a system of this sort, but I've heard from friends in the RAF doing COM/SEC (more COM than SEC) that MLS can be a real pain at times. [for the truly paranoid, the RAF operates a network of communication satellites called Skynet :-)] Simon p.s. still no luck on the Hackers soundtrack - I did recognise a few prodigy tracks though (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

CAV_ein
by John Young 17 Dec '03

17 Dec '03

12-29-95. NYPaper: John Markoff page-ones Compuserve's cave-in to Reich sex law and the alt free-screeching for sex home censorship cave-in to rutting parents ashamed. CAV_ein

1 0

Re: ideath remailer permanently down / PGP key changes for Greg Broiles
by Greg Broiles 17 Dec '03

17 Dec '03

Doh, the wordwrap on that message was ugly. Sorry. Gotta spend some more time making friends with Private Idaho. Short version: remailer(a)ideath.goldenbear.com is gone forever, sorry. All mail to anything @goldenbear.com is bouncing. Mail for me should be sent to "gbroiles(a)netbox.com", effective immediately. I have distributed a new PGP key to the keyservers and marked my old key obsolete. I will be signing list messages again once I get that wordwrap thing fixed. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

1 0

Chinese Cypherpunk quote [NOISE]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

I see that some rants here are rubbing off on the folks who write chinese fortune cookies, In tonites dinner, The cookie said: The will of the people is the best law. I wonder if we can get a couple thousand cookies sent to Congress with that message? A.E.N. or to T.C.M..... Xmas_Troll

1 0

Netscape 40-bit cracking. The new computing benchmark?
by Weld Pond 17 Dec '03

17 Dec '03

>From Infoworld Dec 25, 1995 page 3. Netscape Commerce Server Security Broken Integrated Computing Engines Inc. (ICE), in Cambridge, Mass. announced it has cracked the 40-bit DES [huh? not RC4] encryption in the Netscape Commerce Server. Unlike a similar security break-in [talk about bad terminology] by a French university student last August, which required eight days, 120 workstations, and two supercomputers, ICE said it used a computer that cost $83,000 and compromised the Wold Wide Web server's security in 7.7 days. [Hey, what about the Cypherpunks crack that only took 31.8 hours?] Netscape Communications Corp. officials were not surprised by the security crack. "We've known that 40-bit encryption is breakable since we shipped the server. That's the reason it's allowed to be exported," said company spokeswoman Rosanne Siino. "We need to keep lobbying to get rid of the U.S. governments 40-bit restriction on what can be exported." Within the United States, Netscape sells products with 128-bit encryption. Weld Pond - weld(a)l0pht.com - http://www.l0pht.com/ L 0 p h t H e a v y I n d u s t r i e s Technical archives for the people - Bio/Electro/Crypto/Radio

3 2

Re: Compuserve is Not "Censoring": Look to Governments for the Cause
by tallpaul＠pipeline.com 17 Dec '03

17 Dec '03

On Dec 28, 1995 23:30:19, 'tcmay(a)got.net (Timothy C. May)' wrote: > >I see a positive longterm trend toward people connecting through smaller, >more local services. > Quite correct. Not only does the internet radically change (at least perceptions) of space and time, it also is producing serious disequilibriums of scale in economics. Economy of scale states that until a farily high limit is reached, bigger enterprises tend to produce goods that are less expensive than those produced by smaller enterprises. Specialized handicraft production aside, the goods produced in larger enterprises also tend to be of higher quality. The disequilibrium here began with the development of the microprocessor as we see from the shift to the old centralized IBM iron to the microcomputers we're using today. Ditto certain aspects of network switching. Ditto DES moved from centralized hardware to decentralized software. We're seeing a growing dystopian world where national entities and non-governmental organizations all seek to enforce their particular cultural/political/economic/etc. biases on the global internet. I believe this process will continue for some period of time. At the same time we may (and I think likely will) see aspects of the net broken down into widely geographically separated locations that simultaneously have no more effect on end users than the floor at the central library on which the book we want resides. E.G. we'll use Denmark to get "alt.sex.granny.gum-jobs," ftp to Singapore for "/warez/microsoft/win99/hack/" and to the Turcos Islands for "data.finance.internal.morgan." We'll have all three open and on our monitor at the same time, passed through an second-level ISP in some small country that decides there's money in switching and will no more regulate data throughput than they would try to hold hotel keepers responsible for the content of the phone calls made by their tenants. --tallpaul

1 0