December 2003 - cypherpunks-legacy

Re: rejection of CJR
by Peter D. Junger 17 Dec '03

17 Dec '03

I happened to speak to Mr. Capilino at the Office of Defense Trade Controls this morning, and mentioned that the Commodity Jurisdiction Request for the T-Shirt had been returned and read him the message to that effect. He told me that that was the wrong address for mail, since it was used only for currier deliveries, and that they have stopped accepting even currier deliveries there since the Oklahoma city bombing. He suggested that those who want to apply for the Commodity Jurisdiction determination should call him at 703-875-7396. He will fax the current information on how to submit a CJR to anyone upon request. He did not say so, but I rather think he looks forward to getting the T-Shirt request. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

2 1

Diane Rehm Show just ended
by Carl Ellison 17 Dec '03

17 Dec '03

You just finished a show on terrorism (WAMU, 10-11am, 10/26/95). Thank you. Some of your callers said most of what I would have said and I found that pleasing, since I wasn't able to call in. However, there was a theme which kept coming up and which wasn't addressed specifically. You might hold it in mind for future shows on terrorism: The FBI representative was saying that the goal is to *prevent* terrorism, not just to investigate and prosecute crimes after the fact. I heard Director Freeh (on 10/19 on All Things Considered) say something similar -- that the FBI's job was to protect the people (which can be be translated into "prevent terrorism"). This seems to be a major problem and perhaps the source of the concern about civil liberties. Terrorism might be a product of an organized, identified group and infiltration of that group might enable the FBI to prevent acts of violence. Of course, the permission to infiltrate suspicious groups has been used in the past to justify infiltration of non-violent but unpopular groups like the Sanctuary Movement. However, many of our recent terrorist acts appear to be the result of individual actions -- not those of organized groups. [Unabomber, OK City, train derailment] Infiltration is out of the question in such cases. The only way to prevent such acts is to put the entire population of the US under surveillance -- an authentic instance of Big Brother from 1984. The conclusion to me is that we can not task the FBI with the job of prevention of terrorism. I suspect that we must insure that the FBI is formally and carefully restricted to the job of investigating and prosecuting crimes once they occur -- allowing the threat of almost certain prosecution to serve as a prevention -- rather than with the impossible job of prevention of such crimes. ------------------------------ Meanwhile, there was one question I had that no one answered: I didn't like history much as a student, but I vaguely remember other periods of domestic terrorism: bombings in the early 1900s, acts of violence associated with the labor movement, sabotage during WW-I conducted by German agents. There may have been many others. This seems to be a feature of life -- nothing recent, nothing special, frightening from its news coverage but not a serious threat to any one individual (because of the actual statistics around the threat -- comparing my chance of injury due to auto accident, plane flight or terrorist act (for example)). It would be interesting to know why we had the pause in terrorism during the Cold War -- or, for that matter, if we actually did. Could it be that the apparent return of terrorism is actually a perception rather than a fact -- as a result of shift in focus of the news media? - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Usenet: pseudonymity's killer app
by pjm＠ionia.engr.sgi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Risks Digest 17.42 contains a Boston Globe story by Simson L. Garfinkel detailing the risks of the DejaNews (http://dejanew.com) Usenet archiving service. Not only does this service archive Usenet postings, it provides a "sophisticated system for retrieving 'author profiles' of the individuals who have posted messages." Many people are upset at what they view as an invasion of privacy. The article notes that: > But Usenet has actually been archived for a long time. Many schools, > for example, have backup tapes containing Usenet messages dating back > many years. Furthermore, says Madere, the National Security Agency and > possibly other law enforcement or intelligence organizations has been > cross-referencing and indexing Usenet for quite some time. "I know for > a fact that they do have a text retrieval database which contains > Usenet," says Madere. Creating a searchable index of Usenet " was > already done for what people might consider to be sinister purposes," > says Madere. "What we have done is made it searchable for useful > purposes." DejaNews will be archiving the alt, talk, and soc groups beginning later this year. That could result in many more people becoming upset at the service. It would appear that ISPs could make money from offering anonymous or pseudonymous accounts to their customers who would rather not have their postings used by marketers, employers, or neighbors. Providing protection from junk mailers is also more politically defensible in this society than providing protection from the government. This could be the catalyst for widely used and accepted pseudonymity on the net. Patrick May -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMI/tze5Yg08fDKehAQHUiwP/ePOJeQ5+R0+h0QQVJEziWFZvz0qCMooA 6jQXjDxWpxydas+KYCe9dt2yekjsh3Lr/bc+VHDtuTuE4l+m3HIFqk7uWxYk7iB6 fjIhuPMcmVSIg+lPOTFIlhfypmwE/6c4FHXiGb6N02Pc5E22BJFjECOdx1RNlJwv A8DbV/lAyGI= =FjnE -----END PGP SIGNATURE-----

2 1

MD5 and ITAR questions
by Simon Spero 17 Dec '03

17 Dec '03

I can't remember the exact details, so could someone give me a quick refresher- which of the following are considered ok under ITAR? MD5 as a checksum keyed MD5 for authentication keyed MD5 as a stream cypher Thanks Simon --- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

[Dr. Fred] [FRED] (was: Re: Fred, Fred, Fred: Enough already!)
by Herb Sutter 17 Dec '03

17 Dec '03

At 07:51 10.26.1995 +0800, James A. Donald wrote: >At 11:58 AM 10/24/95 -0400, Robert Hettinga wrote: >> Can we please talk to Dr. Fred, the Poster Child of the Informal Fallacy, >> if we *really* have to, off line? > >Yes, please, will everyone please killfile Dr Fred. I am tired of seeing >things that are glaringly obvious explained in painful detail to someone >who is reluctant to understand them. At the very least, please put "Dr. Fred" or "[FRED]" in the subject line so my filter hits it ("Fred" alone is too general). Thanks. :-) Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

_______________________ Copyright EMAP Computers, 1995 Network Week, London, Vol 1 No. 8, 25 October 1995 Page 1 Lead Electronic cash card system faces possible legal action MONDEX BLOWS USERS ANONYMITY By Gavin Clarke and Madeleine Acey Mondex faces possible legal action after admitting transactions made with its supposedly anonymous electronic cash cards can be traced. Launched in December by Natwest, Midland and BT, the electronic card was promoted as easy to use and as anonymous as cash, with no trace being left. It was perceived that a significant percentage of the public avoided credit and debit cards because they preferred their spending habits to remain private. Simon Davies, Visiting Professor of Law at Essex University, has lodged a complaint with the Trading Standards Board demanding that Mondex change either the retailers card readers or its promotional material. It has been revealed that the readers keep records of up to 500 cards identities. The customers can keep a record of ten transactions. The retailer sends the money to the bank through a 9,600 modem-based Mondex phone Rob Jameson, Mondex project manager for the pilot in Swindon, said we can certainly trace where cards have been used. There are degrees of control that Im not prepared to discuss. There are other mechanisms in place but I dont want to go into that. Davies said this contradicted previous Mondex publicity material. It said In everyday use Mondex transactions are anonymous, just like cash A Mondex spokesperson denied last week that the company said its card offered anonymity. But the same spokesperson said in February 1994 that the cards anonymity would appeal to those with a cash psychology, such as cab drivers and other cash-in-hand business people. Mondex entered a new phase last week with the launch of specially designed public telephones that will allow its 8,000 Swindon trial customers to re-load their cards from their bank accounts. The Data Protection Registrar said people using Mondex and other smart cards should be made aware of the uses to which their card information will go. ---------- Photo of Mondex promotional material and caption : Mondex card use can be traced, despite claims of anonymity. ends --

2 1

A real payoff of the export-SSL bruting.
by Peter Trei 17 Dec '03

17 Dec '03

I know of two companies which are developing products incorporating cryptography. At both, the original plan was to distribute only a weak exportable version. Marketing & distribution didn't want to deal the hassle of stocking different versions, and worried that the export version would be seen as inadequate. Since the bruting of export SSL by the cypherpunk's key-cracking ring, this policy has changed. It is now clear that the exportable version can be cracked, and probably will be cracked, with all the bad PR that entails. Both companies now plan to release export and domestic versions. (Some overseas sales are better than none, and not everyone needs or uses the cryptographic capabilities). Speaking only for myself, Peter Trei ptrei(a)acm.org

1 0

Re: [Noise] Perrynoia in the Comics
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:05 PM 10/26/95, Alan Olsen wrote: >At 08:13 AM 10/26/95 -0400, you wrote: >> >>Alan Olsen writes: >>> This has no real crypto relevence, but some anarchistic relevence. >> >>Alan; >> >>As much as I found the comment interesting, it probably belonged >>somewhere like libernet-d, not here on cypherpunks. > >I posted it on Cypherpunks becuase it is the only list I take where such >political views are even mentioned. I thought that people on the list would >enjoy it. I prefaced it with [noise[] so that people who would object would >skip over it. Evidently that disclaimer is not enough anymore. I found Alan's comment about the comics interesting, as even Alan's critic apparently did, and hardly harmful to the overall noise level. It gave in a short snapshot a vignette of "pop culture" views of surveillance. At less than 1% of the size of the latest EPIC crosspost to our list (or was it EFF, or VTW?) it hardly will affect the list in any significant way. Many of us have posted movie reviews, book reviews, even mentions of Alison Armitage sightings. The list is more than just about Java and Netscape, though newcomers may not know this. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: newsweek oct 30 Levy digital cash article
by cman＠communities.com 17 Dec '03

17 Dec '03

[stuff about losing e-cash] They already point out that you shouldn't hoard money on your own machine. I've been doing what I can to pitch in and help out, including some suggested edits to their materials. Here's my suggested rewording of that section: ========= Ecash that you keep on the hard drive is like cash. It can be erased accidentally in the event of a hard drive crash or other system problem. While we do have safeguards against this, there is a possibility you could lose money if your ecash files are lost. Money in the Ecash Mint is also like cash. Although the Mint is well- secured and maintained by computer professionals, it is a new, somewhat experimental system. Also, it is connected to the Internet. While we have taken many steps to ensure the Mint's security, we cannot at this time make the same guarrantees we'd make for a regular bank account. Because of these factors, we strongly urge you to keep your balances in the Mint and on your hard drive fairly low. A good rule of thumb is to have no more money on your personal computer than you'd be comfortable carrying in your wallet in a typical American city. Don't leave more money in the Mint than you'd be comfortable leaving stashed in a drawer in your house. ================

1 0

idle CPU markets
by Wei Dai 17 Dec '03

17 Dec '03

With many high speed personal computers on the Internet and the deployment of low transaction cost Internet payment schemes, it seems inevitable that markets for idle CPU cycles and memory will develop. An interesting problem is to try to predict who this market will benefit, and what the market will be used for. So far it seems that cryptanalytic problems (e.g. factoring and brute forcing of keys) have the highest marginal value/MIPS among problems amenable to loosely coupled distributed computation. However, I think it would be wasteful if the demand in idle CPU and memory markets were to be dominated by cryptanalysts since (non-academic) cryptanalysis is basicly a zero-sum game. When a key is broken, no wealth is created, rather it is transfered from the owner of the key to the cryptanalyst. What other problems would benefit from easy access to lots of distributed CPU cycles? Wei Dai

2 1