December 2003 - cypherpunks-legacy

Re: Java & Netscape security [NOISE]
by schampeo＠imonics.com 17 Dec '03

17 Dec '03

<plonk>! I'm so tired of listening to this no-researching, no-paying-attention, out-to-make-money freak I just can't stand it. Consider Mr. fc(a)all.net hereby removed from my mailbox by virtue of the autofiltering capability of my lovely mailreader. Fred: *RTFWP* and stop complaining about things you know nothing about. Feh. Steve -- Steven Champeon (919) 469-7833 Technical Lead, schampeo(a)imonics.com Imonics Web Services webmaster(a)imonics.com

2 1

Security via Sounding Impressive
by szabo＠netcom.com 17 Dec '03

17 Dec '03

I've notice an interesting pattern in how security mechanisms are named. On the one hand, we have some security features with very impressive sounding names: Certification *Authority* *Authorization* *Trusted* Server *Master* Key etc. These words fill most people (many on this list are exceptions) with awe and good will towards the feature so named. They also make good channel markers, pointing out the _insecure_ parts of the system. The effect is to cover up the lack or inadequecy of a mechanism with invocations that put your brain to sleep. This is quite lucrative for marketing purposes, but it works on many designers of security features as well! On the other hand, when we isolate the actual mechanisms of a system are in fact mathematically secure, we get names like: Encryption Blinding Message Digest Mix Capability These are just plain, boring words, with no connotation that we should trust them like we trust our big brother. They just work. Nick Szabo szabo(a)netcom.com Internet Commerce & Security consulting -- e-mail for details

1 0

Re: e$: Come aaaannnndddd Get it!
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:20 AM 11/17/95, sameer wrote: >> >> 3. The success of BankAmericard (later renamed Visa) came when real >> customers and real shops started to use it, not when early pioneers set >> themselves up as clearinghouses and whatnot. > > I'm sorry, but Community ConneXion is a real shop, with real >customers, selling real services, and we accept ecash. You guys are getting way too sensitive about all this. I'm in favor of real shops selling real things or real services. My point was that there is no compelling need to get people to sign up just for moral support. Lighten up. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Mark Twain Bank ecash scripts needed
by Bill Stewart 17 Dec '03

17 Dec '03

At 04:25 PM 11/16/95 -0700, Bryce wrote: >I am in the process of setting up a shop using Mark Twain Bank >Ecash. Could someone please forward me the scripts to accept Ecash >(running on SunOS. On c2.org actually) and/or any advice you have http://www.digicash.nl/mt/ #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

e$: Financial Cryptography for Dogs, pt. 2. OpenDoc Kitchen, anyone?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

As a result of my temporary notoriety as OpenDoc Futurist(tm) ;-), I've heard about something called an OpenDoc Kitchen, which is a periodic hack fest put on by Apple for developers of OpenDoc parts where code is actually written. My understanding is that this will be held at Apple, in Cupertino, in early December. They are especially interested in anyone from Digicash who would like to make a digital cash OpenDoc component for Cyberdog, because I've been ranting to them about this picture in my head of someone dragging digital cash icons onto a register icon in a web browser to pay for a purchase. I expect that *any* digital cash part, even some kind of bashing of the current Mac ecash client into an OpenDoc part, would be cool by them as a first start. In addition, it seems to me that we may be close enough with MacPGP 3.0 to play with it at the component level, but maybe not... If you're interested, e-mail me, and I'll put you in touch with the right people. Now, the invitations have already been sent and RSVP'd on this, so we'd be coming in through the back door. Obviously, we're looking to put the best foot forward, as they are just about to the point of believing my mantra of "digital commerce *is* financial cryptography". I'm hoping to go, if there's something to do. I couldn't code my way out of a paper bag, but like the immortal Chauncey Gardener, "I like to watch." ;-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Ecash account
by don＠cs.byu.edu 17 Dec '03

17 Dec '03

So who here is going to use their ecash account to set up a money lau^H^H^Hexchange service? Ob Cyphernoise: Would Dr Fred, Alice, and any other names LD has set up for himself lately please keep the noise limited to email? Please? Ob Plonk: amen. So let it be written, so let it be plonked. Don

2 1

Re: No Privacy Right in Indonesia ? (fwd)
by Charles Gimon 17 Dec '03

17 Dec '03

I spent several minutes resisting a followup, but if people are going to discuss, I have to cave... Forwarded message: > > At 05:54 PM 11/17/95 -0500, "James M. Cobb" <jcobb(a)ahcbsd1.ovnet.com> wrote: > > Activists in Indonesia who use the Internet say it is a power- > > ful tool for distributing information in a society where self- > > censorship abounds, newspapers are tightly controlled, jour- > > nalists are jailed and unlicensed magazines banned. > > The primary difference between Indonesian and Singaporean censorship > is that the Singaporeans are a lot more urbane about it, and generally > don't have crowds of protestors to shoot at. Reporting on the East Timor > activity is an especially good way to get kicked out of the country; > I know people it's happened to. Uncensorable communications can be > a substantial help, though rubber-hose cryptanalysis is still fairly > effective, and it's the type of place that would use it. > > A certain amount of US activism on the East Timor problems is Internet-based; > I don't know how connected it is to Indonesia or East Timor, which is > too underdeveloped to be very active on the net, and has the added problem > that activists are heavily watched. I'll try to keep this as short as possible... Almost anything on the Internet about East Timor is just crap. Get that out of the way first. I've put the entire Portugal domain in my kill file. It's like reading the lowest grade of anti-abortion rant from an AOLer. The issue under all the others is "what happens when Suharto dies". Lots of people, both in and out of power, are biding their time until Suharto leaves power. My hunch is that practically nobody in Indonesia has a PC at home like most US Internet users do. They're getting access through a company or university, or through a government office. A distributed network can resist censorship--but Indonesia isn't very distributed yet, and almost everyone is dependent on some sort of institutional access. Most people in Indonesia--including a lot of middle-class people--don't have a phone. You run down the street to a government Telkom office or a private Wartel office to make a phone call. Putting Web terminals in Wartels-- now *that would be a concept. If you dig into the UUCP maps for Java, you'll see a surprising number of sites listed in all sorts of little places. How many of those are up and operating, I have no idea. You are routinely warned that people at those sites are generally charged for receiving foreign e-mail, and that that can be expensive for them at current exchange rates. Private Internet providers (RadNet, IDOLA, IndoNet) have popped up only in the last year or so. I have links to some from my home page (http://www.skypoint.com/members/gimonca) As for the rubber hose...Indonesia is a fairly inscrutable country to try to figure out. They are quite capable of simply killing people if necessary; at other times, the wheels of justice turn agonizingly slow, and people are left free for the moment not knowing what might end up happening (a la Phil Zimmerman). My at-a-distance impression is that you see more of the Alabama-Sheriff's-Deputy kind of oppression than the Nazi-jackboot kind. Either way, it's millions of light years from the Libertarian Home World. Technology is a hot issue in Indonesia, partly because one of Suharto's favorite ministers, Mr. Habibie, is kind of a techno-nut, and has been pushing a variety of medium- and high-tech projects for Indonesia. Some people feel that he's being allowed to do whatever he wants, regardless as to whether his projects make any economic sense or not. After Suharto is gone, it will be interesting to see how high-tech stuff fares. In short, will Habibie end up giving it a bad name? Or will the technological middle class come to power and do it right the second time around? I'm going to stop rambling, and add something of more crypto-relevance. I've got an old article of mine about remailers in my web pages. (http://www.skypoint.com/members/gimonca/anonmail.html) I've talked it up in soc.culture.indonesia and soc.culture.malaysia. Later, sameer asked me to put a link to c2.org in there. Now, I'm getting a low but respectable number of hits on that page (30-40 per day)...so it's not out of the question that some of those Indonesian users might be finding their way to sameer's site for a badly-needed nym.

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by Bill Stewart 17 Dec '03

17 Dec '03

At 03:13 PM 11/16/95 -0600, Scott Brickner wrote: >The problem is that the non-encryption program must use the same >interface as the encryption program. Text compression is often cited .... >You'd need a program which not only *accepted* the additional parameter, >but also *needed* the second parameter. I confess I have some difficulty >thinking of one. If you support user-specified program/module interface which take arbitrary string-valued arguments (e.g. Unix-style stuff or objects), and you've got negotiation methods that can accept args, then you've got a very general system which they shouldn't be able to argue with - so the drop-in authors can hand the keys around as 0xHEX-strings rather than bignums without the program needing to know. Sorting and backup systems often want lots of options. If you decide for reliability reasons to insist on registered module names, to prevent problems like six different sorting modules with different argument orders, or backup modules with different ideas of "original" and "copy" (switching those two can be _Very_ annoying!), then there's even a mechanism which the crafty foreigner to distribute modules and documentation! >> An abstract set of open/modify/close >> routines (where open returned a pointer to opaque state, say a session >> key :) would be fine. #-- # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com # Phone +1-510-247-0663 Pager/Voicemail 1-408-787-1281

1 0

COMMUNITY CONNEXION BECOMES FIRST INTERNET PROVIDER TO ACCEPT ECASH
by sameer 17 Dec '03

17 Dec '03

For Immediate Release - November 17, 1995 Contact: Sameer Parekh sameer(a)c2.org 510-601-9777 COMMUNITY CONNEXION BECOMES FIRST INTERNET PROVIDER TO ACCEPT ECASH Community ConneXion today announced that it has become the first and only Internet Service Provider in the world to allow for payment using ecash, a digital cash system developed by DigiCash bv, of Amsterdam, Holland, released jointly with Mark Twain Bank, of St. Louis, Missouri. On October 23rd, DigiCash bv announced jointly with Mark Twain Bank that they would be issuing ecash denominated in real U.S. Dollars. In the past DigiCash had been running a trial "CyberBucks" payment system, which was not backed by any strong currency; it was a form of "Monopoly Money". The ecash system provides full payor anonymity. Consumers can use ecash tokens to pay for goods on the Internet, with full anonymity from the merchants. This lets consumers buy things without fear of merchants compiling and selling databases of their spending habits. It also allows for a convenient and safe mechanism for payment through the Internet. Sameer Parekh, President of Community ConneXion, said that ecash is a significant improvement over the payment systems widely in use on the net today. He described one example, "Currently people usually just send their credit card numbers over the net to the merchant if they want to buy something. This opens up the security risk of having the merchant's computers broken into; every consumer's full credit limits are then subject to attack. With ecash, only the limited sums that have been spent are at risk." Community ConneXion has begun accepting ecash as payment for its services, offering a five percent discount for customers who pay with ecash. "It simplifies our accounting and protects the privacy of our clients; it is to everyone's benefit to use ecash," said Parekh. "Ecash has greatly simplified account creation procedures for our anonymous accounts. In the past someone creating an anonymous account would need to wait until their payment arrived, and their check cleared, before the account could be created; now, the account is created automatically, immediately after the ecash payment is made over the world-wide-web." Community ConneXion is the leading provider of privacy on the Internet. They provide anonymous and pseudonymous internet access and web pages in addition to powerful web service, virtual hosts, and web design consultation. Information is available from their web pages at http://www.c2.org/. Information about the Mark Twain Bank ecash release is available from http://www.marktwain.com/ecash.html. DigiCash, CyberBucks, and ecash are trademarks of DigiCash bv. Mark Twain Bank is a trademark of Mark Twain Bancshares. Monopoly is a trademark of Parker Brothers, Division of Tonka Corporation.

1 0

No Privacy Right in UK ?
by James M. Cobb 17 Dec '03

17 Dec '03

Cypherpunks assume privacy is a good thing and wish there were more of it. --Welcome to cypherpunks Friend, 11 16 95 The Electronic Telegraph runs a newsstory headed Doorstep polish researcher was whiplash injuries spy Here are excerpts from the newsstory: Miss [Natalie] Goldner had been hurt when a car in which she was a passenger was hit from behind in April 1988, and she was forced to leave her video library job. Shortly after the accident, she started a claim for compen- sation and future loss of earnings against the Royal Insur- ance Company. ...Margot Christie...was working for the Hampshire Detec- tive Agency when she went to Miss Goldner's house in Octo- ber 1991. Christie posed as a market researcher. It was only when a compensation claim reached court that Miss Goldner realised the "researcher" was a private de- tective hired to discover the extent of her injuries. In a report which was due to go before the court, Mrs Chris- tie said she had asked Miss Goldner to test some polish and window cleaner. [Christie] returned 11 days later. "I asked the plaintiff if the polish had given a good shine and if she had rubbed hard. The plaintiff said 'Yes I did, it didn't smear at all'." Natalie lives with her mother. "I felt as though we had been burgled. I felt violated. We were so worried afterwards that we just didn't trust anyone who turned up at our door. "She asked lots of questions about who did the housework in our house. We were just chatting away and I had no idea she was there to spy on me." Natalie settled out of court. In September, she accepted a 20,000 [pound] settlement after one day of a planned four-day court hearing. She is to lodge a complaint with the Association of British Investigators.... Fortunately, the Daily Telegraph publicized the case. The news- story points out: A spokesman for Liberty, the civil rights group, said: "There is no right to personal privacy in Britain and so it [invasion of privacy by deception] is not against the law." Cordially, Jim NOTE. The Electronic Telegraph can be accessed at http://www.telegraph.co.uk The online filename of the above newsstory is: nspys16.html

2 3