December 2003 - cypherpunks-legacy

Re: Cypherpunk Certification Authority
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Is this another one of those LD tentacles? ;) Must that or a spoof of somekind... "She" didn't sign it, and "she" claims to have issued a signature... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Electronic Commerce CFP for Special Issue in _The Information Society_
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text <many sniped mail headers later...> Dear Colleague: You may be interested in submitting a manuscript for review for the following special issue on Electronic Commerce. Rolf Wigand * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * CALL FOR PAPERS For a Special Issue on 'Electronic Commerce' The Information Society (An International Journal) -------------------------------------------------- _The Information Society (TIS)_ journal is inviting authors to submit papers for review on the topic of 'Electronic Commmerce' for a special issue to be edited by Rolf Wigand, Syracuse University. The paper submission deadline is January 15, 1996. Electronic transactions are now common place in the business and government environment in the industrialized world. In the United States alone, over 50 % of all companies are exchanging data electronically while engaging in accounting, controlling, production management, funds transfer, record-keeping, purchasing and selling activities. Consumers too use various information technologies daily to buy products via their credit cards, to transfer funds, to buy stocks, and to browse through electronic catalogues. We are entering a new era in electronic commerce characterized by firms and customers conducting business on the Internet spontaneously, on a 24-hour basis and worldwide. With the phenomenal growth of the Internet a unique and new electronic market place is evolving. Various estimates (ranging from 10 million to over one billion) have been advanced in terms of the total number of people who will be connected to computer networks as they expand to include telephones, televisions, computers, as well as a range of intelligent devices such as the 'market choice box'. Electronic commerce is expected to grow in various forms such as electronic data interchange and various multimedia services such as interactive television and home shopping, multimedia kiosks and cable-based video-on-demand services. Off-shoots may be desk-top video-conferencing and computer networks affecting the way we communicate and the overall need to travel. When overlaying and projecting many of these and future electronic commerce activities on the envisioned National and Global Information Highway, it is indeed astonishing to fathom the future potential for commerce and economic performance. At the same time, however, we can recognize potential social, organizational and societal limits and dysfunctions. How is the availability and use of the Internet changing commerce as we know it? Given many uncertainties, how can we reliably and empirically estimate the number of potential electronic commerce users on the Internet (in an effort to separate grounded analysis and projections from hype)? Will electronic markets provide new areas of opportunity for retailers, producers and consumers? How will future traffic on the Information Highway affect each segment of an industry value chain? How will such forseeable developments impact the consumer and society in general? If electronic markets lower transaction costs for producers and retailers, will consumers gain by accessing manufacturers directly via market makers? What do electronic commerce developments mean from a marketing perspective and for customer relationships? What are the impacts of the emergence of widespread information technology use and worldwide electronic networks (e. g., the World Wide Web) on electronic commerce and markets in general? Can we envision electronic forms for payment such as digital cash on the Internet? What may be the potential impact of electronic cash on the economy, banks, and nations' equivalent of federal reserve systems? What is the role of government in electronic commerce developments and what policy directions ought to be addressed? This special issue intends to embrace a wide and rich array of electronic commerce issues. We would like to focus on "commerce," not just transactions, implying that commerce denotes a larger process including aspects of information seeking and distribution, negotiation, trust, risk-taking, customer relationships, buyers finding sellers, sellers finding customers, after-sale service and support. Although we are interested in transaction processing concerns within and between firms and within markets, we would also like to address important and essential social and behavioral issues in this setting, without which no effective commerce is possible. Moreover, we are interested in work and organizational issues embedded in electronic commerce and what they mean and imply inside the organization. In addition, we would like to explore how these electronic commerce issues relate to the marketing perspective, such as in relationships between firms and customers/clients. _The Information Society_ journal, published since 1981, is a key forum for thoughtful analysis of the impacts, policies, system concepts, methodologies and cultural change related to trends that may be described as the "information technology revolution." It is a refereed journal publishing scholarly articles, position papers, short communications and book reviews. _The Information Society_ is a multidisciplinary journal whose audiences include policy- and decision-makers and scientists in government, industry and education; managers concerned with the effects of the information revolution on individuals, organizations and society; and shcolars with an interest in the relationship between information technologies, social/organizational life, and social change. A general description of the journal can be found at the following URL: http://www.ics.uci.edu/~kling/tis.html For this special issue on "Electronic Commerce" and, in general, _The Information Society_ is interested in provocative analytical articles or empirical studies that are written to advance our understanding of the relationships among information technology, related social practices and policies, and social change. _TIS_ articles are typically 4,000 to 6,000 words long, and are written vividly with coherent analyses and minimal jargon. For manuscript format details, look at the following URL: http://www.ics.uci.edu/~kling/tisinst.html You may also contact the editor or see the inside back cover of an issue of the journal. Authors of manuscripts for this issue on "Electronic Commerce" should send four copies to the guest editor no later than January 15, 1996: Rolf T. Wigand, Ph. D. Guest Editor, _TIS_ School of Information Studies 4-293 Center for Science and Technology Syracuse University Syracuse, NY 13244-4100, USA Telephone: +315-443-5608; Fax: +315-443-5806 E-Mail: rwigand(a)syr.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: Cypherpunk Certification Authority
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sun, 26 Nov 1995, Robert Hettinga wrote: > >Is this another one of those LD tentacles? ;) > > Must that or a spoof of somekind... "She" didn't sign it, and "she" claims > to have issued a signature... I have never signed any of my posts to this mailing list and frankly have no intention of beginning at this point. No matter what some spoofer posts, as my "key". Whoever the dolt was who posted the "pgp key" hopefully will begin to use it and produce something worthy of their "signing". I always thought that my words spoke for themselves. I really don't have the inclination to travel to a secured facility and to use a secured machine in order to reply to a message on this list, and I truly am not interested in issuing a new key on a daily basis. That is reserved for something of some importance. Frankly, this is really not worth it. As some people might have noticed, I've simply closed off this communications channel. There really is nothing left to say at this point. Or as some people might learn, "Lilies that fester, smell far worse than weeds." I think that was a line from a sonnet or soemthing ... not that it would refer to anything in particular, or anything. <g> > Cheers, > Bob Hettinga Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: Cypherpunk Certification Authority
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 25 Nov 1995, Adam Shostack wrote: > Does X.509 version 3 fix the problem that Ross Anderson points > out in his 'Robustness Principles' paper? (Crypto '95 proceedings, or > ftp.cl.cam.ac.uk/users/rja14/robustness.ps.Z) > > Its an excellent paper, well worth reading, but the basic > problem is that X.509 encrypts before signing. You'd rather sign before encryption?? Doesn't that give you "known plain-text" to attack? i.e. the signature. I'm not sure whether it would or wouldn't, but I'm sure some cryptographers here might clear that up mighty quick -- before any more harm is allowed, I mean. > Adam > > -- > "It is seldom that liberty of any kind is lost all at once." > -Hume Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: Junk E-Mail - Part 4
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Alice: >Heavens, no. Than again, I'm waiting for the day that the NY Times >allows advertising on its op-ed page. It does and has for years and years, every day. Maybe you meant the editorial page?

1 0

Cyberangels
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

Some may have already seen this, but the Guardian Angels are trying to intrude onto the net... and are doing so in typical clueless newbie fashion. See the CUDigest web site for more information; the links to the most significant issues are: http://www.soci.niu.edu/~cudigest/CUDS7/cud786 and http://www.soci.niu.edu/~cudigest/CUDS7/cud791. Some interesting commentary is also in http://www.soci.niu.edu/~cudigest/CUDS7/cud787. Incidentally, one way in which they are displaying cluelessness is in taking L.Detweiler seriously. -Allen

1 0

No Subject
by Instituto Latinoamericano de Computacion 17 Dec '03

17 Dec '03

Hey What's up,my name is Herbert Salas,I live in Costa Rica,I would like to know everything you can about hacking.I've tried to find here something,but I can't find anything here,how they do to encrypt things,and how can you crack it,what do I need,Software,Hardware,Where can I get it.??Help. Thanks. Herbert Salas

1 0

For sale: your secret medical records
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

The Sunday Times, Top page one, 26 Nov 1995 For sale: your secret medical records for L150 by Lois Rogers and David Leppard Confidential medical records of politicians, celebrities and millions of other National Health Service patients can be bought on the information black market for L150. The contents of the files comprising patients' most personal health details dating back 30 years, are being sold to order by high-street detective agencies advertising in the Yellow Pages. The Sunday Times has discovered that GP practices across Britain are failing to safeguard files which contain sexual, mental and physical histories of patients. Files on sale last week revealed how named patients had vasectomy operations, or had a family history of Alzheimer's disease and precancerous growths. They also included the type and dose of medication prescribed, visits to casualty units, and injuries suffered in road accidents. The disclosures have prompted calls by opposition MPs and doctors' leaders for urgent laws to protect the security of the health records of Britain's 56.5m patients. Alan Milburn, a Labour health spokesman, said he would be asking Stephen Dorrell, the health secretary, to conduct an urgent inquiry. "This is a violation of the special relationship between doctors and their patients," said Milburn. "I find it disturbing and deeply sinister. Patients will be horrified to learn that their records can be accessed by unknown organisations." Alex Carlisle, the Liberal Democrat home affairs spokesman and a lay member of the General Medical Council, said: "It is ethically and morally outrageous that organisations of any kind should obtain details like that without consent. It is contrary to everything we are told about the confidentiality of medical records. This should be a crime punishable by imprisonment." Milburn and Carlile were among more than a dozen people who last week allowed The Sunday Times to expose the security failures in the NHS records system by giving the newspaper permission to access their confidential files through commercial agencies. The problem first came to light when one agency said it was receiving more and more commissions from big employers who wanted it to carry discreet checks on the medical backgrounds of their employees. The agencies, many of which advertise "private searches" in the Yellow Pages, offer their services for fees ranging from L150 to L800. They offer to provide a written summary of anybody's complete medical files within three hours. All they require is the name, address and date of birth of the patient they are investigating. They are thought to be able to obtain the records by impersonating medical staff and persuading them to disclose contents of the NHS files over the telephone. Last week a Sunday Times reporter posing as a prospective client contacted 10 private detective agencies chosen at random from the Yellow Pages. "Most of this stuff is on manual records," said one employee of a London agency. "It is pretty well protected. We're not officially allowed [to do this] but it's perfectly possible." A second private investigator said: "It's just a question of knowing who and what to ask." However, most declined to discuss the methods they used. "What we are doing is illegal, and I'm not going into the details over the telephone," said another agent in Robertsbridge, East Sussex. Dr Sandy Macara, chairman of the British Medical Association council, which represents 105,000 doctors, was among those who agreed to take part in the exercise. Details of his medical and surgical history were provided after a brief telephone call by a reporter to a private agency. The information was faxed to the newspaper within three hours, after a price of L150 was quoted. "This is incredible. I cannot imagine how they have got this information," Macara said. The ease with which the health files could be obtained posed a threat to the Electronic Patients' Records, a new computer database which will soon contain the files of all NHS patients in England and Wales, Macara said. "We will have to ensure the new nationwide computer network is as secure as humanly possible, and press for a statutory right to confidentiality of patient information." Elizabeth France, the data protection registrar, said the Criminal Justice Act had recently tightened the law regarding information obtained by deception. But the penalties apply only to information held on computer, rather than medical notes, which at present are held mainly on hand-written files. "This is something we take very seriously," France said. "We are actively pursuing it. It doesn't mean the problems have been solved." John Wadham, director of Liberty, the civil rights group, called on the government to introduce a new criminal offence of obtaining information by deception. "Such information can obviously include material about sexually transmitted diseases and material about an individual's physical and mental health," he said. "There clearly needs to be a right to privacy so the courts can act against this." Baroness Cumberlege, the junior health minister, said confidentiality remained a cornerstone of the NHS. "We are about to issue strengthened guidelines for security of records within hospitals and new measures for unauthorised access from external sources," she said. "We are having discussions with the BMA and the Data Protection Agency specifically about these issues." -----

1 0

Re: MED_vac
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Thu, 16 Nov 1995, Adam Shostack wrote: > If you have some personal data that includes your patient > number, why not have a card that instead lists your important data? > "This patient is diabetic, alergic to amoxicillin, and has Gold Cross > insurance." I'm confused. Are you saying that the answer is hardware?? Why I think someone already thought of that. It's called a MEDIC-ALERT bracelet. As someone who's blood type is rare, I can appreciate this. > At Defcon, Bruce Schneier was talking about the value stored > in casino chips. Its sttaggering. Its an alternate cash system, with > a huge float, astounding velocity, and very little fraud. Transaction > costs are low, clearing is instantaneous. The comparison is fairly > clear. I don't see the comparison. High value "chips" have additional security precautions engineered into them, over and above low-value chips, hopefully Schneier realizes this. There are also regular "counts", in fact perpetual "counts" in all casinos. I mean pit bosses and managers have to do something to earn their keep. (other than handing out comps, I mean.) There's also an "eye in the sky" lording over you in a casino, and the "chips" aren't actually "cleared" until you cashout. I'm not sure how Schneier got the idea that it was instantaneous clearing, but it isn't by any stretch of the imagination. But then what do I know ... I don't even sign my posts with PGP. > | So, what if my records were available on the net, but encrypted with a > | an key known to my physician and an escrow agency? (Equivalently, they > | could be on that smartcard, but encrypted.) If an emergency occurs, the > | hospital fetches my encrypted records from my physician's server, then > | sends a message (signed with the hospital's key) to Keys R Us, the escrow > | agent, saying "This is Dr. McCoy at Frobnitz Memorial Hospital, we need the > | key for FooBar Medix, Inc., patient number 147258369." (My FooBar Medix, > | Inc., insurance card lists my physician's server, the escrow agency, and my Why bother with having records on the "Net". What if the net goes down, then what?? Where are you left then? Relying on technology, simply because something CAN be done is very bad practice, when its not needed. When I travelled in the States, I simply kept a copy of my travel documents in my wallet. I never had any problem. And I had a copy of my pertinent medical data, attached via a MEDIC-ALERT bracelet to my body. Then again, the amount of information that you want a doctor reading over when you do have an emergency is minimal. You really want the doctor to act, not to get to know all of the details which aren't relevant to your treatment. There's no need to overload someone, you simply have to give someone the resources they need in order to get the job done. And that is the critical point, isn't it?? Getting the job done, and giving someone what's needed to do so. > -- > "It is seldom that liberty of any kind is lost all at once." > -Hume Alice de 'nonymous ... ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Elliptic curves, current status?
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 12:07 PM 11/25/95, James A. Donald wrote: .... >Can someone tell me the true story? Not with any assurance. I don't trust my own knowledge yet. I think that the opinion is that the discrete log problem is harder with elliptic curves than for prime modulus arithmetic for numbers of a given size. That is why you can use fewer bits. The inner loop in some elliptic curve systems is not multiply-add (as is the case with number fields) but other operations that are as efficient with gates but less efficient with normal machine instructions. There are probably an order of magnitude more people that have studied and published about the problems of breaking prime modulus crypto than elliptic curves. Perhaps progress will be faster should elliptic curves be studied by more people. There are a lot of tricks to speed up discrete logs in for prime modulus schemes that don't seem to work for elliptic curves. There are many parameters to an elliptic curve crypto system. I haven't seen any taxonomy of which kinds are good and which have been shown to be week. In contrast there seems to be a consensus about how to pick primes for RSA or Diffie-Hellman. I am certainly no expert. Perhaps this will prompt comments from someone who can point to real information.

2 1