December 2003 - cypherpunks-legacy

FWD: Intuit and SSNs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

What does our man in Intuit have to say about this? > Date: 18 Dec 1995 19:10:07 -0800 > From: michael(a)piglet.amscons.com (Michael Bryan) > Subject: SSN Shown On Payments by Intuit's Banking Service > Organization: none > > Another user (Robert Mayo) discovered, and I confirmed, that Intuit's > online bill payment service sends your payees a printout containing > your social security number. > > This applies to any person who is using Quicken for Windows or > Microsoft Money for Windows to send payment requests electronically, > using Intuit's service. It specifically does -not- apply to using > Quicken with the Checkfree service, as the Checkfree service does not > supply anybody with your SSN. > > The details: > > When the Intuit service sends a payment to a merchant, it will do one > of three things. First, it will try to perform an EFT directly from > your account into the merchant's. Most merchant's are still not setup > for this, however. Second, if your payment is the only payment going > to a given merchant on a given day, then they will print a check, drawn > against your account, and mail it to the merchant. Both of these > methods are ok, and do not result in your merchant receiving your SSN. > > However, if there are multiple payments going to a single merchant on a > given day (i.e., more than one customer has requested a payment to the > given merchang), all of these payments are sent in a single envelope, > and a summary sheet is enclosed. This summary sheet will have a field > called "Control Number", which consists of your SSN, followed by two > other digits. This summary also lists your checking account number, in > addition to your name, account with the merchant, and the amount of > your payment. (In my opinion, only these last three fields are called > for. There is no need for the checking account number to be listed, > even though it -is- printed on your check as part of the MICR > encoding.) > > I have contacted Intuit regarding this matter, and they have been > decidedly less than helpful. I know at least three other people who > have called them, and we have all been told the same thing: > > 1) "Most of your merchants already have your SSN". Perhaps this is > true for some people, but it is not the case with me. > > 2) "The SSN is encrypted on the printout". Absolutely not true. It is > printed under the label "Control Number", and has two extra digits > appended, but this does not "encrypt" the number. Anybody who knows > what the field contains has instant knowledge of your SSN. > > Intuit is currently refusing to address this issue. Furthormore, when > I called in, they tried to tell me I was the only person who was > complaining. I immediately gave them the names of three other people > who had called in, one of whom I knew had talked to this particular > individual. So that little "divide-and-conquer" trick backfired. > > Also, when I said that I would be forced to go to the media if they > didn't address this issue, I was told that by doing so, I would be > responsible for broadcasting this information to those who might then > illegally use the information. I found this two-faced attitude > particularly annoying. On the one hand, they are claiming it's not a > problem, yet on the other they tried to keep me from going to the media > because it might give criminals information they could then exploit. > > Anyway, I've done all I can with talking to Intuit, so I am now > pursuing other avenues. My bank (Union Bank) was particularly > concerned that the SSN was being printed out and mailed with > potentially every payment, and vowed to look into it and work with > Intuit on my behalf to get this behaviour stopped. Also, I and a few > others have contacted various media representatives, in an attempt to > get them to focus a spotlight on Intuit, and let people know that > Intuit is broadcasting their SSN, without their knowledge. And of > course, I'm posting Usenet articles in the privacy newsgroups, as well > as the newsgroup where most Quicken discussion occurs, > comp.os.ms-windows.apps.financial. > > If you are using Intuit's Online Bill Payment service, and are > concerned about this, please call Intuit and express your displeasure. > The number for the Online Bill Payment service is 708-585-8500. Also, > call your bank, and inform them as to what's going on. Finally, write > to your local (or national) newspaper, let them know about this, and > ask them to cover this in their paper. > > It appears that the only way Intuit is going to address this is by > getting some negative publicity, since customer complaints don't seem > to carry enough weight. I wish they were more reasonable, but that > just doesn't seem to be happening here. So be it --- they want a > fight, they've got one.

2 1

Re: The War on Some Money [long]
by tcmay＠got.net 17 Dec '03

17 Dec '03

Amidst all the flames about impure Cypherpunks on the list, about evil capitalist corporations, about conspiracies involving the underground Grey Alien bases in Nevada, and amidst the flames about posts not dealing solely with number theory or ciphers, it's nice to read a post like this one from David Murray. The tension between "private transactions" and "traceable transactions" is indeed at the core of the debate. Kudos to David on this. I just want to end on a positive note before leaving for the holidays (the birthday of my savior, F. Hayek, of course). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Bit Commitment Query
by Hal 17 Dec '03

17 Dec '03

For Robbie Gates, I agree that the bit commitment he describes seems more complicated than necessary. The simpler one, where you just hash (R,b), is the one I have seen used. I suggest asking on sci.crypt. Bruce Schneier and many other good cryptographers read that group. For Futplex, the idea of using a block encryption algorithm in a similar way, encrypting (R,b) with a secret key K, and later revealing K, is a little questionable because block encryption algorithms are not designed to avoid collisions in the same way hashes are. Futplex suggests that it should be hard to find two keys K_1 and K_2 such that E_K_1(R, b1) = E_K_2(R, b2) where b1<>b2. But this is not necessarily true. A cryptosystem might have the property, say, that complementing the key is equivalent to complementing bit 0 of the plaintext. DES has some simple complementation properties (although not this one). Unless you can show that a cipher with this property is inherently weak then it is not a valid assumption that a cipher won't have this property. There is some literature on creating hash functions out of block ciphers. The two are really not interchangeable. Hal

1 0

AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE??
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... Back on Tue, 19 Dec 1995, I wrote: >>>Can anyone tell me whether Ian Goldberg and David Wagner got their >>>$25,000 from Netscape for finding the HUGE security flaws in Netscape's >>>existing product line?? >>> >> >I can't remember whether they got anything or not ... >> >> That would be no (well, except for the nifty T-shirt from Sameer; Thanks!). > > Not anything?? That's shameful ... where on earth are the values in > America, today? Everyone should ask this question. AT&T can sign-on to a two-page ad, calling on Congress to balance the budget -- to cut off veterans, and cut-off women with dependent children just before Christmas. It can sign on to this, but it can't bother to even offer a scholarship to the students who helped make its fortunes. It would rather leave the impression that it freeloads off of other's efforts. It's shameful. > AT&T and Netscape have jointly made a small fortune distributing this > product, and yet NEITHER company feels that the software engineers who > "voluntarily" made a difference -- a couple of students -- deserve > even a wooden nickel for the ideas which were used. > > It's absolutely shameful. But then, I guess that AT&T and Netscape > have no shame at all. > > They just steal "intellectual property" from students, and don't even > pay a token amount. > > And people wonder what's wrong with America? Luckily for those of us who don't live in the United States, we can perhaps look at that country and truly wonder what is going on over there, and what is wrong with America? Where are the values amongst ALL Americans, not just Netscape and AT&T? What are the role models that all the leaders -- business, sports, and political leaders -- show to the national youth. Here is all I've seen (as a foreigner), over the last while: Enid Greene Waldholtz blubbering in a news conference about how she as a congress person certainly COULDN'T be expected to resign after winning her election with stolen money. Blubbering for five hours straight (except when she had to stop to turn a page, I mean) ... She certainly said that "leadership" is all about playing "victim". Poor little Enid. (And even worse, she was _defended_ by Susan Molinari.) Bob Dole, deciding to go to Bosnia. The former WW II veteran willingly jeopardizing the lives of American boys -- boys who have put their lives on the line in a _volunteer_ armed force -- all for a lousy political photo-op. The chance to say ... "hey look at me, I'm here in Bosnia." Someone who's willing to overrule the Pentagon's own most diplomatic advice on how complex an operation this actually is. And then there is AT&T. A company who's Chairman can publish a letter which calls on Congress to cut off checks to mothers with dependent children and war veterans days before Christmas, all while stealing and freeloading off of the work of some students. Scrooge ... take heart. Here's Holiday wish #1. Enid do the right thing ... resign. Say the "right thing" and say that your child -- the future and the delayed gratification that the future brings -- is much more important than your own personal PRESENT political aspirations. Here's Holiday wish #2. Bob, lots of people worked their asses off to make sure that the American fighter pilot, and the two French fighter pilots could be rescued from Bosnia. If you want to go and get some photo-ops, go to Germany or Italy, and give one hell of a vote of support to the boys that are there -- a support which could just as easily have been given and should be given in Congress. A _real_ strong unfettered commitment. And here's Holiday wish #3. AT&T. Do the right thing. Reward those people who help make you a fortune. Stand tall as an example, rather than as an embarrassment to the nation. You've ignored this for so long now, that you've almost dug your own grave. But you still have a chance to save face. Have the courage to take the chance when it's offered. Simply say that the proposal to reward David Wagner and Ian Goldberg -- some holiday mad money and scholarships -- was lost in committee, and approval processes -- but it WAS in the works, and it was recommended and can now be announced just before Christmas, as a rightful reward. Some holiday cheer. Will people think it's a cynical attempt at manipulation? Yep. But it's a darned site better than the alternatives -- especially when you look at possible future outcomes. Trust me, this is far better than calling for veterans and single mothers with children to be cut-off just before the holidays. Perhaps, Enid, Bob, and AT&T will all learn when to use offense and when to use defense. They might also learn that the best offense is a good defense. They might even begin to look at what "courage" truly is, and of how difficult it can be for anyone to do the "right thing", especially when they think that they're surrounded by minefields. Even when the "right thing" is in your own best interest, you not only have to be shown the right path to take, but you have to have the motivation and courage to make the move and take action. Enid, Bob, and AT&T, take note. Hopefully for the holidays, everyone finds the courage to neutralize some portion of the vulnerability spectrum they've placed themselves in. > > - Ian "There's a reason people talk about `starving grad students'..." > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: CFS and Linux
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:40 PM 12/20/95 -0500, Matt Blaze wrote: >I'm told that all version of CFS since 1.0.4 (the latest is 1.3.1) >do work out-of-the-box under *some* releases of Linux and with some >coaxing on the others. I am wondering if he is compiling for ELF. That seems to throw a good size monkey wrench into just about every piece of software out there. (At least the ones that have not been written to take the ELF paculiarities into account.) >I'm not sure exactly what problem you're having, but the most common >CFS-Linux problem that people complain about has to do with the rpcgen >output not being in the format expected by the rest of CFS. There >seem to be two things you can do about this: get a version of rpcgen >that generates the "standard" (original Sun) names for the functions it >generates, or just grab the rpcgen output from the cfs-users mailing list >archive ("echo help | mail cfs-users-request@research att.com" for details). I think you may be right on this one. I have heard of a few other things having problems with Linux's version of rpcgen. (The names of which are not coming to mind... Need more coffee.) [rest of reply deleted because I had nothing to say about it] ObNoise: >NB to "Bill Gates" and friends: To save you the trouble of pointing it out, >I hereby admit that I'm a commie-fascist brainwashed sold out member of the >military-industrial complex who has been programmed by his masters to >infiltrate the cypherpunks in order to sap and impurify their precious >bodily fluids. I think that the mention of Mr. Bill as a "good guy" is the most effective use of agent provoceteur-type behaviour I have seen on this list yet. We know who Mat and Jeff work for. Who do the anon-flamers work for? | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

No Subject
by frantz＠netcom.com 17 Dec '03

17 Dec '03

David Plotnikoff, in his regular (WWW oriented) column in the San Jose Mercury News, writes: DOES YOUR BOSS KNOW WHERE YOU'RE SURFING? The SIMBA Media daily reported recently that a Maryland-based software publisher called Charles River Media has introrduced a $30 electronic fink program called "Internet Watchdog" that keeps an eye on where you've been hanging out on the Net. the program doesn't block or censor sites, but it does maintain a handy record of cyber-footprints that the parent, teacher or employer who controls your Net access can peruse. ----[end]---- Anyone know more about this program? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

KOD
by John Young 17 Dec '03

17 Dec '03

Congratulations to the cypherpunks named Newsweek's "Big Thinkers of tomorrow -- the list of 50 People Who Matter Most on the Internet." In the December 25 issue. And, sympathy for the Kiss of Death envynescent celebrity.

4 3

FTC Privacy Initiative (fwd)
by Jyri Kaljundi 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 20 Dec 1995 09:22:11 -0800 From: Internet Marketing Discussion List <internet-marketing(a)popco.com> To: internet-marketing(a)popco.com Subject: FTC Privacy Initiative From: Lewis Rose <lewrose(a)arentfox.com> The US Federal Trade Commission has launched a "Privacy Initiative" to investigate whether the information collected at websites (either that affirmatively submitted by a visitor via a form or information collected based upon a visitor's selection of pages at a site to reflect personal interests) should be the subject of regulation by the FTC. To get background on this effort, you may want to read a speech by FTC Commissioner Varney on Electronic Commerce and Privacy which is available at the FTC's site under speeches (www.ftc.gov) or the Advertising Law Internet Site (www.webcom.com/~lewrose/home.html) under speeches. This week the staff of the FTC established a mailing list to allow interested parties to discuss the issues surrounding the privacy interests of consumers visiting web sites. To subscribe, send the message "subscribe" (without the quotes) to privacy-request(a)ftc.gov I suspect most of the participants will not represent the internet marketing community and urge interested members of this list to subscribe and participate. So far, there have been only two posts-- one by me yesterday wondering why marketers on the internet should be treated any differently than marketers using more traditional media, followed by one post simply asserting that internet marketing privacy issues are completely different from those raised by traditional media. Lew Lewis Rose 202-857-6012 (voice) Arent Fox Kintner Plotkin & Kahn 202-857-6395 (fax) 1050 Connecticut Avenue, NW lewrose(a)arentfox.com (email) Washington DC 20036 Advertising and Marketing Law Advertising Law Internet Site http://www.webcom.com/~lewrose/home.html Net-Lawyers Mailing List: net-lawyers(a)lawlib.wuacc.edu

2 1

Encryption Rules Coming
by John Young 17 Dec '03

17 Dec '03

Financial Times, December 21, 1995, p. 4. Encryption rules to be prepared By Andrew Jack in Paris Representatives of international business and government yesterday agreed to draw up guidelines on encryption, a system which allows computer users to transmit information electronically with little risk that it can be intercepted and understood by unauthorised "hackers". The meeting, which was held at the International Chamber of Commerce in Paris, could lead to formal propositions prepared jointly by business and government organisations that could be ready by as soon as next summer. Yesterday's meeting did not have any formal legal authority, but was highly significant as the first forum where so many representatives of governments businesses and computer experts met to discuss developments in encryption. Highly sophisticated encryption technology already exists in a number of countries including the US and Sweden. In the US, companies already have access to these programs. A growing number of businesses -- led by the banking sector -- are demanding access to these programs. However, many governments, including that of the US, have resisted permitting the technology to be exported because they fear it will fall into the hands of organised crime and terrorist organisations. They have demanded that they should be able to "hack" into computer transmissions for counter-intelligence and criminal investigation work, in the same way that they can conduct telephone-tapping exercises. An important conclusion of yesterday's Paris meeting was that business agreed in principle to allow such hacking to take place as long as sufficient safeguards were in place and "electronic search warrants" had been issued with proper judicial approval. A number of governments appear willing to permit relaxation of export controls on sophisticated encryption devices as long as these safeguards are in place. Among the issues that experts on both sides need to resolve are the ways in which "keys" allowing computer transmissions to be decoded would be handled. A number of business organisations have discussed the use of third-party organisations, which would be independent of government, would have the keys and would hand them over to government investigators when demands were justified. However, the organisations still have to resolve a number of issues, including how these custodians could be made legally liable for any unauthorised access to this information and for the costs of its misuse. [End] ---------- Does anyone have press reports or more information on this meeting? Any connection to the recently signed Transatlantic Agenda?

3 2

Re: What ever happened to... Cray Comp/NSA co-development
by tcmay＠got.net 17 Dec '03

17 Dec '03

Anitro wrote: >O.K. Just a factor of 16 increase over the CM architecture right? Not knowing >the computational capabilities of the individual processors, it might be >difficult to say what the machine is capable of. Wouldn't that have some >bearing? Not in cracking "truly large" problems by brute force. Even if each of the million processors is capable of 100 MIPS (which is unlikely, given the PIM approach and the fine-granularity, few-bit-or-less word size, etc.), this is only 10^8 MIPS. For problems that (for instance) 10^75 machines would have to spend 10^10 years on, not even a drop in an ocean. The point is that no existing machines are going to make a dent in these calculations, though algorithmic cleverness _might_ make factoring much easier (personally, I doubt it). >> Second, there was work on a "processor-in-memory" architecture, in >> conjunction with a Bowie, Maryland spook-connected company. Perhaps this is >> what you are thinking of? > >I didn't mention a 'processor-in-memory' architecture and neither did the NYT >article. Don't know about any other company involvement, just CCC and NSA. I wrote my response before seeing the other response someone else (Thaddeus J. Beier) gave the name of the company. Thad's details match what I recall about this Bowie company. The archives should have articles on this, dating back about a year or so ago. As I recall, someone on the list knew people working at the Supercomputer Research outfit. >> Third, all avenues of continued funding having fallen through, Cray >> Computer (not Cray Research, of course) was shut down and assets >> liquidated. I haven't heard what's become of Seymour, though. (He is >> undoubtedly an asset, buy I doubt the Agency would have him liquidated.) > >You mean the avenues that are of PUBLIC record. The possibility could always >exist that the development continues 'in-house'. It wouldn't be the first time >that sort of move has been played. You, whoever you are, asked about the operational status of Cray Computer, and I answered. It entered Chapter Seven liquidation, parts of existing computers were sold for scrap or museum/curio objects, the GaAs fab was sold to another company, and the employees scattered. Claiming the NSA moved it "in-house" is implausible, at least in terms of these events. >> Huh? First, what evidence do you have for this claim? Second, who cares? >> Implementing Clipper in a Cray Computer machine--why bother? > >[Rant mode on] >Speculation Tim... I'm SPECULATING. Could, in theory... AND my kind of theory >probably has holes you could drive a FLEET of Mack trucks through. I have NO >evidence. I'm not sure WHO would care. I'M A PARANOID DILLUSIONAL PSYCHOPATH! >O.K. well maybe not that last part... but I'm asking the questions, remember? >I said I'm new here, so if your going to blow holes in my pet theories, then >do me the 'kindness' of using an accurate weapon... that's why I posted... I asked what evidence you have for this claim. Idle speculation, based on innumerate estimates of plausibility are helpful to no one. >> As to the claim that a million-processor machine could do this, you need to >> work out the math. (If a backdoor exists, or the LEAF has been gotten, a >> supercomputer is not needed....) > >Again... I claimed NOTHING! SPECULATED MUCH! Now it's your turn... Why would >YOU build a machine like this? What could POSSIBLY be it's capabilities? >Speculate with me for a moment... *_take a chance_*. On our list, and in the circles I am familiar with, "speculations" are not treated with more respect than are actual "claims" (whatever they are). If you speculate that "really, really fast computers" will make today's ciphers insecure, based on not even the simplest of calculations, expect to be either ignored or called to task. This is the way science works, by falsification of theories (and speculations). >> If you mean using supercomputers to brute force the general factoring of an >> RSA modulus, this is nonsense. While there may be math shortcuts we don't >> yet publically know about which make factoring easier than we currently >> think it is, a mere million or even a billion processors will not make a >> dent in the factoring of, say, a 700-digit modulus. See the tables in >> Schneier and elsewhere for some estimates of factoring efforts needed. > >Nonsense? Is that 700 decimal digits or 700 binary digits? I don't have the >tables that you refer to. Where may I find them? (LOL) A 2048-bit key, such as many of us use, uses a roughly 700-decimal-digit modulus. "Schneier," mentioned in my paragraph, is "Applied Cryptography." Page 284 of the 1st Ed. has a discussion of the work involved in factoring large moduli. Rivest has made some more detailed estimates. Given your rudeness and self-professed ignorance of even the basic math, I see no point in wasting any more of my time on your posts. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1