December 2003 - cypherpunks-legacy

Re: Reasonable validation of a software package
by David Sternlight 17 Dec '03

17 Dec '03

At 1:12 PM -0700 7/18/96, Carl Ellison wrote: > >The problem people overlook is that a CA binds a public key to a name but >the name is in the CA's name space. For me, a verifier, to derive any >value from a certificate binding (key,name), the name has to be in *my* >name space. > >If there were such a thing as a global namespace meaningful to everyone, >then we could both use it. That's the X.500 falacy/pipe-dream. Think of the common name on a certificate as if it were a first-come, first-served serial number of alphanumeric form. There's no reason to believe that John Smith is YOUR John Smith. Your John Smith might tell you he's John Smith 37. It's kinda like vanity license plates. The alternative is every privacy fan's nightmare--embedded SSNs or some such in certificates. Some of the problems, of course, will be of the users' own making and there they get to pay their money and take their choice. What I mean is that you can optionally include or suppress your e-mail address in Type I certificates, and real address in Type IIs. If you include it you improve the chances of being the "right" John Smith someone is after. If you prefer privacy you will also be less accessible. I see nothing unusual about that--after all, people with unlisted phone numbers are ultimately inaccessible except (pretty much) to those to whom they give the info. > >The fact is, no global name space could be held in one human's mind, so >there's no way a global name space could be meaningful to me. Nor is there any reason it should be. It isn't, now. > >So, to use a certificate from a CA, I need to map a name from its name >space (DN) into a name in my name space (nickname). Every time I've looked >at that process, I've had to have a secure channel over which to learn from >the person I call by that nickname what DN he goes by. Why does it have to be a secure channel? Why can't it be published (for instance by including the address in the certificate)? >If I have that >secure channel, then he could tell me his public key fingerprint ove that >cnnel -- and I wouldn't need the CA. Why wouldn't you use the certificate to bind the public key to the name and address? What need would there be for fingerprint communication? How is this different from 20 John Smiths in the phone book at 20 different street addresses? I'd better know the address of the John Smith I want if I'm to get his phone number from a directory. Note that I'm not attacking what you say. There's clearly something you're getting at that I don't understand--since you post sensible stuff (as far as I recall). Help me out here. David

1 0

RE: ABC news on Internet Telephony
by talon57＠well.com 17 Dec '03

17 Dec '03

David Sternlight writes: >There's something fundamental going on here beneath the surface. >Surprisingly, a recent item (maybe the one you reported) on this >suggests that the big phone companies are trying to use this >phenomenon rather than stop it. I think it was AT&T who announced >that they had web software that improved the quality of such >internet voice calls. Surprisingly constructive, in contrast to >the coalition of small phone companies screaming for the FCC to >"stop it". The FCC has wisely said they're not going to act right >now because it could kill an incipient new technology. There is something fundamental going on here, a lack of common sense, and/or critical reasoning. Lets try it again. Who is the most likely to be disintermediated by a global packet network? (how do you get to your ISP?) I assume by "big phone company" vs "little phone company" you are refering to long distance vs local service, tell me, if the RBOC's continue merging, at what level do they become a " big phone company." The RBOC's are not the only local service providers of course, here in Illinois alone there are more than 80 (at my last count) providers of local service, and soon there will be many more. The other "urban myth" you are helping to support is the notion that it is the local providers that are fighting deregulation. Ameritech filed for total unbundling in March of '93, and you don't see them insisting on having a percentage of the long distance market before the long distance companies are allowed to compete in the local loop. >This is the rankest speculation on my part, but could some of the >bigger, smarter phone company cum internet providers have done >some serious analysis and concluded that we're moving away from >distance-based rates for voice calls. Might they even have >examined where we'll be in the next ten years (with ADSL, etc.) >and decided that the network technology and simple market >economics makes fixed charges per "line" more profitable to them >than metered usage? Maybe this is wishful thinking on my part, but >some of the bigger actors are starting to behave in a surprisingly >counter-intuitive (based on the way we stereotype them) fashion on >this topic. point to point circuits are more efficiently handled by circuit switching rather than packet switching networks. Nicholas Negroponte wrote an interesting piece about asynchronous vs synchronous, I believe it is in his book "Being Digital." ADSL is an interesting attempt at digital telephony but expensive and basically would mean replacing existing central office switches. (backbone bandwidth) In a packet network you have to either dedicate a portion of the bandwidth for a synchronous circuit, or you have to have a very fast network and use very small packets (ATM), expensive either way. A single central office has many times the bandwidth of the widest part of the internet, and the average state has hundreds of CO's. If even a small portion of the Internets current users tried placing a call things would grind to a halt. A huge increase in the number of backbones and their bandwidth would solve this, but who will pay the bill? TANSTAAFL Sometime ago the discussion was on the cost of laying new fiber, may I suggest the realworld heuristic of "a million dollars a mile." Please note I am not trying to make fun of anyone personnally, I am in the words of Jubal Harshaw "heaping scorn upon an inexcuseably silly idea, a practice I shall always follow." Brian communicate globally, censor locally

2 1

Re: Filtering out Queers is OK
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:48 AM 7/19/96, Simon Spero wrote: >On Thu, 18 Jul 1996, Timothy C. May wrote: >> Filtering is not "wrong," Cerridwyn, it is a rational response to garbage >> being spewed constantly. I filter lots of items. I read "Scientific >> American" and "The Economist" because they filter (or "censor," in the >> sense some are objecting to here) nonsense about "queer rights" and > >Actually, the Economist has, er, come out strongly in favour of gay >rights on numerous occasions- most recently on the issue of same sex >marriages. Sure, and I didn't exactly state what my position _is_ on so-called queer rights. I said I have no interest in hearing nonsense about it, e.g., the drumbeat of propaganda, etc. Of course, it should come as no surprise that I believe everyone has the legal right to refuse to associate with anyone. Thus, a shop owner or employer, in my view, has every right to refuse service or employment to whomever he wishes. While many may not _like_ this (including me, when I am banned from certain businesses, as I am), it is part and parcel of liberty. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: (fwd) Re: US versions of Netscape now available---NOT
by David Lesher 17 Dec '03

17 Dec '03

> > Whatever YaKnow > > cybernut(a)nutcom.com > > 10401 Wilshire Blvd, Suite 805 > > Los Angeles, CA 90024-4628 > > (310) 475-3799 > > > > > > Isn't that nice. Some creep is proud enough of his skill at accessing the > trivially available InterNIC finger data that he posts it to invoke > harassment. And being a coward as well, he hides behind an anonymous > remailer. Of course, SternFUD himself advertised all the same material & much more hornblowing on http://www.switchboard.com; Check it out yourself. (I do note UnProfessor has removed the Panasana address that was there previously.) [IMAGE] DR. DAVID STERNLIGHT PROVIDES ECONOMIC AND STRATEGIC PLANNINGCONSULTING SERVICES FOR HIGH-TECHNOLOGY FIRMS. Strategic uncertainty is now the norm for the business environment. Wrenching events such as the fall of the Soviet Union, major shifts in technology and its location, and new directions in national and international policy strongly affect the medium and long-term business future...... -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

2 1

Re: New Infowarfare Panel
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

David Sternlight wrote: <snip> >I'm talking about some of the information that started slowly leaking out >later, not the prime-time TV pyrotechnics. It doesn't "slowly leak out" as if there were some regrettable lapse in the plumbing. Someone has to commit the federal crime of military espionage! <snicker>

2 1

No Subject
by weffross＠counsel.com 17 Dec '03

17 Dec '03

To: cypherpunks(a)toad.com Inet unsubscribe weffross(a)counsel.com Thanks!

1 0

Re: #E-CASH: PRODUCT OR SERVICE?
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:19 7/16/96, Stig wrote: >Perhaps this has already been voiced on the main list (I get a filtered >helping or two of cypherpunks), but *I'm* surprised that such a generic name >as 'Ecash' was granted trademark status anywhere. > >It's like giving Microsoft a trademark on the term 'Email'... It's nuts! >Was the term ecash not in use before DigiCash showed up on the scene? No that I am aware of. Furthermore, to the best of my knowledge, DigiCash's Ecash is the only ecash that I am aware of. The other "ecashs" lack various properties of cash, as previously explained by Bryce. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred. Defeat the Demopublican Unity Party. Vote no on Clinton/Dole in November. Vote Harry Browne for President.

2 1

BIG_dif
by jya＠pipeline.com 17 Dec '03

17 Dec '03

7-19-96. NYP: "AT&T and Wells Fargo Investing in an Electronic Cash Card." The companies said that they would form the American affiliate of Mondex. Any one with a Mondex card can transfer electronic cash to anyone else with a card. This flexibility has raised concerns both about the possibility of counterfeiting and of money laundering. Because of these concerns, Mondex has been modified in the United States so that banks will be able to track card use. That will allow them to audit for fraud, if not recreate every transaction. Data from Mondex cards will be used for various product marketing. "We believe there should be privacy, but there is a big difference between privacy and anonymity," Dudley Nigg, executive vice president of Wells Fargo, said. ----- http://pwp.usa.pipeline.com/~jya/bigdif.txt (4 kb) BIG_dif

1 0

Re: Gorelick testifies before Senate, unveils new executive order (fwd)
by David Lesher 17 Dec '03

17 Dec '03

SternFUD claims: > There are exceptions to ITAR for this purpose (overseas offices of US > companies). Clearly UnProfessor failed to read recent Phil Karn's testimony at the Senate Subcommittee. Phil, representing both himself *and Qualcomm* explained how Qualcomm had attempted to export a Triple DES application to their own Hong Kong office, *for use by the AMCIT employees there* to communicate with Califunny. The request was denied with a FORM LETTER checked "resubmit a non-Triple DES method" or words close to that. Further, Phil told the Subcommittee that every time they need a bug fix on the CDMA code running on the system in HK; they must resubmit the whole package back for approval. A BUG FIX! They've been through this many times, each one taking eons. Just suppose ARCO needed all new permits every time they adjusted the crude mix, or retuned the cat cracker? -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

Re: BIG_dif
by Duncan Frissell 17 Dec '03

17 Dec '03

> Because of these concerns, Mondex has been modified in > the United States so that banks will be able to track > card use. That will allow them to audit for fraud, if > not recreate every transaction. Data from Mondex cards > will be used for various product marketing. > > "We believe there should be privacy, but there is a big > difference between privacy and anonymity," Dudley Nigg, > executive vice president of Wells Fargo, said. So, how will the identity of the cardholder be tracked when they are transferred physically from one person to another? Presumably bank tracking will only work when the card is submitted to a "public" terminal. "Wallet" transfers won't be tracked immediately. Also, if an API is realeased, interesting possibilities are created. DCF

1 0