December 2003 - cypherpunks-legacy

URG_ent
by John Young 17 Dec '03

17 Dec '03

11-02-96. "Transaction Records Urged for Smart Cards" Electronic money systems must generate transaction records to help law enforcement agencies track money launderers, a senior Justice Department official said last week. "In a paper environment ... we can get bank records, we can get credit card records. Our goal is only to preserve this ability." "Internet insecurity " Jeff Schiller: The Web has a lot of potential vulnerabilities. There's plenty I know about that I don't want to talk about. People who know about the vulnerabilities are reluctant to talk about them because if we disclose what we know to the public, the bad guys will take advantage. And if we address them with the vendor community, they don't do anything about them. There's a lot of hooey out there. Never trust the advice of someone selling you a product, especially if the sales pitch is, "My product makes your problem go away." "RSA offers kit for secure credit-card transactions" RSA Data Security, Inc. will announce today a tool kit for developing secure applications that support credit-card transactions on the Internet called S/Pay in support of SET. "Medcom introduces a "Super Cafe" data encryption product" Medcom's latest data encryption product, the Secure Socket Relay (SSR), features strong encryption with full key length (56-bits DES). A demo version can be downloaded at http://www.medcom.se/. "On Technology's Security White Paper" "Taking The Threat Out Of Network Security," will stimulate the industry into discussing some of the issues of security that face the Internet industry and its users. Copies of the paper are available on request from On Technology. The company's Web site is at http://www.ontech.co.uk . ----- http://jya.com/urgent.txt (21 kb) URG_ent ---------- In another story on gov-spooked insecurity: NEC announced that it successfully demonstrated country-to- country virtual private networking (VPN). During the tests, privacy and security was maintained between the two sites by deploying DES and triple-DES encryption. Since DES encryption technology cannot be exported from the United States, a Japanese version of DES, developed outside the U.S., was used.

1 0

Re: [NOISE]Re: Dr. Vulis
by Ross Wright 17 Dec '03

17 Dec '03

On or About 3 Nov 96 at 15:44, Sandy Sandfort wrote: > ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ > SANDY SANDFORT > . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . > > C'punks, > > > Just want to add my 2 cents. I am also unhappy with the fact that > > he was removed. My personal correspondence with Vulis has been > > friendly and he has been very helpful. > > Then I suggest that Ross not remove Dimitri from his private > e-mail correspondence. On this list, however, Dimitri was NOT > friendly NOR helpful. > > Wha do Ross' or anyone else's private interactions have to do > with the decisions of those who pay for this list's existance? In fact, nothing. I just wanted to show that this coin has 2 sides. Ross =-=-=-=-=-=- Ross Wright King Media: Bulk Sales of Software Media and Duplication Services http://www.slip.net/~cdr/kingmedia Voice: 415-206-9906

1 0

Re: Thank you, John Gilmore, for protecting freedom of speech against Dr. Dmitri Vulius [RANT]
by Gary Howland 17 Dec '03

17 Dec '03

> But there's probably a logical reason for taking this "action", although it can > apparently be easily circumvented, even though many of us don't understand what > that logic could be. Yes. If only you knew what they knew ... :-) The mail filter is dead! Long live censorship, double standards and hypocrisy! Gary

2 1

Re: Discrete logs 1 [non-cryptography related annecdote] [NOISE]
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 03 Nov 1996 09:36:32 -0800, Dale Thorn wrote: >> >properties than regular logarithms, but I thought this bit of history >> >would spark some memories in old-timers and give a new perspective for >> >younger people. >[snip] >> The same thing goes on with SATs and especially SAT-IIs. Some higher-end >> calculators, esp. HPs, have plugin cartridges which automate much of the >> basic work in chemistry, physics, etc. I never saw anyone who used such >> things even get asked about it. Do we even need social engineering with >> people this stupid? >Technology has a base, much like a pyramid. When you add enough layers, you can't >find very many people who can traverse top to bottom and understand all of what's >in between. How true... >I consider it a miracle when a student has the quality of consciousness to buck the >trend and get themself a quality instrument (such as an HP-48SX/GX), since once they >do that, they might be encouraged to explore further. Were this the way it actually happened, I'd tend to agree. However, the group that bought high-end calculators solely to do things like this was proably about 50-60% of the total. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

1 0

Re: Sliderules, Logs, and Prodigies
by Sean Roach 17 Dec '03

17 Dec '03

A quick note, I consider myself to be a nerd. This is in part "reclaiming", as I found myself uninterested in sports, as my classmates were, and found computers fun.(good reason too, considering I had access to one of those, an old TI99/4, longer than I had classmates). I didn't grow up un either log tables or slide rules, but I did learn how to do basic arithmetic on both the traditional slide rule, and a round one designed for engineers. At one time, nerds were the intellectuals, the only thing that has really changed is that now the nerds are in control, making intellectual arts a little more appealing. I'm only a 21 year old college student who is still somewhat ignorant, make that quite ignorant, about the world, but I do feel that just because it was an unpopular term to describe you, it isn't disrespectful to consider ourselves nerds. Relevance to Crypto, none. Just attempting to defend myself in the ether.

1 0

Re: Censorship on cypherpunks
by Greg Broiles 17 Dec '03

17 Dec '03

At 06:54 PM 11/3/96 -0500, Will French wrote: > I'm quite upset about this. Up to now I was able to tell >people that "there is at least one mailing list on the net that >functions in a completely open manner". No more. This is an easy problem to solve. Run your own list, you can set the policies. There are service providers who will set up/maintain mailing lists for you. If you can't find one, and "quite upset" means >$200/month to you, let me know, and I'll set one up for you. Mailing lists aren't exactly rocket science. Actually, I'm curious exactly how much money "quite upset" means to you. Perhaps you and the others who are also upset can buy Dmitri his own mailing list. You can even subscribe your list to the cypherpunks list, and advertise it as "total freedom cypherpunks", so that subscribers to your list get everything on cpunks, plus Vulis' helpful commentaries. The lesson to learn from this is not "all people are essentially authoritarian" but "one jerk can ruin something good for 1500+ people." Just one turd in the punchbowl, and all that. Doesn't matter if the turd has a PhD, nobody wants any punch. When one person does something which inconveniences or annoys many people (over and over, intentionally) it's unsurprising (and not even "authoritarian", in any useful sense of the word) that someone gets sick of it and tries to correct the situation. Freedom isn't just for assholes; and the name for someone who won't take care of himself (or his mailing list) isn't "friend of liberty", it's "pushover". -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

Any Info for Sen. Pressler....
by Troy M. Barnhart 17 Dec '03

17 Dec '03

If anyone has any specific bits of info on cryptography, etc... please feel free to send it to me... I live in South Dakota... Due to circumstances I occasionally see and speak w/ Senator Larry Pressler - (Committee Leader)... (btw, I am not a Pressler plant or anything...) Been talking to him w/ the Burns Bill and such... He wants less gov't. control, but does have "concerns" w/ the garbage... And, wants to balance the business and private concerns... He is open to any info from a "constituent" though... regards, barney He who joyfully marches to music in rank and file has already earned my contempt. He has been given a large brain by mistake, since for him the spinal cord would suffice. -- Mark Twain E-mail: barney(a)rapidnet.com

1 0

Press Release: Atalla Agreement with RSA
by Geoffrey C. Grabow 17 Dec '03

17 Dec '03

ATALLA INKS AGREEMENT WITH RSA DATA SECURITY INC. TO PROVIDE OPEN CRYPTO-API FOR NEW SET INTERNET PAYMENTS TOOLKIT Atalla's PayMaster Internet Security Processor (ISP) will provide enhanced SET performance and secure key management capabilities for new RSA toolkit-based applications SAN JOSE, CA -November 4, 1996- Atalla, a Tandem Company (r), today announced that it has signed an agreement with RSA Data Security Inc., to develop an open Application Programming Interface (API) that will become a key component of RSA's new SET payments toolkit. The suite of tools from RSA is being built to enable developers to deploy secure SET-capable applications quickly, with transparent access to the strongest commercial Internet security functionality. The new API developed by Atalla, will access the command set to Atalla's PayMaster Internet Security Processor (ISP) product to accelerate SET protocol performance and to manage cryptographic keys securely. The new SET Toolkit suite from RSA is designed to provide banks, cardholders, merchants and application providers with the ability to deploy secure SET- based applications without specialized cryptographic expertise. Atalla will be one of seven companies that will support the RSA SET toolkit. The other companies are Open Market Inc., NEC, Netscape, Tandem Computers Inc., Verifone and Verisign. The SET protocol specifies how cardholders, merchants, issuing banks and acquiring banks will interact to ensure secure payment processing over the Internet. SET relies on specially developed encryption technology from RSA Data Security Inc., and has been adopted by Visa and MasterCard to secure credit card transactions, authorization and settlement information over public networks such as the Internet. "The development of the SET protocol was an important milestone in securing commerce over the Internet." said Robert Gargus, president and general manager of Atalla. "We believe that the combination of new, RSA-based SET tools and the strong security functionality and high throughput provided by our Atalla PayMaster Internet Security Processor will now help transform public networks such as the Internet, into a secure, high- performance payments infrastructure that banks, merchants and cardholders will trust." "We consider integration with the Atalla PayMaster ISP a critical feature of the RSA SET developer's suite," said Jim Bidzos, president of RSA Data Security, Inc. "The Atalla PayMaster, in combination with RSA, will now allow for cost-effective, high- volume SET application servers through greatly improved performance for the underlying cryptography and strong physical protection for private keys. We believe this will overcome a major barrier to the adoption of secure electronic commerce on the Internet." Atalla's PayMaster ISP product was designed specifically to manage the cryptographic requirements specified by the SET protocol. The protocol requires multiple public key operations for each SET transaction. The Atalla PayMaster ISP product offloads these computationally-intensive tasks from server CPUs and isolates private information intended solely for merchants from private information intended solely for banks. This ensures that data cannot be altered at any point in the network, and accelerates the required SET -specified public-and-private key operations. Atalla's PayMaster ISP also provides RSA and DES-based cryptography to provide a high-performance bridge from the Internet to private networks such as the Bank Payments network. About Atalla (a Tandem Company) Atalla (a Tandem Company) brings nearly 25 years of experience securing commerce over private networks to the public networks and the Internet/Intranet arena. The company's products include industry-leading hardware-based security processors for the Internet, Intranet and the bank transfer networks, POS/POE (point-of-sale/point-of-entry) credit /debit payment terminals, customer authorization and PIN selection terminals, and secure enrollment products for banking, retailing and government applications. An estimated 70 percent of all ATM transactions in North America (estimated value: $1.4 trillion daily) are secured by Atalla's specialized security processor products. Atalla is headquartered at 2304 Zanker Road, San Jose CA 95131. Phone: (408) 435-8850. Fax (408) 435-1116. The company's website is located at www.atalla.com. Tandem, Atalla, PayMaster, and the Tandem logo are trademarks or registered trademarks of Tandem Computers Incorporated in the United States and/or other countries. All other brand names are trademarks or registered trademarks of their respective companies. G.C.G. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ | Geoffrey C. Grabow | Great people talk about ideas. | | Oyster Bay, New York | Average people talk about things. | | gcg(a)pb.net | Small people talk about people. | |----------------------------------------------------------------------| | PGP 2.6.2 public key available at http://home.pb.net/~gcg | | and on a plethora of key servers around the world. | | Key ID = 0E818EC1 | | Fingerprint = A6 7B 67 D7 E9 96 37 7D E7 16 BD 5E F4 5A B2 E4 | |----------------------------------------------------------------------| | That which does not kill us, makes us stranger. - Trevor Goodchild | ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Re: FDA_dis
by Murray Hayes 17 Dec '03

17 Dec '03

On Tue, 29 Oct 1996 17:51:56 -0500, Hallam-Baker wrote: >Declan McCullagh wrote: >> >> I'll have to reread John's piece tomorrow (I'm on vacation right now), but >> it doesn't surprise me. He and I have been arguing about this topic via >> email for the last week or so. He takes the traditional liberal view of >> government regulation of drugs is necessary; I take the more libertarian one. >> >> The Cato Institute, BTW, will be putting together a roundtable on this soon. >> >> -Declan > >Characterising this as the "traditional liberal view" is somewhat >misleading, >its not as if Bob Dole or Newt Gingrich would disagree much. The >argument is >more over which special interest group is to be advantaged by changes in >regulation. If I was a citizen of a country where the government was >elected >by a billion dollars of corporate contributions I might be a >libertarian. Are you saying that you are anti-corporation? That would make no sense. Many corporations are very benificial to society. Take Shell for example. It did all that it could to save the life of that guy in Nigeria, but the "libertarians" who instantly boycotted Shell would have you belive that they encouraged the sentence. >Its important to remember that its the World Wide Web and not simply >limited >to the US. As long as US companies set up subsidiaries in Europe they >will be constrained by European law. In the net.age law is becomming a >major >export for many countries. What is becoming a major export? Weak laws? Why would a country encourage criminals to come to it's boarders? >Regulation is not necessarily anti-commerce. UK beef farmers would be >better >off today if there had been more regulation, a weak "free-market" >attitude >to public health has destroyed the entire industry. I don't think you have analysed the situation. It was the regulating that deystroyed the UK cattel industry and put the entire world at risk. The British government protected the beef industry despite a ban on British beef accross Europe. If Eroupe is considered to be the "Free Market" as you suggest, then it would be exactly opposite to what you have suggested. The "Free Market" labled the animals coming from Britian to be of questionable quality. The regualtors in Britian disaggreed because it would cost them a few penny's to slauter the infected heards. Then Britians started getting sick. The rest of the world throws up bans of British beef; Yet the British regulators still do not cleanse the heards. The only way to ensure the desease is gone is to kill every last cow in Britian and bring in fresh stock. THAT MEANS NO GIVING THEM TO INDIA YOU STUPID FUCKS. It is often in a >companies >commercial interest to voluntarily agree to be regulated. Microsoft >recently >signed an agreement to be bound by the European computer privacy >regulations >because by doing so they gained a business advantage - people would >trust >them with their data. This is another interesting point. Why is it better for a company to agree to any regulation? Do you REALLY trust Microsoft? I do not. They write poor code. They probably signed the aggreement because they knew that there product was so bad that it couldn't violate any restrictions or they contracted the work out to the NSA who wrote the code for them and so they know that it can be cracked if they need to track down every last copy of the OS for their marketing group to do a statistical analysis on. > >Much of the advertising regulation being discussed is private, agreement >on >standard formats for image placements for example. There is existing >government >regulation of advertising in many countries however. In particular much >stricter control over advertising of drugs, making misleading statements >in >advertising and so on.In the UK there is regulation of advertising >through >the advertising standards council which is a voluntary body in the sense >that it has no statutory enforcement powers but has practical authority >because the publishers will not publishe ads that fall foul of its >decisions. I belive that this is the GOVERNMENT body called the BBC. We have a similary group up here called the Communist Broadcast Corporation. Actually, I must be fair to them, I do like Air Farce. I don't think your argument holds any water. Different cultures have different social norms. I was quite shocked to see John Clease stark f**king naked on a tea commercial (isn't tea a carrier of caffine? yes. Does caffine change the way in which you body works? yes. Is caffine food? no; therefore caffine is a drug and tea carries that drug.) > >A more serious problem however is likely to be dramatically different >cultural norms. In the US people expect to be lied to in adverts. In >countries >where there is regulation of advertising there is a general expectation >for comparisons to be fair and for ads to be truthful. I'm just waiting >for a major corporation to create an Intel scale PR disaster by applying >sleasly US style marketing techniques in markets where the downside is >very large. One recent example is Hoover which had a $30 odd million >debacle over a "free flights" giveaway that was based on sleasly US >style >marketing techniques. The company ended up having to live up to the >spirit of its offer rather than the letter as it intended simply to >preserve the value of the brand. So? All this proves is that the US is more oreiented toward the free market than other places. In the free market, on's "brand value" is incredibly important. I think you are also missing the distinction between a company and it's marketing. I'm sure Hoover, as in your example, has many marketing camnpaines going on at any time and that every so often an overeager director of the comapany that Hoover hired to do the campain makes a mistake. I'm sure this happens all the time, just take a look at another marketing company: Microsoft. > >If you don't believe in anti trust laws there is no basis on which you >can object to the sort of regulation by cabal that the advertising >standards council represents. Of course such cabals cannot exist in the >libertarian belief system since their existence is denied a-priori >by invoking the spirit of Milton Freedman. Milton Freedmen is of course >a rightwing ecconomist whose theories are widely admired by free >market ecconomists who admire Mitlon Freedman. Does that mean a libertarian is more Free Market oriented or more Command Market oriented? I'm not sure there is any correlation at all. I belive in anti trust laws, does that mean I can object to regualtions? mhayes(a)infomatch.com It's better for us if you don't understand It's better for me if you don't understand -Tragically Hip

3 2

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp pgponly hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord ?"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord middle ?"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. remailer(a)crynwr.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The winsock remailer does not accept plaintext messages. The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. Last update: Mon 4 Nov 96 6:49:04 PST remailer email address history latency uptime ----------------------------------------------------------------------- jam remailer(a)cypherpunks.ca ************ 14:34 99.99% winsock winsock(a)c2.org --.--+----- 5:02:13 99.84% squirrel mix(a)squirrel.owl.de +++---++--- 2:35:51 99.76% lead mix(a)zifi.genetics.utah.edu +++++++- ++* 37:17 99.62% extropia remail(a)miron.vip.best.com -.------.-- 10:08:19 99.60% lucifer lucifer(a)dhp.com +++++++++ + 41:39 99.31% replay remailer(a)replay.com +******+++** 7:48 99.16% balls remailer(a)huge.cajones.com ******** *** 5:25 98.82% exon remailer(a)remailer.nl.com *##* **++# # 1:51 98.59% middle middleman(a)jpunix.com + +++ - +- 1:34:45 98.17% cyber alias(a)alias.cyberpass.net +***** + * 34:08 98.12% dustbin dustman(a)athensnet.com +-++-+-- -- 1:22:20 97.96% haystack haystack(a)holy.cow.net #+****-++# 3:00 86.77% mix mixmaster(a)remail.obscura.com ++ 1:30:30 47.85% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0