December 2003 - cypherpunks-legacy

Re: Checkout the crypto in IE 4.0
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

>Maybe people have already noticed but the pre-release IE 4.0 has >S/MIME encryption and signatures built in. I'm trying to set it up >as we speak. Just found an even more important cypherpunk feature. It has a kill file feature for both news and mail. Now if we could just get them to put Dimitri in as the default it would be fine. Phill

1 0

security_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ Thursday April 10 10:03 AM EDT Internet Security Code Said Vulnerable To Hackers By David Morgan ATLANTA - The new security protocol for safeguarding credit-card transactions on the Internet may have to change because the underlying cryptography is too easy to hack through and too difficult to upgrade, an expert says. Steve Mott, senior vice president of electronic commerce and new ventures for MasterCard International, said it could take hackers as little as a year to break the industry's standard encryption code, which is supposed to render credit-card numbers unreadable to outsiders on the Internet's World Wide Web. For that reason, the consortium of technology companies and creditors that has spent two years developing the Secure Electronic Transaction (SET) protocol may switch to a faster encryption system called Elliptic Curve, which is produced by Certicom Corp. The first complete version of SET, known as SET 1.0, will be available to software makers June 1 with core cryptography provided by RSA Data Security, a unit of Security Dynamics Technologies. "RSA is a very good starting point. But we suspect that in a year or two, the Kevin Mitnicks of the world will start to figure out ways to hack it," Mott said. Mitnick is one of the most notorious computer hackers. "The only way you scale an RSA is to add a lot more bits. You add a lot more bits and it becomes more complex software in terms of the interaction of the transaction messages. That's part of what's taken SET so long to start with." MasterCard has been helping put together merchants with its own member banks for SET pilot projects in Denmark, Japan, Taiwan, South Africa and the United States. Mott told a news conference at the Internet Commerce Expo that the Elliptic Curve encryption system would make a better encryption core. In fact, he said it would have been chosen in the first place if developers had been known about it. "It will fit on a chip card. I think its 160 bits equals security to 1,024 bits of RSA," the credit industry executive said. "We anticipate putting it into some SET 1.0 pilots in the very near future this year in the U.S." Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Digital TV Sets Off High-Definition Race Next Story: NTT Data, MCI To Start Internet Roaming Service _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

EVENT! Rep. Anna Eshoo (D-CA) holds online town hall meeting April 16!
by Shabbir Safdar 17 Dec '03

17 Dec '03

========================================================================= _ _ __| | ___ _ __ ___ ___ ___ _ __ __ _ ___ _ _ _ __ ___| |_ / _` |/ _ \ '_ ` _ \ / _ \ / __| '__/ _` |/ __| | | | | '_ \ / _ \ __| | (_| | __/ | | | | | (_) | (__| | | (_| | (__| |_| |_| | | | __/ |_ \__,_|\___|_| |_| |_|\___/ \___|_| \__,_|\___|\__, (_)_| |_|\___|\__| |___/ "Government Without Walls" _________________________________________________________________________ Update No.5 http://www.democracy.net/ April 10 1997 _________________________________________________________________________ Table of Contents - Join Silicon Valley Internet Policy Leader Anna Eshoo (D-CA) Live April 16. - Background on Rep. Eshoo - democracy.net statistics - About democracy.net ___________________________________________________________________________ JOIN SILICON VALLEY INTERNET POLICY LEADER ANNA ESHOO (D-CA) Live ONLINE! Representative Anna Eshoo (D-CA), walks point for Silicon Valley on Internet policy issues. Her career has been marked by outspoken positive positions on Internet policy, but also for her groundbreaking work of making the Internet a tool for servicing her constituents better. Rep. Eshoo will hold a live online interactive 'town hall meeting' at democracy.net on Wednesday April 16 at 8:30 pm Eastern (5:30 pm Pacific). The town hall meeting, moderated by Wired Magazine's Todd Lappin, will be completely virtual. The discussion will be cybercast live via RealAudio, and listeners can join a simultaneous interactive chat discussion and pose questions to Rep. Eshoo. This is a unique opportunity for Internet users to discuss current Internet issues, including how Congress can better communicate with the public using the Internet, the chances for online speech legislation in the 105th Congress, Congress' agenda for encryption policy reform, and others. Details on the event, including instructions on how you can submit questions in advance, are attached below. ____________________________________________________________________________ INSTRUCTIONS ON HOW TO PARTICIPATE * Interactive Town Hall Meeting with Rep. Anna Eshoo (D-CA) * DATE: Wednesday, April 16, 1997 TIME: 5:30 pm Pacific / 8:30 pm Eastern LOCATION: http://www.democracy.net In advance of the town hall meeting, please visit http://www.democracy.net and fill out the form to ask Rep. Eshoo a question. We will collect the questions and forward them to the moderator on the day of the event, and will make every effort to ensure that questions from constituents are asked first. 1. Attend and ask Rep. Eshoo a question! Please mark this date in your calendar: Thursday April 16, 5:30PM Pacific at http://democracy.net/ 2. Get your friends and co-workers to join the discussion Members of Congress love to hear from their constituents. If you have friends that live in the district, please forward this invitation and encourage them to attend. 3. Make sure you have the right software To participate in the chat, you will need two pieces of software besides a Web browser. To listen to the _____________________________________________________________________________ BACKGROUND "We need to send a clear, unscrambled message to Washington that our nation's encryption policy needs to be reformed, and reformed now." -- Rep. Anna Eshoo (D-CA), SAFE Forum, July 1, 1996 Given the 14th District's concentration of high-tech industries, it is not surprising that Rep. Eshoo serves on the House Committee on Commerce. Her subcommittee assignments on this committee include the Subcommittee on Telecommunications, Trade, and Consumer Protection, as well as the Subcommittee on Health and the Environment. The Commerce Committee has policy making power over high technology, biotechnology, public health, and the environment. Through her seat on the Commerce Committee, Rep. Eshoo is well positioned to assist high technology interests in her district. She fought hard to ensure that securities litigation reform and telecommunications reform were signed into law. Rep. Eshoo has introduced the Online Parental Control Act to fight government censorship and encourage parents to use technology to control their children's access to online materials. She has led the fight to improve the Food and Drug Administration's product review process and played an instrumental role in securing the $238 million B Factory for the Stanford Linear Accelerator Center. In addition, Rep. Eshoo has pushed to loosen costly export controls on high technology products, make NASA contractors more liable for the costs of failing to comply with their contract requirements, and prevent government laboratories from competing with private industry. She also played a key role in stopping the Financial Accounting Standards Board from adopting a rule requiring businesses to charge stock options against earnings, a move which could have seriously curtailed the growth of small firms and start-up businesses, particularly in the high technology industry. Additional Information can be found at the following locations: * Rep. Anna Eshoo's Home Page -- http://www-eshoo.house.gov/ * democracy.net Page -- http://www.democracy.net/ _______________________________________________________________________________ DEMOCRACY.NET STATISTICS In the two weeks following the original Pro-CODE cybercast hearing, over eight times as many people (804) listened to the RealAudio archive than could have fit into the room at the hearing itself! The hearing transcript continues to be extremely popular, with the testimony of Jim Barksdale (CEO, Netscape) and Louis Freeh (Director, FBI) counting as the two most popular hearing witnesses to listen to. Over a quarter of our visitors to the hearing archives stop to listen to Barksdale and Freeh's takes on the encryption debate. Whether you're a concerned citizen who can't get to Washington, a student researching the topic of privacy, or a reporter just following the debate, these archives are here for you. You can experience Government Without Walls at the March 19th hearing cybercast archive at http://www.democracy.net/. _______________________________________________________________________________ ABOUT DEMOCRACY.NET The democracy.net is a joint project of the Center for Democracy and Technology (CDT) and the Voters Telecommunications Watch (VTW) to explore ways of enhancing citizen participation in the democratic process via the Internet. To this end, democracy.net will host live, interactive cybercasts of Congressional Hearings and online town hall meetings with key policy makers. democracy.net is made possible through the generous support of WebActive, Public Access Networks, the Democracy Network, and DIGEX Internet. More information about the project and its sponsors can be found at http://www.democracy.net/about/ To receive democracy.net announcements automatically, please visit our signup form at http://www.democracy.net/ _____________________________________________________________________________ End update no.5 04/10/1997 =============================================================================

1 0

Re: store your private ke
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:bryce@digicash.com to Harka <=- In> The non-cpunks that I talk to frequently say that "no bad guys In> would bother to read my e-mail". This is a pretty good assumption, In> because it takes into account (as the cpunks themselves frequently In> fail to do) that there is a _cost_ to illicitly reading e-mail, and In> that as long as the value of reading your private e-mail is less than In> the cost of reading it, you can consider yourself safe. Another point, that most PGP-"uninitiated" (challenged? :)) people fail to realize is the non-individual-based approach to e-mail snooping. Commonly people think, that first they have to be specifically targeted by a "bad guy". But in the times of Echelon and generic key-word-based filtering of _all_ e-mails, that go through certain points (Satellite-Links etc.), nobody has to be specifically targeted anymore, because _everybody's_ e-mail is potentially read. All other things you mentioned are of course valid too besides that. Ciao Harka ... Microsoft - "Where do you want to crash today?" ___ Blue Wave/386 v2.30 [NR] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM02gpjltEBIEF0MBAQFy4wf/QIx7s1iRBDIW7VXYFWN6T5xlO2stm7QI +Cl8dz7ZL24nMazVUA+I0GqJjpjEOY7bK5oZwbELTaaD6g6unjoZLb6n5/fiXeaN Dd7LdJ989oqmUxO2fm6F/81OqPIGHQl5UwqOj0hII4AndaIwMJB/kSENXXJXXupI 7G/HWWddSnCzeuTfAzYBUeo1cpAgsBP7zTqyQsVUtoGVhgwbRsdUBX1kqcR7cEsv SX+TZZJZAs9AxTlIoQBuP4hb5/aEZnahb8myomKVY9XbMLBRdFzw6YlF2u/hHyit OqMzn12QVKkflxbMQWj3qCLARuT2wKEg6TeHUFAReSgIV1YSNV2Xsw== =Au+6 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: anonymous credit
by Hal Finney 17 Dec '03

17 Dec '03

Wei Dai, <weidai(a)eskimo.com>, writes: > The idea goes like this. The government announces a new series of > anonymous zero-coupon treasury bonds that mature in 10 years, backed by a > special lump-sum tax to be collected when the bonds mature. The proceeds > of the bond auction and the tax are distributed equally among everyone. > So basicly, the government forces everyone to take out a loan on the > credit market and guarantees its collection. Anyone who does not want the > loan anonymously buys treasury bonds with all of his distribution, holds > them for 10 years, redeems them at maturity and uses the proceeds to pay > off the lump-sum tax. I think this is a very intriguing idea. Let me try to spell it out in more detail with some concrete numbers. A zero-coupon bond is one with a purchase price less than its face value. After the maturation of the bond, it can be redeemed for its face value. The purchaser of such a bond is loaning money to its buyer, and he will be paid off at the end of the loan period with more money than he put in. For a ten year bond, maybe the purchase price is 1/2 its face value. A $1000 bond would be purchased for $500, and redeemed in 10 years for $1000. An "anonymous" bond would be a bearer bond, one which is sold without any record of who bought it, and which can be redeemed at maturity by whomever holds it. In the example above, the U.S. government sells, say, $1 billion worth of these 10 year zero coupon bonds. It will have to pay back $2 billion in ten years at maturity. The $1 billion in revenues is then distributed evenly to everyone in the country. Assuming a population of 250 million, each man, woman, and child gets $4. In ten years, in order to pay off the redeemed bonds, $2 billion of special taxes will be collected. This will amount to $8 per person. As Wei says, each person in the country (who doesn't participate in the bond sale) is given $4 now, and must pay $8 in ten years. In effect he is given a $4 loan, payable in ten years. If he does not want that loan, he can take his anticipated $4 and buy $4 worth of the bonds during the bond sale. This produces no gain or loss of money, but he gets the bond. Then, in ten years, he turns in his bond for $8, and uses that to pay off the $8 in taxes. He ends up without any change in his financial state, neither loaning nor borrowing money. (There is a slight complication in that at the time of the bond sale, people who want to offset their loan with a bond purchase won't yet have the loan funds to buy the bond; and at the end, people want to pay off their tax with the bond redemption, but the government can't redeem the bonds until it collects the tax. I'm not sure if this is a serious problem or not.) Now, if this picture is correct, this isn't exactly how I would have thought of an anonymous loan. The people receiving the distributed revenues from the bond sale are essentially borrowing money from the government. Every borrower is identified, and must pay back his loan in ten years via his taxes. So the loans are fully identified and not anonymous. What does happen though is that some (or most?) of the people can offset their loan by anonymously lending money (buying bonds). In effect they have borrowed money from the government, non-anonymously, but then have the option of lending all of it back, anonymously. At the end, it is impossible to know which people have retained their loans and which people have cancelled them. So you don't know who has borrowed money, and this therefore is effectivelly equivalent to an anonymous loan. > The fatal flaw, of course, is that there is no reason why the government > would want to help people get anonymous loans. Can anyone find a way to > fix this? Maybe a non-governmental body could be used in place of the government. Suppose a group of people wanted to allow some members to borrow money anonymously. For example, a church group wants to help members through tough times via loans, but they don't want the recipients to be identified and bear the stigma of needing charity. Wei's idea could still be used: the church sells its own bonds, redeemable at some future date for more than the face value. The funds from the sale are distributed evenly to all members. Members who don't want to borrow make purchases at least equal to their receipts. Then, after the time period, everybody has to pay a special membership fee ("tax") so that the bonds can be redeemed. If some people can't pay, the other members will have to be willing to pay more to cover their defaults. One practical problem with this idea is that the amount of money loaned per person is small compared to the volume of transactions going on, especially for large groups. In my example above, each person only anonymously borrowed $4, given $1 billion worth of transactions. That's a lot of paperwork with associated transaction costs for a small value. With smaller groups the idea might actually be more practical, although there is less anonymity then. Hal

2 1

Your Site Builder Network Membership!
by Site Builder Network 17 Dec '03

17 Dec '03

Welcome to Site Builder Network - Level 1. We went to your site(s) and found the Microsoft Internet Explorer logo and link, so your membership has been upgraded to Level 1. You now have access to the Members Only - Level 1 Lounge as well as the Members Only Download Area. Please take some time to visit http://www.microsoft.com/sbnmember/lounges/lounges.asp to see what's in store for you. Your ID and password are listed below for your convenience. Do you think you qualify for Level 2? Would you like to? The reason your Level 2 registration failed could be one of the following reasons: You are not using an ActiveX control. ====================================== To find out more about ActiveX, go to our home page at http://www.microsoft.com/sitebuilder/ and click 'Technologies' at the top of the page. Choose 'ActiveX' and you will find all kinds of ActiveX resources. Or, download the ActiveX Control Pad from the download area and add an ActiveX control to your site without a vast knowledge of html code! After you have added an ActiveX control and you are ready to upgrade your membership to Level 2, go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which are listed below). This will bring up your registration information. Be sure to list the exact URL where the ActiveX control is located as well as the exact URL the IE logo is located, and we will check your site again. In the meantime, enjoy your Level 1 benefits and we will notify you of your Level 2 status within 5 days. You did not register the exact URL where the ActiveX control is located. ====================================== Our automated system can only check pages, not entire sites. Please go back to http://www.microsoft.com/sbnmember/apply/apply.asp , click 'upgrade your membership' then enter your ID and password (which is listed below). This will bring up your registration information. Be sure to list the exact URL where the ActiveX control is located as well as the exact URL the IE logo is located, and we will check your site again. In the meantime, enjoy your Level 1 benefits and we will notify you of your Level 2 status within 5 days. Once again - welcome to Level 1, and enjoy your Site Builder Network benefits. The Microsoft Site Builder Network Team ======================================== ID: 643361 Password: WRITECODE ======================================== Sites Checked: www.enter.net.mx Result: Connected OK / Link to MS Found / No ActiveX Control Found

1 0

Grouchy Old Cypherpunks
by Toto 17 Dec '03

17 Dec '03

Kent Crispin, whose sense of humor indicates he may not, after all, be a government Bot, wrote: > On Thu, Apr 10, 1997 at 12:27:29PM -0800, Timothy C. May wrote: > [...] > > By the way, I'm staying out of this latest tamper-responding device > > argument. I worked on this at Intel, actually. But I wrote a bunch of > > fairly long articles on this the 5th, or maybe it was the 7th?, time this > > came up, circa 1993. Those who refuse to learn from the threads of the past > > are condemned to repeat them. > > Let's see, to which would I rather be condemned: participating in a > lively, current discussion; or digging through musty outdated archives? I regularly cruise back through my archives of the CypherPunks list from as far back as the early 90's and I rarely find them outdated. And rather than being pretentious, I usually find them 'portentious'. > Yes, we could continually mine the archives for words of wisdom from > past participants, and thus pay them homage -- especially since it is > so painfully obvious that is what they crave. But we should forgive > them this weakness, for at some lonely age we all start wondering > about our legacy. There is, however, a far cry of difference between those to whom homage is due, and those to whom it is not. As much as I may have railed against the fascist censorship of the 'moderation experiment' badly instituted by John Gilmore, I am not ungrateful for the years of time and effort that he spent in hosting the CypherPunks list, and stated so in a post to the list before it moved on to new homes. Not knowing Tim May personally, I cannot comment on the description of him in the press as 'crusty' (not knowing if it refers to his personality or his sexual hygene), but I can see how a review of some of his recent posts might suggest that he would not be out of place in a remake of 'Grumpy Old Men'. However, his propensity for taking an attitude of 'been there, done that' (and spanking young pups on the list) in no way negates the fact that he 'has', in fact, been there and done that, and that his (somewhat vague) pointers to sources of information in regard to various list issues might prove valuable to those who have enough interest in the issue to want to indulge in a little research on the matter. While the discussions of those currently active on the list may be enlightening, there are certainly other CypherPunks (some active, some inactive) who have dealt with current issues in the past, and done so from a perspective and knowledge base that are equal or superior to those who are participating in current discussions. While Tim is certainly an icon on the list, I haven't seen any signs of senility seeping in, just yet. {From: "Timothy C. May" <tcmay(a)got.net> Subject: Has anybody seen my shoes? I lost my shoes! } (OK, maybe a couple of signs..:) While I sometimes feel that the list would be better served by more of the long-time members being a little more specific in their aide to more inexperienced members seeking information, there is no doubt that much of the input they do provide is useful enough to point those seeking a better knowledge of crypto and crypto issues in directions which can bear much fruit if the individual is sincere enough to follow their pointers. Tim's legacy is already written in CypherStone, regardless of what he may or may not do in the future, as is that of Gilmore and Hughes. Despite whatever battles you or I may engage them in, in the future, we will be telling our grandchilren, "Hey, I <spit on>/<farted at>/ <kissed> him." when the movie 'Grouchy Old CypherPunks' hits the big screen. -- Toto "One TruthMonger down, four to go"

1 0

Re: Reporters, Declan, Columns, Articles, and Angles
by Ross Wright 17 Dec '03

17 Dec '03

On or About 10 Apr 97 at 19:09, Dr.Dimitri Vulis KOTM wrote: > "Phillip M. Hallam-Baker" <hallam(a)ai.mit.edu> writes: > <doesn't matter what, 3 times> > > That's $3 for Sinn F\'ein. Thank you, Phil. > > P.S. Fuck your Queen. Free Rule for Ireland!

1 0

Re: store your private key on a multi-user system! use pubkeys without verifying them!
by Toto 17 Dec '03

17 Dec '03

Bryce wrote: > > The non-cpunks that I talk to frequently say that "no bad guys > would bother to read my e-mail". > as long as the value of reading your private e-mail is less than > the cost of reading it, you can consider yourself safe. Bad, bad assumption. > So my points are as follows: > 2. To the cpunks: the _value_ of invading your privacy is not that > high. There are no evil storm troopers whose full time job is to run > a man-in-the-middle attack on your PGP public key, or dedicate a > cracking farm to decrypting your messages, or using TEMPEST devices > on your home computer or whatever. Therefore, simply encrypting your > personal e-mail with a 512-bit PGP key, storing your private key on > your local multi-user Unix system, and using people's public keys > _without_ doing anti-Man-In-The-Middle techniques is more than > sufficient to protect your privacy. Horseshit. Send me all of the email and files from the hard drives of the NSA, CIA, FBI, and the organizations we don't know about, for the last 20 years, and then we'll talk about what evil storm troopers do, or do not, exist. Then we can begin to talk about what really trips up most fugitives/criminals/freedom-fighters--the mundane. J.Edgar Hoover didn't rise from the grave to entrap the UnaBomber with high-tech devices and an army of spooks. His own family turned him in. Four guys broke into a Vancouver bank a few years ago, spent the weekend cracking the vault and safety deposit boxes, and made a clean getaway, except one of their suitcases broke open on the trip out of town, spilling the goodies for everyone to see. They sat in jail until Monday morning, when the banks opened, and the cops could figure out who they robbed. > Now, if you use your e-mail to transmit really _valuable_ data, then > that is a different story. I submit that everyone has _really_valuable_data_, no matter what value others put on it. I would guess that there are no shortage of people who would rather have their company's data compromised, than have their spouse find their secret love-letters. The key is to be as meticulous as possible in your security precautions, because those things you have little knowledge of or control over may well be more dangerous to you than those that you don't. Case in point. I spent twenty years of my life making sure that I had extra 'butts' on me at all times, so that I would not have to face my greatest fear--going to jail without a suffiecient supply of nicotine. The one time I slipped up was when I was on 'safe' ground, in my hometown, crossing a border I had crossed every day for the last few weeks with no trouble. Then I got hauled in for a 'bad check' that was a result of a clerical error. I actually had the cancelled check in my motorhome, but the facts didn't matter--I was headed for the slam with almost no butts. An understanding Sheriff's deputy with a couple extra packs probably saved me from the death penalty for killing cops to escape and go get more butts. When you decide that you've got nothing to worry about, because the 'bad guys' aren't after you, then the 'good guys' will get you. Your wife will hire a teenage hacker to look for the secret love letters that don't exist, and turn up unrelated info that the kid will use to get a sweetheart deal when the Feds break down 'his' door. Your employer's audit of the books will point to you being a thief, and in the process of proving you innocent, will turn up evidence of your office affair, giving your spouse grounds for divorce. The people who get fucked aren't the people who 'deserved' it. They aren't the people who 'took crazy chances'. They aren't the people who 'had the most to hide'. They are the people who got fucked. The bottom line is, if you have something to hide, then hide it, and hide it well. You can be faster than a speeding bullet and leap tall buildings in a single bound, but somewhere out there is a bum going through a dumpster, and he just found a funny, glowing, green rock. -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/xenbody.html

2 1

Microsoft Site Gestapo
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

At 08:53 PM 4/10/97 -0700, you wrote: >Welcome to Site Builder Network - Level 1. > >We went to your site(s) and found the Microsoft Internet Explorer logo >and link, so your membership has been upgraded to Level 1. You now have >access to the Members Only - Level 1 Lounge as well as the Members Only >Download Area. Please take some time to visit >http://www.microsoft.com/sbnmember/lounges/lounges.asp to see what's in >store for you. Your ID and password are listed below for your >convenience. > >Do you think you qualify for Level 2? Would you like to? The reason >your Level 2 registration failed could be one of the following reasons: > >You are not using an ActiveX control. >====================================== >To find out more about ActiveX, go to our home page at Fuck you.

2 1