December 2003 - cypherpunks-legacy

Re: Bypassing the Digicash Patents
by Robert Hettinga 17 Dec '03

17 Dec '03

Someone, whose reputation is bigger than God, in the hope of sparing me public humiliation from the error of my ways (the very paradigm of a lost cause :-)), wrote to me offline on this topic. I'm posting it here, because frequently people reply to me with stuff which is extremely relevant to the argument at hand, and which should be heard in public. The main consideration I use is that none of the information in the reply can be used to identify the person who sent it, or mess up whatever plans they're laying, something you can clearly see in the following... At 4:48 pm -0400 on 5/3/97, somebody wrote: you write: > > I further claim that the most efficient digital bearer certificate is an > > anonymous one. > > Hal's point is this. There are two types of "anonymity": one where > the bank says "I swear I won't keep any records based on the name > you gave me" (the benign bank), and the other where we use Chaumian > blinding so the bank never even sees the identity information (the > untrusted bank). Right. Let's call the first one the Microsoft model, because I feel especially vicious this evening, and the second one the "Real" Chaum model. > Now, it seems to me that the "benign bank" sort of anonymity can't > cost any more (and in fact will even cost less) than the "untrusted > bank" Chaumian anonymity. Not true. With Chaumian anonymity, all the underwriter does is keep a database of spent digital bearer certificates, which they keep down by expiring certificate issues and the keys which generate them periodically. When someone double-spends a certificate, the underwriter has enough information to reveal their public key, but only when someone double spends and not before. With the Microsoft model, the underwriter knows who's buying your certificates, *and* the shared secret which makes the cash valid, *and* what time the certificate was issued, *and* what your shoe sizes, and the name of your sister's first date, and, and, and,... Anyway, I claim that the very Chaumian inability to *ever* know who bought the certificates you underwrite keeps you from ever *trying* to keep track of any other data, which, of course, is inherently cheaper. > Yet your arguments for anonymity apply > equally to both situations. No they don't. There's a qualitative difference between a system where you can't ever know who some one is, but you can still trust them, and a system where you always know who someone is and they have to trust *you*. :-). I say that one of the additional virtues of the former system is significantly reduced transaction costs, and finally, that that happy side effect will eventually result in a shift away from the latter kind of system, if it ever is useful to begin with. By the way, an additional cost of the system, which is obviously more in line with the privacy concerns of cypherpunks, and possibly less germaine to the transaction cost issue we're discussing, is the cost of the risk of breaking the confidentiality of systems like the Microsoft idea. I have a hunch that all it takes is one big information leak, and such systems will be dropped as a form of digital cash underwriting, but I'm going pretty far out on a limb to make that particular assertion. Should we call this the "Clipper effect", just to rattle peoples' chains? > Therefore, I say your arguments, taken > to their logical conclusion, imply that we'll end up with "benign > bank" anonymity, rather than Chaumian "untrusted bank" anonymity. Again, I don't think so. However, what we really need is some actual estimates and analysis to prove it, barring the existence of any actual transaction cost data, of course. :-). Something I'm not qualified to do, though I bet there are people here who can get those answers. > But "benign bank" anonymity is a very very weak form of anonymity > indeed -- it's not what most cypherpunks (or cryptographers) mean > when they talk about anonymous digital cash. Amen. Only people mired in the book-entry way of looking at things think otherwise. I believe the economics of the marketplace will soon teach them the serious errors of their ways... > "Benign bank" anonymity > is the sort of thing that Cybercash or other traditional systems > provide; "untrusted bank" security is what Digicash provides. And, again, I assert that the paradox of all this is that the cheapest form of commerce is a form where you don't trust anyone, or, better, trust, but verify, everyone. That's the beauty of the blind signature algorithm, it allows you to do all that, and not keep books, which cost money. > So, if I understand your argument correctly, you're saying that > we'll inevitably end up with some weak form of anonymity, but it > will be far weaker than what most cypherpunks want. I hope you can see by now, after I've taken another shot at explaining it better, what I was getting at. > That sounds more like a cause for a call to arms than a reason to > sit around reassuring ourselves that everything will turn out fine > without us! Nah. I don't do calls to arms. It's much better to change the world by making money. An especially important focus to have when you're building transaction systems. :-). I strongly beleive that you can easily knock three, maybe four, decimal places off the cost of any transaction you can care to mention just by using strong financial cryptography and anonymous digital bearer certificates on a ubiquitous geodesic network. That remains to be seen, however. I will say that I'm working as hard as someone with my limited skillset can to prove that hypothesis. :-). Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

1 0

Ready for PrimeTime: FUD! The Newsletter of Fear Uncertainty and Doubt
by geeman 17 Dec '03

17 Dec '03

See this new exciting venture. Cards and Letters Welcome; use "FUD" in the subject header. www.best.com/~geeman

1 0

YOU ARE APPROVED!
by YES!＠netcom.es 17 Dec '03

17 Dec '03

$4000 MAJOR CREDIT CARD... GUARANTEED!! EVERYONE QUALIFIES...UNSECURTED CREDIT CARD!!! * NO Credit Checks! * NO SSN Number Required! * Major Credit Card $4000 Limit, UNSECURED!! * 4.95% Interest Rate Per Annum! * LINE OF CREDIT...$15,000 UNSECURED, 5.95% Interest Rate Per Annum! * Offshore For Complete Financial Privacy! * WORLDWIDE Acceptance At More Than 8 MILLION Locations! * INSTANT CASH ADVANCES At More Than 350,000 Banks & ATM's!! * MLM With $25.00 Fast Start Bonus! * 3X6 Forced Matrix... With High Demand, You'll Fill It Within 30 Days!! ABSOLUTELY GUARANTEED!!!!! For complete information AND application go to: FAX ON DEMAND: 415-273-6168 Doc# 1 ************************************************************* *IMPORTANT* In order for your application to processed properly, please use sponsor id# 542 ************************************************************* ABSOLUTELY GUARANTEED!!!!!

1 0

No Subject
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Quoting: http://www.msnbc.com/onair/nbc/mtp/default.asp Tune in to Meet the Press with Tim Russert on Sunday... check local listings for details. Sunday: Meet the Press will look at crime, terrorism, national security, and foreign campaign contributions. Moderator Tim Russert will speak with FBI Director Louis Freeh. This week's panelist will be NBC's Pete Williams, and the roundtable guest will be Elizabeth Drew, author of Whatever it Takes. Meet the Press transcripts are usually available three hours after the show airs.

1 0

Re: Artikel about XS4ALL in New York
by Paul Bradley 17 Dec '03

17 Dec '03

On Fri, 2 May 1997, tank wrote: > "A few years ago, we would have been portrayed as a band of dangerous > anarchists, bent on disrupting society," Rodriquez told the Dutch daily > Trouw. "But now they have come to see that we are nice and quiet people > really." The only "nice people" are dangerous anarchists bent on destroying governments and buggering poloticians to death. (last part a personal preference of course, the author is totally straight but would nonetheless be distinctly amused to see any government official butt-raped to death) > The company was instrumental in the creation of the Amsterdam Digital > The hotline is run by Internet users and providers. Unlike Britain's > Internet Watch Foundation, the Dutch hotline doesn't censor any > information nor does it ask the provider to do so. Hotline operators > contact the author of the information and ask him to remove the > offending content. "If the author does not comply, we report him to > the police, and he'll be prosecuted," said Rodriquez, who also is > chairman of the Dutch Providers Association. How very benevolent. Its nice to know that instead of censoring your pages they send in the jackbooted thugs to do it for them, then throw you in a nice 6x9 cell for the henious crime of displaying some .gifs or similar. > "The Internet Watch Foundation forces the provider to remove the > illegal content," he added. "This is a fundamentally different approach > to responsibilities on the Internet. We think the author of the > information is responsible for his own actions, not the provider." And if he chooses not to remove the content you happen to find offensive? If you truly believed in the rights of the author and publisher of the information you would think about it before sending in your own particular brand of thugs to "crush the mutiny". > Yet when violation of the law is flagrant, XS4ALL doesn't hesitate to > comply, as it did a few weeks ago when it shut down a customer's home > page called Neuroroom, which sold marijuana and other soft drugs in > Holland and abroad. Sometimes one really wonders why we bother to set up mirrors to allow freedom of information to users, when the owners of these servers, supposedly in favour of free speech, do not even have the strength of character or conviction to decide for themselves what they will allow on their servers rather than bending over for the long cock of the law... > The company's commitment to support free expression and democratization > of the Internet doesn't stop here. As far as I can see it hasn`t even started yet. > Last fall when the Serbian > government censored radio station B-92, XS4ALL helped design an > Internet campaign and started to carry news broadcasts (in RealAudio > format) that kept the rare opposition voice alive and the international > public informed through independent accounts of the events occurring > during the mass demonstrations in Belgrade. I presume B-92 fell into line and matched the "requirements under law for obtaining a free-speech permit" before XS4ALL allowed this/ > "Basically any project we like gets free resources from XS4ALL," > Rodriquez commented. And anyone who guarantees to publicly lick the boots of the benevolent owners in thanks for their support gets as much free space as they like? Of course I believe in the right to free expression of anyone and if these thugs choose not to allow material they don`t like on their servers they have every right to remove it. I just don`t see that setting up mirrors to defeat blocks on sites that refuse to carry certain content is of any value in the fight for free speech. Sure, create a mirror of Radikal, but giving any credit or attribution to XS4ALL seems to be a poor choice. Paul "Still messing with mail apps so totally .sig-less" Bradley

3 3

Re: Privacy news: Oakland Cameras, Levi employee files, FileGate
by geeman 17 Dec '03

17 Dec '03

At 06:35 PM 4/30/97 -0700, Bill Stewart wrote: >It's been a busy day for privacy issues in the Oakland Trib. > >Surveillance Cameras in Oakland >------------------------------- >Bay Alarm is trying to sell the City Council a $500K-$1.5M closed-circuit >TV system for watching people in public places. The three picknickers >didn't litter, but the camera mounted on the public library building could >zoom in enough to that the council could tell a ham sandwich from roast beef, >and whether the two joggers were wearing Nikes or Reeboks. >"Anybody who is a law-abiding citizen is not going to be concerned about >this.. >"When I'm out in a public place.... I don't have an expectation of privacy" >said Councilcritter Nate Miley (East Oakland/Elmhurst), who wants a test run >in his district, where residents have bars on their windows and are afraid >to go out at night. Police Chief Joseph Samuels likes it too. >"This is technology spying on our citizens from camera on light poles" >said John Crew of the ACLU police practices project, speaking against it. >Bay Alarm said that some British cities have dealt with privacy fears by >setting up monitoring centers away from city and police offices, >where tapes are kept in case a crime occurs -- crime victims can call up >the police and ask them to play back tapes, said Mark Demier of Bay Alarm. >The camera systems are also capable of taking pictures in the dark. > Brief radio piece on the red-light cameras in S.F. --- red-light running appears to be down at the 4 intersections where cameras are installed; some well-placed official was quoted as saying "The cameras are definitely having an effect on people's behavior." Yes, a Good Thing. They are continuing to move forward with plans to install more cameras. This is fine for red-light-running. I'm just worried about the day when the cameras have an effect on people's behavior with respect to what they say, whom they associate with, the clothes they wear, the thoughts they think... How do you hack a camera?

8 8

Full Strength Stronghold 2.0 Released Worldwide
by sameer 17 Dec '03

17 Dec '03

For Release May 5, 1997 C2Net Software: Douglas Barnes +1 510 986 8770 UK Web: Dave Williams +44 113 222 0046 Full-Strength Stronghold 2.0 Released Worldwide C2Net President Sameer Parekh Rejects Weak Keys, Back Doors Oakland, CA - C2Net Software, Inc. annouced today the worldwide availability of Stronghold 2.0, a major upgrade to their secure web server based on Apache. With this release, Stronghold has added more functionality than ever, including uncompromised security, web-based configuration, and new protocol support. "The Stronghold web server -- like all C2Net products -- supports full-sized keys, and will never support government back doors," said C2Net president Sameer Parekh. "We have development teams around the globe working on our products, free from US export control policy. Even if some of these countries cave in to US demands, we'll still be able to produce first-rate, uncompromised security products." Others Use Compromised Security In a recent announcement, Netscape Communications announced plans to include government back doors in their products. "By implementing this so-called 'key recovery', Netscape is getting a small increase in key length in exchange for putting your keys in the hands of the government," said Parekh. "This the same government that hired Aldrich Ames, the same goverment that has IRS employees surfing taxpayer databases at will. What do you think is going to happen to your keys?" According to cryptography expert Bruce Schneier, "There is absolutely no business case for key recovery. Any benefit you get from longer key lengths is offset by the enormous security risk of concentrating keys in a few hands." Current "export" versions of Netscape and Microsoft web servers use a weak 40-bit cipher that can be broken in hours by any bored systems administrator or college student with access to a few hundred idle machines. By comparison, all C2Net software can use at least 128-bit keys. To understand this difference, imagine that the hundreds of computers needed to crack a 40 bit key in a few hours were compressed into a cube an inch on a side, and you built a computer the size of the Earth out of these cubes, it would still take this computer more than four times as long to crack a 128 bit key. It's easy to find a few hundred computers idle at any medium-sized business or university; Earth-sized computers are still relatively uncommon. Stronghold Gaining Market Share In several recent surveys, Stronghold has emerged as a leading contender in the web server market. An O'Reilly and Associates/Netcraft survey of secure web servers in use on the Internet found that Stronghold was second only to Netscape. The monthly Netcraft survey of all web servers on the Internet has indicated for some time that Stronghold is also the second most popular commercial web server for the Unix platform. "We've been steadily gaining market share," indicated Parekh, "and to a great extent it's due to our firm stand that we won't sell deliberately weakened security products to our customers." Features in Stronghold 2.0 "We've redesigned the security interfaces and built on the new Apache 1.2 code base," commented Mark Cox, Stronghold product manager at UK Web. "Stronghold has had many productivity and performance enhancements and it is now fully compliant with the new HTTP/1.1 standard." The HTTP/1.1 standard is a significant update to HTTP/1.0, the protocol that governs how web browsers and web servers communicate. HTTP/1.1 brings many new features to the table, including improved content and language negotiation, improved persistent connections, and better recovery from interrupted transfers. (For more information on HTTP/1.1, see http://www.apacheweek.com/features/http11) Stronghold 2.0 also includes a web-based configuration manager, allowing web administrators to securely administer their sites from the web browser of their choice. "We've had a lot of requests for this feature as Stronghold has grown in popularity," said Douglas Barnes, C2Net Vice President. On the security front, the new release includes support for Secure Sockets Layer (SSL) version 3, which provides stronger security and more flexibility in choosing ciphers. Background UK Web Limited is a leading Internet services company specialising in server technology, Internet security, business solutions and effective site design. C2Net is the leading worldwide provider of uncompromised network security software. Netscape Navigator and Netscape Enterprise are trademarks of Netscape Communications Corporation. Microsoft Internet Explorer and Microsoft Internet Information Server are trademarks of Microsoft Corporation. Stronghold and SafePassage are trademarks of C2Net Software, Inc. Portions of Stronghold were developed by the Apache Group, and were taken with permission from the Apache Server http://www.apache.org/. Stronghold also includes software developed by Eric Young (eay(a)cryptsoft.com)

4 3

Re: Chaum steps down as CEO of Digicash
by Robert Hettinga 17 Dec '03

17 Dec '03

At 1:53 pm -0400 on 4/28/97, Hal Finney wrote: > Chaum's orientation towards privacy has not been well accepted by the > conservative banking community (a similar point was made by Peter Swire > in his article about payments and anonymity). Again, financial privacy is like flight. To the people who invented it, flight was an inherent good. People died trying to create it. However, the thing which made flight commonplace was commerce. Flying is not only the fastest way for people and other important things to get somewhere, but, over great distances, it is simply the cheapest way for people to travel. People don't purchase "wow, we can fly". They purchase economy seats to Cleveland. :-). The same thing with financial cryptography, and, by extension, strong cryptography in general. What will sell financial cryptography is not financial privacy per se. What will sell financial cryptography is the fact that digital bearer certificate protocols will prove, by virtue of their very *anonymity*, to be many orders of magnitude cheaper to use than any internet transaction method of equal security. Or any transaction method at all, for that matter. Including, of course, the book-entry transaction settlement methods (like checks, credit cards, securities clearinghouses, interbank settlement) we use today. It is under *that* proposition alone, the potential for radical cost reduction in *all* transaction settlement processes -- and the prospect for radical economic transformation that that brings -- that the blind signature patent should be marketed and licensed. Notice I said "licensed". Cryptographers -- and that is who Digicash is, nothing else, no matter how hard they try to be otherwise -- should invent, license, and validate the use of cryptographic protocols. And, clearly, there is no better financial cryptographer in the world than David Chaum, the man who created, from whole cloth, everything we consider to be modern financial cryptography. Digicash should not try to be a financial trustee, or a certificate underwriter, or even a software developer. All three things Digicash, BV, has tried to be in its many previous incarnations. Now, it appears, Digicash, Inc., is going to try to become the internet equivalent of a credit card association. However, once you understand what Digicash's strengths really are, you can see why this current strategy is just the next progression in, I'm sorry to say, the fool's market that Digicash, Inc., has become in terms of investment return. So, you can understand how, sometimes, I'm very much afraid we'll have to wait until this round of funding is burned through -- say 3 to 5 years -- before we see any progress in the market for digital bearer certificates. And, if Digicash keeps finding a "greater fool" when the money runs out, we'll end up waiting until 2007, the expiration date on the blind signature patent, in order for anything to happen at all. Yet, most of rest of the time, however, I'm not so pessimistic. I'm convinced that if Digicash starts non-exclusive licensing of the blind signature patent, and the other relevant Chaum patents it now controls, even as an experiment, I expect that they would very soon find that their profit margins on those licenses would dwarf the profits on all their other projects. Maybe then they'll realize they should stop trying to be something else, and be what they what they have been all along: the very best financial cryptographers in the world. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA Lesley Stahl: "You mean *anyone* can set up a web site and compete with the New York Times?" Andrew Kantor: "Yes." Stahl: "Isn't that dangerous?" The e$ Home Page: http://www.shipwright.com/

6 13

Re: Firewalls
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Timmy Mayo the self-admitted child molester possesses a rudimentary dick less than one inch long, half the size of his mother's clitoris, that barely makes a fistful. Thereby hangs the root of this Jew-hating sissy's sick fixation on little boys and Usenet forgeries. \|||/ (o o) -ooO-(_)-Ooo- Timmy Mayo

2 1

Thanks for signing up!
by The Dilbert Trivia Game 17 Dec '03

17 Dec '03

Hi from Yoyodyne! This message is to let you know that you're signed up for The Dilbert Trivia Game. Welcome! You'll get questions e-mailed to you on Tuesdays, your answers are due back by 11 p.m. Eastern Time on Sundays, and you'll get your scoring messages on Mondays. It's that simple. When your questions come, you'll be asked to send your answers to dogbert(a)yoyo.com in this format: * Make sure your Player ID -- which looks like this (123456di) -- is on the Subject line of the message you send back with your answers. * Each answer must be preceded by one of these symbols # and each answer must be on its own line. * Each answer must be the letter of the multiple choice answer you like best. Let's repeat. The answer is the letter of the multiple choice selection you like best. It works like this: If one of the questions asks for the name of the evil human resources director, we'll say: "What is the name of the evil human resources director?" Then we'll list these choices: A -- Catbert B -- Ratbert C -- Dogbert You know that Catbert is the evil human resources director, so you'll send back e-mail with your Player ID in the Subject line, and a multiple choice selection in the body of the message that look like this: # A That's pretty much all there is to it. For all the fine print on how to play, the schedule, etc., e-mail these addresses for the autoreply of your choice: How to Play -- dogberthow(a)yoyo.com Official Rules -- dogbertrules(a)yoyo.com FAQ -- dogbertfaq(a)yoyo.com Talk to you soon! P.S. We promised you an answer to this sample question when you signed up: * * * Dilbert is worried that if head count is reduced by 50 percent, all the smart people will leave The boss says: A -- Would that be a bad thing? B -- If only half the people go, how could that be all the smart people? C -- Could you organize a goodbye potluck lunch for them The correct answer is #C. --- Yoyodyne Entertainment "Where the future begins...tomorrow." win(a)yoyo.com

1 0