December 2003 - cypherpunks-legacy

Ephemeral, was RE: Junger et al.
by Ed Gerck 17 Dec '03

17 Dec '03

Regarding my comment below: >Ed Gerck writes: >[...] > > BTW, I think that Gwin was struggling to express the notion that > > source code (syntax) is a device whenever there is a clear binding > > between that source code and known semantics, together with proper > > pragmatics (the enviroment, as defined in semiotics), in order to > > perform the desired function. > I received some private postings which questioned it by questioning its logical consequences, as for example: >So the judge should forbid publishing/export of Applied Cryptography >and the PGP Book with source code, right ? > First, IMO, this subject is hard to discuss because it is politically involved and also applies just to a particular set of countries -- so it is not based on a "universal" ruling. Further, I also think it is absurd to try to outlaw cryptography because it is essential and not just to obtain privacy (as in my posting on logical semantics and crypto, some months ago [1]). In fact, I think that cryptography is needed to provide *secure routing* [1] (a property that is more basic than secure content and which I think will be impossible to forbid in the future). However, I also think that the arguments being thought by each side may carry their own intrinsic worth. Further, even though the whole subject is IMO ephemeral because unworkable, some of those arguments may have a far reaching consequence and transcend the issue. Should we overlook that? IMO, no. Even thrash can be recycled ;-) My remark above was in this line of reasoning. So, it ought not to be extrapolated to printed books -- I am not at all concerned about the legal aspects. In fact, laws can be wrong and IMO this is a clear example. But, regarding printed books -- yes, the comment above (and others in that line) are right. If this logic exercise is carried to its fully immoral end, then books should not be allowed to carry complete and workable source code. Which does not show that the argument is illogical, just immoral. Technically, the argument is sound. As Hume pointed out a long time ago, if we were guided only by reason and logic then surely I should prefer to destroy the rest of the world instead of enduring even a small pain in one of my fingers. While this shows that logic is not all, it also shows that one cannot deny logic by moral or ethics but rather define what precedes what in case of conflict, for each society. While this can have different answers for different societies, eg where in some suicide is moral, the cryptography issue may take a different twist if the link to secure routing is further investigated and cryptography is not only used just for secure content as it is today. Thanks, Ed Gerck =========== Reference: [1] http://www.mcg.org.br/trustdef.htm#A.4.1 ______________________________________________________________________ Dr.rer.nat. E. Gerck egerck(a)novaware.cps.softex.br http://novaware.cps.softex.br --- Meta-Certificate Group member, http://www.mcg.org.br ---

1 0

Re: Lotus Notes signature / encryption
by Charlie_Kaufman＠iris.com 17 Dec '03

17 Dec '03

>Could someone kindly tell me about the drawbacks of the Lotus Notes >signature / encryption system (export version)? I guess my first question would be "compared to what?". Compared to the Lotus Notes domestic version, the crypto is weaker in two ways. First, there is a backdoor by which all but 40 bits of each symmetric key is encrypted under a public key whose private half is known to the U.S. government. This encrypted value is included in all messages where the key is passed aroung. Depending on how you feel about breaking 40 bit keys, this means it is somewhere between easy and trivial for the U.S. government to eavesdrop on your communications It also uses 512 bit RSA keys for distribution of encryption keys, which makes it attackable by attackers other than the U.S. government. While no one has ever publicly demonstrated breaking a 512 bit RSA key (last I heard), the workfactor is well understood and it's clearly feasible (and in fact overdue). Compared to exportable versions of S/MIME or SSL, the crypto is considerably stronger. Against attackers other than the U.S. government (and even a paranoid would admit there are other attackers to be concerned about (e.g. the French government)), the workfactor to attack the symmetric keys is 64 bits - a little shakey but not the weakest link in most systems. Further, RSA signature keys are 630 bits, which is better than most exportable systems. Compared to non-exportable (but internationally available) systems, like PGP and strong S/MIME and SSL, the crypto is substantially weaker. Another aspect to consider is the strength of the PKI. Lotus Notes uses an organizationally based PKI, meaning that to a large degree your security depends on the trustworthiness and competence of your system administrator. With PGP, your security is under your own control to a much larger degree. For people who are more security aware than their administrators (as most PGP users are), the PGP PKI offers better security. For people who are less security aware than their administrators (as most Lotus Notes users are), the Lotus Notes PKI offers better security. Finally, a "drawback" that might be relevant to this group is the fact that because the Lotus Notes export version has a key-escrow-like backdoor, using it offers tacit political endorsement for the U.S. government's contention that key escrow is a technically practical compromise between the needs of users for privacy and the "needs" of government to know all the secrets of everyone on the planet. In my mind, this argues strongly in favor of using real strong crypto if that is an option, but using weak crypto as an alternative is offering tacit political endorsement for the even more dangerous contention that weak crypto is good enough. Your mileage may vary. --Charlie Kaufman (charlie_kaufman(a)iris.com)

1 0

Re: IP: "CyberCash can't oust credit cards"
by Dave Birch 17 Dec '03

17 Dec '03

Ryan Lackey said >I think resistance to new payment schemes on the part of a merchant is in >cost and effort to set up. Having a free apache commerce plugin which >handles >a variety of payment systems... What's wrong with this model is that it imports historical physical models that are irrelevant on the Net. Why does the merchant take payments at all? Imagine this scenario: you go into the Good Guys and buy a Walkman. The clerk gives you a ticket. You go round to your branch of Wells Fargo and get a cashiers cheque made out to the merchant, walk round to the merchant's branch of BankAmerica -- or BankBank, or whatever it's called now :) -- and deposit the cheque in the merchants account. BankBank gives you a receipt which you take back to the Good Guys and pick up your Walkman. Now, apart from all of the walking around, this is not a bad system. The Good Guys don't need cash registers, links to First Data etc etc. The Good Guys don't need to put up stickers saying "we take Visa", because the bank takes everything. The Good Guys don't care how you paid. The bank is much better placed than the merchant to handle the risks associated with payments and therefore the information asymmetries associated with the payment are significantly reduced (there's a good article about this in the Federal Reserve Bank of Atlanta's Economic Review, 1Q98). On the Net, there's no walking around. In the physical world, it clearly makes no sense for every bank to build a network out to every merchant: hence it makes sense to have physical payment instruments (e.g. notes, cheques) and credit/charge cards. On the Net, though, every participant is connected. When you buy a book from Amazon, what is the point of sending your credit card details to Amazon just so that they can send the details on to an acquiring network, third-party processor etc. Surely it makes more sense for merchants to have deals with payment agents (this is the model in OTP, Smart Access etc). When you press the button marked "Pay" on your browser, wouldn't it be more natural for a message to go to your bank than to the merchant? Thus, I get a "ticket" from Amazon saying "you owe $20 for this book". I pass the ticket to a payment agent (which may be a bank) and pay them (the negotiation being between my wallet and the agent"). The agent sends me a receipt to keep: I send the receipt to Amazon and they send me a book. Alternatively, perhaps the receipt let's me play Doom for a month or get ten upgrade to an item of software or whatever. All Amazon care is that the money has been paid: what do they care whether I used DigiCash or Mondex, Visa or MasterCard? You might argue that the merchant would discount for cleared funds (pay by Mondex and get 2% off) but I think that its frankly too much bother for them to work out N different prices by M different payment methods. I would imagine that just a merchants run loyalty schemes ("double points if you buy cornflakes") then so would payment agents ("double points for DigiCash") but each could operate their business independently. I would argue that the idea that merchants take payments is outdated. Since merchants don't care about cypherpunk favourites such as bearer instruments and anonymity, they'll be perfectly happy to have an acquiring account with BigBank and get a statement at the end of the month that details the payments taken and says "Money collected $1000, our fee $50, deposited to your account $950". Now, the merchant hasn't had to buy a commerce server, negiotiate 10 different acquiring agreements, implement SET or do anything else. Hey, so it's 5%: so what? Regards, Dave Birch. === mailto:daveb@hyperion.co.uk ===== http://www.hyperion.co.uk/ ===

1 0

Re: Rats in the Walls
by Reeza! 17 Dec '03

17 Dec '03

At 07:21 PM 02 07 98 +0200, Anonymous wrote: >"Reeza!" <howree(a)cable.navy.mil> wrote: > >> At 04:41 PM 02 07 98 +0200, Anonymous wrote: >> >and there are indeed safe havens elsewhere, >> > >> >"Educate, don't Agitate" >> > >> >> Tell me more,,, > >You and who's army? > What army? I'm in the navy, and I'm getting sick of it.

1 0

Re: Covert Access to Data and ID
by John Young 17 Dec '03

17 Dec '03

Froward From: Anonymous To: die(a)pig.die.com Cc: jy(a)jya.com Subject: Intel plans for world domination Date: Wed, 8 Jul 1998 10:51:04 -0500 Good afternoon gentlemen, I've been reading the correspondence on the possibility of govt keystroke access with some interest. I'm in a slightly odd position as I'm responsible for security in one of the larger wintel companies. As such I've been getting quite a feeling of deja vu reading your mails. Intel and others are moving in exactly this direction with a number of initiatives, most notably the PC98, PCXX, and "Wired For Management". WfM in particular is very scary - one of the components is a facility for PC's to download and run digitally signed software before the OS is booted - between "the end of BIOS initialisation and when control is transferred to a high-level OS" in the words of one Intel document. The code is verified by routines embedded in the BIOS and will allegedly use some subset of X.509v3 and PKCS#1. As so often happens in circumstances like this I can't risk passing documents directly as I can't be sure of their provenance - I really have no idea which ones are now considered trade secrets and which have been made public. Instead I recommend you have a look at the Intel WfM site http://www.intel.com/ial/wfm/ with particular reference to the "Pre-Boot Execution Environment" (PXE) and "System Management BIOS" (SMBIOS). The Microsoft pc98 site is at http://www.microsoft.com/hwdev/pc98.htm and the Intel one at http://developer.intel.com/design/pc98/. ---------- And, DM reminds of the DIRT program Ray Arachelian first posted here: There's an article on page 37 of the July 6, 1998 issue of NetworkWorld about a new software product for Windows machines that is basically a trojan horse that allows access to all keystrokes and files on a system from a remote "America's Most Wanted"-type HQ. I can't find the article online at www.networkworld.com, but you can go the the company's site at http://www.thecodex.com/dirt.html to see it. Sale of DIRT is "restricted to military, government, and law enforcement agencies", the article says.

1 0

Join StarDates.com, The Internet's Best FREE Dating Service!
by hizaici72＠prodigy.com 17 Dec '03

17 Dec '03

That's right! Stardates.com is the internet's best FREE dating service. No gimmicks, no free trials that expire, just FREE Click the link below: http://209.2.134.99/ and select JOIN FREE from the menu options to fill out our on-line application. All personal information is kept strictly confidential. We even have an anonymous email system to keep your email address private. So if your your looking to meet people, join Stardates.com Hey, what do you have to lose? Sincerely, Michael Sole Vice-President StarDates **************************************************** Bulk Email Advertising Works Best!! This Could Have Been Your AD !!! For Advertising Information Please Calll 1-510-653-4709 Evenings PST **********************************************

1 0

Jim Bell Message
by John Young 17 Dec '03

17 Dec '03

Forwarded from a long-time cpunk who received a call from Jim Bell yesterday. Jim asked that this message be publicized: 7/7/98 By this post he is publically accusing the Federal Government of having spied on him from two physical addresses. These are two houses to the North & to the East of his parent's house. The government moved in within 6 months (approx) of the time before his arrest. One of the addresses is 7217 Mississippi, which is listed as "Billy King", who died a couple of years ago. The house is ostensibly being occupied by his widow (or that is the impression). It is listed as being as owned by Alverna King, but he has his doubts. The other is address is 7302 Corregidor, purchased about 2.5 - 3 years ago by someone. Listed as being the address of Sundown Development, a small business company. A second floor was added soon after it was acquired by the company. They aren't listed as the owners on record, but they are listed as being at that address. Thinks this is a sham. The govmt was basically next door spying on him for at least a year, before it started provoking him. In response to his using the internet for freewheeling debate, they engaged in some bugging that is illegal under Washington State law. It is illegal to use bugging without the knowledge of the participants. He has developed a technique for identifying when someone is tailing him. Found this on Father's day when some people got a little too close to him. He drove to his Sister's party on Hayden Island in Oregon, and noticed the tails. Identified them as Rixen Marine, which he thinks is a sham, another front organization. One of the reasons he was arrested (though they're not willing to admit it) is because was way too successful in tailing _them_. A few more days and he would have blown their entire operation. He couldn't go into the details of how he found out these things. Did research & sophisticated observation. Will be getting friends to do searches in databases, etc. to gather more info to substantiate his suspicions. He said his recent arrest was on a probation violation charge - failure to pay a fine or something, wasn't clear on the specifics. There will be a hearing on his case this Friday the 10th. Prosecutors last year didn't know what the govmt was up to - not told of the spying (a "black operation"). Their method of spying on him are techniques which are possible, though rarely used. If people knew they would be very surprised. It will be a big story - big as Watergate - when it comes out. Their usage of these high-tech methods for access is difficult, so not used often. The government is trying to cover up their reaction to what he wrote in his essays. ------------------- <end of message>

1 0

IP: "CyberCash can't oust credit cards"
by Robert Hettinga 17 Dec '03

17 Dec '03

Hettinga's three laws of internet payment technology investment: 1. Geodesic, peer-to-peer transactions. 2. Three orders of magnitude cost reduction. 3. Nothing but net. The application of the above to Cybercash, or SET, for that matter, I leave as an exercise for the reader... Cheers, Bob Hettinga --- begin forwarded text Delivered-To: ignition-point(a)majordomo.pobox.com X-Sender: believer(a)telepath.com Date: Sun, 05 Jul 1998 13:53:40 -0500 To: believer(a)telepath.com From: believer(a)telepath.com Subject: IP: "CyberCash can't oust credit cards" Mime-Version: 1.0 Sender: owner-ignition-point(a)majordomo.pobox.com Precedence: list Reply-To: believer(a)telepath.com Source: Charlotte (N.C.) Observer (printing a Washington Post article) Posted at 3:32 p.m. EDT Friday, July 3, 1998 CyberCash can't oust credit cards By MARK LEIBOVICH The Washington Post WASHINGTON -- Two years ago, CyberCash Inc. walked tall as a pioneer in the seemingly vast frontier of Internet commerce. Today, the Reston, Va., firm and its software that lets merchants receive payments over the Internet offers a cautionary lesson in how social habits in the digital age are difficult to predict -- and dicey to stake a business on. On Tuesday, CyberCash announced that its second-quarter revenue would be below expectations, and that it would lay off 20 percent of its staff. The news sent its stock price into a decline -- the latest to strike the company. Once trading in the $60 range, it fell steadily this week to finish at $11.12 1/2. The hard times come even as CyberCash has tried to tone down its aspirations and diversify into a more conventional business, the processing of credit-card transactions in ordinary stores. The moral, said Ulric Weil, a technology analyst at investment bank Friedman, Billings Ramsey Co. in Arlington, Va., is: ``It's always hard to bet on the purchasing mores of consumers.'' William N. ``Bill'' Melton, one of Northern Virginia's most accomplished technology entrepreneurs, envisioned a world of paperless purchasing when he founded CyberCash in August 1994. In this world, Internet users would purchase goods and services using new ``virtual currencies,'' such as CyberCoin, a CyberCash product that allows online purchases of up to $20 at a time by transferring funds from a credit card or bank account to an account that CyberCash oversaw. Few people bought anything with this virtual currency at first, but the market was patient. In the speculative world of Internet stocks, the potential for this commerce seemed limitless, and CyberCash was an instant Wall Street hit. Company shares, first offered to the public for $17 in February 1996, were trading at more than $60 by that June. But today, investors are tired of waiting. The predicted rush to electronic currency remains a mere trickle and what little there is generally uses plain-old credit card transactions, not a fancy new currency. For now, consumers shopping online merely want to use something they know and trust for payment, the credit card, not an entirely new form of currency. After this week's layoff, which involved about 20 positions in the Washington area, CyberCash has about 200 employees. It remains unprofitable, having reported a loss of $5.67 million on sales of $1.14 million in the January-March quarter. If life weren't uncertain enough in Reston, speculation was rampant this week among analysts who follow the company that its low stock price was making it a ripe takeover target. These predictions were fueled further by the company's announcement Tuesday that its board of directors had adopted a new shareholders rights, or ``poison pill,'' plan, which companies typically use to deter unwanted takeover bids. In this case, if an outside entity attempted to purchase a stake in CyberCash that exceeded 15 percent, the company board could invoke the provision -- at which point CyberCash shareholders would win the right to purchase company shares at a greatly discounted price. For a potential buyer, this would make CyberCash far more expensive. Russ Stevenson, CyberCash's general counsel, said the new provision was not related to the company's recent struggles, and that the timing of its adoption was coincidental. In a statement, CyberCash said the poison pill did not come in response to an acquisition proposal. James J. Condon, the company's chief operations officer, would not comment on whether CyberCash was in discussions to be acquired, citing a company policy ``never to comment'' on potential acquisitions. Melton, CyberCash's president and chief executive, was traveling Thursday and could not be reached for comment. CyberCash's recent woes stem in part from its May acquisition of ICverify Inc., an Oakland, Calif., company that makes credit-card processing software. CyberCash, which purchased ICverify for $57 million in cash and stock, hoped to complement its own technology with ICverify's more conventional ``point of sale'' software, which helps retailers process credit card transactions in shops and other commercial establishments. Entering the ``point of sale'' market was a way for CyberCash to hedge its bets against the uncertain future of electronic commerce, analysts said. ``This gave (CyberCash) a piece of the physical point of payment, as well as the electronic point of payment,'' said Scott Smith, an Internet commerce analyst at Current Analysis Inc. in Sterling. With the addition of ICverify, Condon said, CyberCash could now offer a full package of payment software to potential customers. They could now provide, say, a clothing retailer, the tools to process both in-person credit card transactions as well as Internet credit card purchases. But the ICverify acquisition proved a difficult transition. In recent months, analysts said, some customers of both companies have frozen their accounts, saying they were unsure about which transaction software they would deploy in the future. ``The ICverify transaction resulted in customers taking a close look at what direction they wanted to go in,'' said Weil. Condon said he expects this to be a short-term problem. He said he has spoken to several customers who plan to continue their accounts shortly. People who follow CyberCash generally agree on two things: that if the company can hang on long enough for electronic payments to become a widespread phenomenon, it will be well positioned to cash in. They also say the company has a strong, tenacious management team in place, led by Melton. ``He is the rock the company is built on, and he's committed to the company's success,'' said Smith. ``I don't see anyone there who is ready to back down.'' But in the end, Weil said, the future of CyberCash might rest with forces beyond its control. ``You can't change the psyche of consumers,'' he said. ``CyberCash doesn't have that kind of influence.'' ----------------------- NOTE: In accordance with Title 17 U.S.C. section 107, this material is distributed without profit or payment to those who have expressed a prior interest in receiving this information for non-profit research and educational purposes only. ----------------------- ********************************************** To subscribe or unsubscribe, email: majordomo(a)majordomo.pobox.com with the message: (un)subscribe ignition-point email@address ********************************************** www.telepath.com/believer ********************************************** --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The Philodox Symposium on Digital Bearer Transaction Settlement July 23-24, 1998: <http://www.philodox.com/symposiuminfo.html>

5 8

U.S. relaxes licensing grip on encryption
by Xena - Warrior Princess 17 Dec '03

17 Dec '03

(From the Mercury News, see subject line) http://www.sjmercury.com/business/center/encrypt070898.htm It's a start, at least.

1 0

A Mirror - 'Don't be blue if you should be green'
by StanSqncrs＠aol.com 17 Dec '03

17 Dec '03

Sorry, that server that address I gave you on earlier seems to be all locked up, so I created a mirror, check it out, Stan, The Desecration of 'The Dark Side of the Moon' http://members.aol.com/RealityWal/DarkSide/darkside.html

1 0