December 2003 - cypherpunks-legacy

RE: Golbal Econ.
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> >An "internet economy" needs a basis of trust, as well as security > >mechanisms appropriate for the current level of IP security. What basis > >of trust do you envisage? > Secure transactions are here already. ... for parties with established commercial relationships. > Most of this can be done in civil law. It's done all the time in the > securities markets. If you have certificate which is collateralized, by an But the contractual agreements upon which these transactions are based don't scale too well to the [small] vendor / casual purchaser sector, which I guess the term "internet economy" is intended to encompass. The most likely basis of trust for this sector is not going to be achieved through each transient buyer-and-seller pair-instance entering into an explicit contract to enable the seller to believe the buyer's electronic [proxy-]promissory note - but by an extension of the current mechanism for telephone or mail-order payment, with the trusted third parties being VISA, AMEX, etc. While CommerceNet is the most prominent make-the-internet-safe-for-business initiative, it still only expects to have 1 million customers within five years - a goal that is modest enough given today's Internet user base, and growth rates. Even so, industry analysts consider this goal ambitious. Expectations for an internet economy based on techniques above and beyond the ability to securely send one's credit/charge card details are unlikely to be fulfilled in the short/medium term. - pvm

1 0

Re: Golbal Econ.
by p.v.mcmahon.rea0803＠oasis.icl.co.uk 17 Dec '03

17 Dec '03

> > All payment mechanisms require a basis of trust - so > > that the seller knows s/he will get paid . > The above bank/vendor/customer/mix scenario seems the > simplest to start out with on the Internet at this time. Indeed. But what I have still not seen in this thread is an articulation of a business case for existing financial institutions to support the putative [on|off]-line payment mechanisms - in particular as an alternative to charge/credit cards for one-off transactions. - pvm

1 0

New Cypher ListServ (part 1)
by David Downey 17 Dec '03

17 Dec '03

I recently purchased my own domain called CyberSpaceTechnologies.com, and with it I recieved the ability to own and operate a ListServ of my own. I will continue to be a member of this one. Yet in order to make sure that we may always have a place from which to discuss this most important of issues, I have started the Cryptography-Politics-PGP-L listserv. This listserv will be up in approximately 72 - 96 hours hopefully. Those of you with long time experience with listservs, and those that have run them before, I would be honored to hear from you on the best way to run this. I have decided beforehand that it would be an unmoderated list. The ONLY monitoring that I will do, is to glean email addresses and upstream server addresses from spam messages for the purpose of notifying offenders that such actions are not wanted or tolerated on this list. I hereby pledge that in no way shape or form, will I passively allow spammers or other entities to use email addresses from this list for ANYTHING without first getting permission from the email address owner. If ANYONE sees that happen, PLEASE notify me IMMEDIATELY! I want this list to be a place where open discussion of this issue may take place regardless of age, sex, creed, religion, experience, or lack thereof. We are a community of believers, believers in the right to freedom, privacy, and the ability to remain an idividual. The only thing I ask, and this is a request not a demand, is that all list members treat new and old members with the level of respect and courtesy that you would expect for yourself, if not better. Not much to ask, I don't think. ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com

1 0

Re: In the year 2525
by Matthew Ghio 17 Dec '03

17 Dec '03

"Rick H. Wesson" <wessorh(a)ar.com> wrote: > If I stole all the digital cash in the world, and held it for 30 > seconds in a numbered account, how much interest would I have? Zero. If you stole all the money, there would be none left to pay you interest. :)

1 0

Re: In the year 2525
by David K. Merriman 17 Dec '03

17 Dec '03

> If I stole all the digital cash in the world, and held it for 30 > seconds in a numbered account, how much interest would I have? Well, you'd certainly have *my* interest.... :-) Dave Merriman - - - - - - - - - - - - - - - - - - - - - - - - - - Finger merriman(a)metronet.com for PGP/RIPEM public keys and fingerprints. Unencrypted Email may be ignored without notice to sender. PGP preferred. Remember: It is not enough to _obey_ Big Brother; you must also learn to *love* Big Brother.

1 0

Re: We get the government we deserve
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Tim C. May wrote: > We get the government we deserve. The Drug War is happening because > Americans shrilly say "Do something!" and would rather have the D.A.R.E. > commandoes educating their kids than do it themselves. Ditto for most of > the laws passed by the tens of thousands every year. (Ever wonder why we > need thousands of new laws? I do.) DARE really isn't so bad... Just because we recognize that people should have the freedom to use drugs if they choose to do so, doesn't mean that such drugs are good. Maybe a lot has changed since the DARE program was given at my school, but it mostly focused on why drugs were bad, allowing people to make a more informed decision about using drugs. That seems to me to be protection against fraud... I was talking about this with a cop recently, and he said that the DARE program was the most effective tactic against drug abuse. He admitted that busting drug dealers wasn't really effective (for several reasons). So maybe attitudes are changing. I asked him about legalization. He was somewhat hesitant on this point. His only objection was that he was afraid that it would "send the wrong message." However, he did admit, that everyone he had ever picked up for drug abuse was also involved in other crimes, theft being most common. So even if drugs were legalized, the same criminals would still get arrested for their crimes.

2 1

Returned mail: unknown mailer error 1
by Mail Delivery Subsystem 17 Dec '03

17 Dec '03

----- Transcript of session follows ----- sh: /users/home/entropy/procmail: not found 554 "|IFS=' ' && exec /users/home/entropy/procmail -f- || exit 75 #entropy"... unknown mailer error 1 ----- Unsent message follows ----- Received: from toad.com (localhost) by IntNet.net (5.0/SMI-SVR4) id AA03078; Sun, 28 Aug 1994 20:13:55 +0500 Date: Sun, 28 Aug 1994 20:13:38 +0500 Message-Id: <9408290013.AA03078@ IntNet.net> Errors-To: cypherpunks(a)toad.com From: cypherpunks(a)toad.com (Cypherpunks List) To: entropy(a)IntNet.net (Jcooper) Subject: blah content-length: 24 Blah Blah Blah -cp >From owner-cypherpunks Sun Aug 28 11:17:53 1994

1 0

Announcement of premail v. 0.20
by Raph Levien 17 Dec '03

17 Dec '03

Hi all, I am releasing premail, a remailer chaining and PGP encrypting mail client, to the Net. If you are interested in using the cypherpunks remailers, but are intimidated by them or simply find them too hard to use, then this software can help. Premail will also PGP-encrypt and optionally sign outgoing mail. The README file is attached. Please check it out and let me know how you like it. Raph Levien ----------------------------------------------------------------------- README file for premail v. 0.20 27 Aug 1994 -- Raph Levien <raph(a)cs.berkeley.edu> Premail is a mail client for Unix workstations, supporting PGP encryption and anonymous remailers. It can be used either stand-alone or as a layer under your favorite user mail client. Premail has been designed to be as simple and transparent as possible. Features include: * Chaining of messages for cypherpunk remailers. * Automatic selection of reliable remailers. * PGP encryption and signing. * Online and offline operation. Premail is designed to masquerade as sendmail. It accepts mail in the same way, and takes the the same options, and providing additional header fields for its privacy features. Thus, if you can get your mail client to pass the mail to premail rather than sendmail, then you gain the use of the privacy features without changing the way you send mail. In the interest of simplicity, premail only handles outgoing mail. It does not handle incoming mail, or PGP decryption. Installation ------------ This section explains how to set up premail for basic operation, without PGP encryption. Use of PGP encryption is highly encouraged, and is covered in a later section, as are configuration and advanced features. This section assumes that your machine is connected to the net when you run premail. It is capable of offline operation as well, as discussed in a later section. 1. Get the source. Given that you are reading this file, you may have already done this; if so, go to step 3. The latest version of premail is available at: ftp://kiwi.cs.berkeley.edu/pub/raph/premail-0.20.tar.gz 2. Unpack it. To do this, run: gzip -dc premail.tar.gz | tar xvf - 3. See if you can run it. First, do "cd premail", then "./premail" (without the "" marks in both cases). If it prints a usage summary, you are in luck. If you get "command not found," then the problem is most likely that your system's copy of perl does not live in /usr/bin. Type "which perl" to find out where it actually is, then edit the first line of the file "premail" to match that, and try again. 4. Copy premail into a directory in your path (this step is optional). For example, if ~/bin is in your path, then do: cp premail ~/bin After this step, you probably want to run "rehash" so your shell knows were to find premail. 5. Set up the premail configuration file by typing: cp .premailrc ~ 6. Test whether premail really works, by typing: premail your(a)own.email.addr Path: 1 Subject: Test Does this really work? . If everything goes well, you should get a response from an anonymous remailer in a few minutes. Then, premail is set up and ready to use. You probably want to set up PGP as well, but you don't have to. This and other configuration options are covered below. The configuration options are controlled by the ~/.premailrc file, so you might want to browse through it and tweak things to your taste. Setting up premail for PGP -------------------------- When properly set up, premail will automatically encrypt outgoing mail using PGP. This applies both to traffic routed through the remailers, and to email encrypted for the final recipient, who would use PGP to decrypt it. On the other hand, you can skip this section if you don't want that. First, you need to make sure that you have PGP set up on your machine. When you do, just type: premail -getkeys This will finger Matt Ghio's remailer list at remailer-list(a)chaos.bsu.edu . If this site is down, or if you are not connected to the net, you should get the list from somewhere else. You can specify either an email address to finger or a file. For example, if you save the keys into remailkeys.asc, then you can run: premail -getkeys remailerkeys The messages from PGP will tell you that it's adding about a dozen new keys to the keyring. You also need to tell premail that you've got PGP running, and have added the remailer keys to your keyring. To do so, add the following line to the ~/.premailrc file: $config{"encrypt"} = "yes"; Also, if you've got PGP in a non-standard place, so that typing "pgp" will not call it up, then you need to add this line to the ~/.premailrc file: $config{"pgp"} = "/wherever/you/put/pgp"; The vox remailer has a problem with MIT PGP 2.6. Thus, premail will by default not encrypt mail going through vox. If your PGP version is 2.3a or 2.6ui, then it should work fine, so add this line: $config{"oldpgp"} = "pgp"; or, if PGP is in a nonstandard place, $config{"oldpgp"} = "/wherever/you/put/pgp"; Integration with user mail clients ---------------------------------- Without premail, outgoing mail works as follows. After you compose your mail, your mail client hands it off to a program called sendmail, which forwards it to the Net. Sendmail (written by Eric Allman at UC Berkeley) knows a lot about email addresses, networking, and so on, but very little about privacy and security. That's the job of premail. It is possible to use premail in either mode: under your client, or by itself. Either way will give the same features, it's just that integrating it with your client will be more convenient to use (if a bit harder to set up). To use premail, type: premail recipient(a)email.addr and enter your mail as you normally would, ending with either Control-D or a line with just a . on it. Or, you can prepare an email message with your favorite editor, and send it with premail -t < your.file To add premail support to emacs, just add this line to your .emacs file: (setq sendmail-program "/your/premail/pathname/here") With other mail clients, you should be able to use a similar technique. Contact me if you need help with a particular client. If you are root on your machine, you can install premail in /usr/lib/sendmail, so that it will work for _all_ mail clients. This is a fairly bold move, so it would be wise to test this carefully before doing so. To do so, move the existing sendmail into, say, /usr/lib/real_sendmail . Then, add the line $config{"sendmail"} = "/usr/lib/real_sendmail"; to premail. Finally, copy premail to /usr/lib/sendmail. If you choose to do this, let me know how well it works out. Using the privacy features -------------------------- Premail has two important privacy features: chaining through remailers, and PGP encrypting the messages. To chain through the remailers, simply add a header line such as Path: 3 to your mail. The number 3 says how many remailers you want it to chain through. Three is a good compromise between privacy on the one hand and speed and reliablilty on the other. The remailers will automatically be selected for their reliablity and speed, using the remailer list I maintain (finger remailer-list(a)kiwi.cs.berkeley.edu to see it). If you want to specify a particular sequence of remailers, you can do that. For example, if you are very fond of the idea of your mail crossing national boundaries, you might want to send it through Canada, Austria, and Holland, in that order: Path: extropia;wien;usura When using the Path field, your identity will be completely obscured. If the recipient tries to reply to your mail, it will get nowhere. You can specify a reply address using the Anon-From field: Anon-From: an123456(a)vox.hacktic.nl The Anon-From field only shows up in mail which goes through the remailers. In ordinary mail, it will be ignored. So, you can put it in all of your mail without worrying about compromising your identity. In fact, you can make premail automatically use it in all anonymous mail by adding this line to your ~/.premailrc file: $config{"anon-from"} = "an123456(a)vox.hacktic.nl"; Similarly, if most of the mail you send will be through the remailers, then you can set premail to do that as the default. Add this line (or whatever path you want, if not 3) to ~/.premailrc: $config{"defaultpath"} = "3"; Then, whenever you want to send non-anonymous mail, add this header field: Path: ; The other important privacy feature is the ability to PGP encrypt outgoing mail. This works whether or not you use the remailers. The recipient's key must be in your public key ring before you can encrypt mail to them. Then, all you have to do is add this mail header field: Key: user_id The mail will be encrypted with this user_id. It will be formatted using the MIME content type of application/x-pgp. If the recipient has a MIME-capable mail reader, they can set it up to automatically call PGP when receiving encrypted mail. Otherwise, you don't need to worry about it. You can also have premail automatically sign your mail, as well. This feature is a potential security problem, so use it with caution. Add these lines to your ~/.premailrc: $config{"signuser"} = "your_user_id"; $config{"signpass"} = "your pass phrase"; Again, a warning: in doing so, you have just stored your pass phrase in a disk file, which is considered a security no-no. On the other hand, if you are using this for medium-security applications, or if you have good control over access to your machine, then it should be OK; certainly a _lot_ better than not using PGP at all. The ~/.premailrc file should always have -rw------- (600) permissions. Use with caution. How to use the cypherpunks remailers like anon.penet.fi ------------------------------------------------------- Even though the cypherpunks remailers do essentially the same things as anon.penet.fi (though faster and with better privacy), they work quite a bit differently, and can be somewhat intimidating. Premail can help. First, you will need to get an anonymous alias. At this time, the only cypherpunk remailer which will do this for you is "avox", or anon(a)vox.hacktic.nl. To get the alias, do: premail your(a)own.email.addr Subject: alias Path: avox Hopefully, this will assign me an alias. . In a few hours, you will get email back with an alias of the form an123456(a)vox.hacktic.nl . Then, when you send anonymous email, give your alias as the reply address. Here is an example: premail recipient(a)email.addr Anon-From: an123456(a)vox.hacktic.nl Path: 3 Hello, if you reply to this, mail will get to me. . Unfortunately, unlike penet, avox does _not_ make the person replying anonymous. The best way for them to be anonymous is to use the cypherpunks mailers as well (hopefully by using premail!). How to post to Usenet --------------------- The easiest way is to use a mail-to-Usenet gateway. For example, to post to alt.skydiving, just send mail to alt.skydiving(a)demon.co.uk . A full list is available by fingering remailer-list(a)chaos.bsu.edu, or from http://www.cs.berkeley.edu/~raph/ghio-remailer-list.html . Extra goodies ------------- Premail supports a few more features, for advanced users. These include: offline mail preparation, logging, a password for penet, and a debugging mode. The configuration options specifying these are described in the ~/.premailrc file, which is what you would need to edit. Have fun!

1 0

Re: We get the government we deserve
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

alex <cp(a)omaha.com> wrote: > nobody(a)shell.portal.com wrote: > > I was talking about this with a cop recently, and he said that the DARE > > program was the most effective tactic against drug abuse. He admitted > > Sorry to be straying from crypto, but: > > I heard exactly the opposite, that studies have shown no difference > whatsover in the usage rates in kids who went through DARE and kids who > don't go through DARE. I don't know; this was just one cop's opinion based upon his experience. He said most of his offenders were in their late 40s, having picked up a heroin problem after taking mophine in Vietnam, and they were doing all sorts of crazy (and stupid) things to support their habits. He said that the drug problem was 'getting better' because many of the junkies were dying from overdoses, and fewer of the younger generation were getting involved in that type of thing. YMMV depending on which part of the country you live in. You're right, this isn't crypto, but I suppose the war on drugs does bring up some privacy issues...

1 0

Re: Golbal Econ.
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 10:10 PM 8/28/94 +0100, p.v.mcmahon.rea0803(a)oasis.icl.co.uk wrote: >But what I have still not seen in this thread is an articulation >of a business case for existing financial institutions to support >the putative [on|off]-line payment mechanisms - in particular as an >alternative to charge/credit cards for one-off transactions. I'd like to take a crack at this one. In the offline business model I'm mucking around with, the bank is responsible for "vouching" for the purchaser. An ATM gateway (which requires a bank) is how cash is sent to and from the underwriter. This cash is used to pay for and collateralize the digital certificates. And when cash is brought off of the net, the ATM gate serves as a place to send a "deposit" of the redeemer's cash. Banks get a commission for this. In addition, an institutional bank is also the trustee for the suspension account, which collateralizes the cash on the net. There are fees for that. The mechanics of getting paid are pretty straightforward. The size of the market is probably the most important question. I hold no illusions about this, but I think the costs of entry are still such that with reasonable royalty demands and with falling prices for equipment and network access a business could be started the proverbial garage (OK, 1000 ft or less of class b office space) and survive. Costs of entry will continue to go up, however. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0