December 2003 - cypherpunks-legacy

The Republic of Desire (anonymous organ
by kone＠courier1.sha.cornell.edu 17 Dec '03

17 Dec '03

< A < / \ < B - C < / \ < D G < / \ / \ < E - F H - I < Another problem in this set up is: What if "B" is caught and put in jail/killed? How are "D" and company (including "J, K, L" and on) going to stay in touch? Some one posted that useing a "I am caught" key might help cover the trail. I think it would cut down on the uptree pateren but might not pass on info downtree. Would a side to side contact help? A / \ B - C / \ D G / \ / \ E - F - H - I How would one keep the cross over safe? An "in case of loss of contact, use PGP Key xxx?" Ideas? Will

1 0

Re: All our eggs in one basket?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

Perry Metzger writes > Jim Miller says: > > However, proving them wrong while also retaining your anonymity may > > be a trick. > > If all transactions require digitally signed confirmation from the > bank, you have an audit trail from them that they can't deny was theirs. > So to prove that the bank is lying you show a third party your copy of the digitally signed receipt of the disputed transaction? I assume the third party uses the bank's public key and your public key to verify the receipt. This brings up a good question: How does the withdraw of digital money from a bank account work? In particular, how does the bank simultaneously give you money and a receipt that neither party could repudiate? I can see how they could give you the money and a receipt signed by the bank. I do not yet see how they could simultaneously give you the money and a receipt signed by both parties. I imagine the bank would use one of the simultaneous contract signing protocols and somehow produce an encryption key as the last step. The key would be used to decrypt the digital money, which was sent in an earlier step in an encrypted form. However, how can the person withdrawing the money verify the digital money is for the amount stated in the receipt if they only get the key after the last step in the receipt signing protocol. I am confused. I must not be thinking of the correct protocol. How is this situation handled? Jim_Miller(a)suite.com

2 1

Re: hohocon
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Regarding the issue of telnet'ing through an insecure system: A general solution to this problem is to have the system you are attaching to engage in some dialog with you to establish your identity. However, the dialog must be such that even if it is monitored by the system you are going through, that will not allow them to later claim to be you. This is the same basic problem as entering a PIN for a credit or debit card in an environment where the PIN can be seen or recorded. If someone sees your PIN they can steal your ATM card (or dcash card, in the future) and access your money. Cryptographic solutions involve zero-knowledge proof systems but they are too complicated to work in your head. For the hohocon case you could have a calculator programmed with some one-way function (DES is available for the HP48); the remote system could generate a challenge number and you would use your calculator to DES-encrypt it with a fixed secret key, then type the result in, and the remote system would check it. This would not help the hohocon people because next time they tried to log in as you the challenge number would be different. There was a paper in the Eurocrypt 91 proceedings called "Human Identification Through Insecure Channel" which attempted to address this problem. The authors proposed a system which was supposed to be simple enough that you could work the response in your head, but which would be complex enough that eavesdroppers would not be able to figure it out, even after seeing many examples. The idea was that the remote system would issue a challenge as a string of letters or digits: 1982043765. You will give a response of the same length, but only certain positions matter. Those positions are identified by one of two secret words that you memorize. Suppose the first secret is 1246. You will produce a response which embeds the 2nd secret word in the positions where 1,2,4, and 6 appear. Suppose the 2nd secret word is 3124. Your response, written below the challenge, would be: 1982043765 3421223142 - - - - Only the marked positions matter; the others are random. This sounds simple enough, but the problem is that for true security the authors require a much longer string with a much larger set of characters, 40 or 50 characters long. I tried implementing their algorithm, without even memorizing the secrets, just writing them down (they had to be about 10 letters long), and entering in a reponse given a challenge, and I couldn't do it. It was extremely difficult to locate the checked positions and put in the next letter. It took forever to do it, and I kept making mistakes. Maybe with practice it would get easier. Or, perhaps the technique would still be useful with a smaller question size to provide less security but still more than you would get without it. It would be interesting to see if other people come up with approaches to solve this problem. I really don't think that protecting my smart card with a 6-digit PIN is going to be adequate. Hal Finney hfinney(a)shell.portal.com

6 5

axe me
by Timothy Finin 17 Dec '03

17 Dec '03

Please remove me from cypherpunks. I can't handle the volume, it seems. Tim

1 0

Remailer cdodhner@indirect.com DOWN (temp)
by Christian D. Odhner 17 Dec '03

17 Dec '03

My sysadmin, due to some sort of security concern, has decreed that .forward files shall not be able to call any execution of code other than certain designated filters. Thus my remailer rolled over and died and lost three days of my mail. My sysadmin is helping me devise a workaround now so my remailer can be the exception to the rule, or bypass the rule entirely without compromiseing security of the site. I'll post to the list when it's back up. (btw, I'm off the cypherpunks list now, on cp-request) Happy Hunting, -Chris Christian Douglas Odhner | "The NSA can have my secret key when they pry cdodhner(a)indirect.com | it from my cold, dead, hands... But they shall pgp 2.3 public key by finger | NEVER have the password it's encrypted with!" My opinions are shareware. To register your copy, send me 15$ in DigiCash. Key fingerprint = 58 62 A2 84 FD 4F 56 38 82 69 6F 08 E4 F1 79 11

2 1

unsubscribe
by Robert Harder 17 Dec '03

17 Dec '03

Please unsubscribe me from (to?) your mailing list Thank you. Rob

1 0

souls and Multiple Personality Disorder
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

In article <m0ozdjZ-000HXQC@khijol> erc(a)wetware.com "Ed Carp" writes: > I thought this was rather tasteless. MP is real. My SO is MP. It's not > very funny. Do you know what causes MP? Childhood sexual abuse. Possibly, but more often overzealous psychiatrists with an axe to grind. (Let me guess, she had no history at all of MPD before she went to a psychiatrist for some unrelated problem, right?) G -- Personal mail to gtoal(a)gtoal.com (I read it in the evenings) Business mail to gtoal(a)an-teallach.com (Be careful with the spelling!) Faxes to An Teallach Limited: +44 31 662 4678 Voice: +44 31 668 1550 x212

4 3

Re: privacy and rights (short reply)
by Black Unicorn 17 Dec '03

17 Dec '03

Having worked in Liechtenstein banks, I can assure you numbered accounts exist.

1 0

Useless anonymity
by jrk＠sys.uea.ac.uk 17 Dec '03

17 Dec '03

We are accustomed to seeing useless messages of various sorts on this and other electronic forums. Messages that quote a long article only in order to add "Me too" at the end, messages of no interest to anyone but the individual they are directed to, content-free banter, ego-driven flame wars, and so on. They still happen -- inexperienced people are always joining the net -- but most people eventually learn to avoid making these faux pas. Anonymity brings a new class of useless message, of which the following from Black Unicorn <unicorn(a)net.digex.access> is a recent example. I quote it in its entirety: >Having worked in Liechtenstein banks, I can assure you numbered >accounts exist. "Black Unicorn" is an obvious pseudonym, and I'm assuming that it is not one with an established reputation. (For all I know, "Black Unicorn" might be as famous as the Legion of Doom, but for the sake of argument I'll assume that it isn't.) What is the use of an unsubstantiated assertion, from an unreputed[*] source, with no means of verification? Having read Black Unicorn's bald asertion, I am as ignorant as before of whether numbered accounts exist, in Liechtenstein or elsewhere. New ideas or arguments can be useful regardless of their source. Likewise pointers to places where evidence may be obtained. Assertions by reputable sources may be taken on trust (I place far more weight on Perry Metzger's comments about numbered accounts than the Black Unicorn's). The quoted message does none of these. It is wholly useless, a waste of its author's time, and of ours. [*] "unreputed": a word I just coined as an opposite to "reputable", meaning not "disreputable", i.e. having a bad reputation, but having no reputation at all. -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K.

1 0

Re: Forwarded mail from S.Boxx
by peter honeyman 17 Dec '03

17 Dec '03

lance has another epiphany. (grep for epiphany in the archives if you want more confirmation of the s. boxx identity.) and if you don't deny it, he will treat that as confirmation. i pointed out in private mail to him that this is mccarthyism. peter

1 0