December 2003 - cypherpunks-legacy

Re: Tommy Tag Lines
by Ben.Goren＠asu.edu 17 Dec '03

17 Dec '03

At 11:26 PM 8/14/94, Timothy C. May wrote: >Ben, ix-nay on the omb-bay talk! I asked you not to discuss these >things on open channels. >[. . .] Ah, but that's the beauty of it. Who would believe that we're actually doing anything? Better yet, what jury would now believe that all those messages that the NSA has gotten via Tempest from us were anything but elaborate NSA fodder? (I *knew* I should have bought that Faraday cage!) Seriously, though, what with the simplicity of communicating in a very secure manner on the 'net--whether that means PGP or old-fashioned code (Aunt Sally's not feeling all that well, but the postcard you sent really cheered her up. Are we still on for coffee and bagles at ten on Saturday?)--it makes one wonder just what the NSA is trying to monitor, and what they hope to accomplish by it. >--My name is May, _Tim_ May b& (special agent 004) -- Ben.Goren(a)asu.edu, Arizona State University School of Music net.proselytizing (write for info): The battle is over; Clipper is dead. But the war against Government Access to Keys (GAK) goes on. Finger ben(a)tux.music.asu.edu for PGP 2.6 public key ID 0xCFF23BD5.

1 0

DSS flaw reported
by an5877＠anon.penet.fi 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I found this in the EDUPAGE clipping service. Does anyone have further information? BACK TO THE DRAWING BOARD ON DIGITAL SIGNATURES The Digital Signature Standard approved by the Commerce Department last May is in trouble. The algorithm may have a fatal flaw that would allow hackers to forge digital signatures needed for electronic funds transfers and alter supposedly secure documents. NIST (National Institute for Standards and Technology) claims all that's needed is a one-line fix, and an unfazed AT&T still plans to release a new version of its DSS-compatible Secretagent encryption software sometime soon. (Data Communications 8/94 p.11) DEADBEAT <na5877(a)anon.penet.fi> -----BEGIN PGP SIGNATURE----- Version: 2.4 iQBFAgUBLki4FPFZTpBW/B35AQG1WAF9Gu8qR0PZcipTw3c121kxIxwcbXVmMtGS tLN4XFjP+M672PigFQ7qCUWHgy94EP+v =J5f7 -----END PGP SIGNATURE----- ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

Re: CARE -- Crypto Abuse Resistance Education
by koontzd＠lrcs.loral.com 17 Dec '03

17 Dec '03

>I fully expect that, barring some major change in current trends, in ten >years or less people will be leaving the US as refugees in search of >freedom in eastern europe. Moving to Siberia in search of freedom

2 1

Re: Liberation Technology
by fnerd＠smds.com 17 Dec '03

17 Dec '03

> "Hmmm.. 'Liberation Technology' there's a book title in there or is it too > close to 'Liberation Management?" Don't forget "Liberation Theology." - -Steve - - - - - - - - - - - - - - - Sometimes I sits and thinks and sometimes I just sits. --Anon.

1 0

Re: e$
by jdd＠aiki.demon.co.uk 17 Dec '03

17 Dec '03

In message <199408151803.LAA10559(a)netcom8.netcom.com> "James A. Donald" writes: > I wrote: > > > You made a claim concerning our judicial and legal system, > > > a claim so far out of contact with reality that nobody can be bothered > > > to refute you. > > > Jim Dixon writes > > I made no claim. I asked a question. I quote the exchange in its > > entirety: > > > > > Jim Dixon says: > > > > In message <9408101428.AA26732(a)snark.imsi.com> perry(a)imsi.com writes: > > > > > [Perry's claim deleted] > > > > On what experience or observation do you base these rather extreme > > > > remarks? > Sigh. > > Let me introduce you to the real world. > > Perry was expressing, in his usual intemperate fashion, the > dominant legal philosophy that is known to lawyers as > "legal realism". If you are a judge, and you are not > a "legal realist" you are likely to wind up in charge > of the night court at Upeka. > > "Legal realism" is not in fact a form of realism but of nominalism. While the claim made may indeed be a form of nominalism, you seem to miss the point entirely. I made no claim. Perry made the claim. I simply asked him what he based it on. You then commented that my claim (which I hadn't made) was far out of touch with reality. You now offer to introduce me to the real world. The world that you are introducing me to is something more like a funhouse, with everything upside down and backwords. I think that I have a good functioning understanding of how the US judicial system works. I have been in court on a number of occasions in various roles. The outcome of the system has a large random component -- we have won cases that I thought that we would or even should lose, and sometimes the opposite occurred. The results are also often skewed one way or the other because of personal or group bias. But we are getting pretty good at playing the system, so we generally win these days. If someone were to ask me to describe one part or another of the US system of government, I might or might not have a formed opinion. If I have a formed opinion and someone asks me a reasonable question like, "on what experience or observation do you base these beliefs?" I generally have no difficulty in answering the question. The answer might be tediously complex, because I do not believe the world is simple. This subthread began with my observing that if e$ were handled carefully, it would not violate the provisions of the Constitution against alternate currencies. Perry referred to this as 'splitting hairs' and then claimed that the legal system was a charade and that 'they' would reach any conclusions that they liked. Shortly after his outburst someone more rational asked a lawyer who asked his wife who is a lawyer specializing in securities. Her opinion was pretty much the same as mine. Other sources that I have checked with seem to have much the same opinion. My narrow observation seems to be correct. You and Perry have made claims about the general functioning of the US legal system. The only claims that I have made are two paragraphs back. -- Jim Dixon

1 0

"finger remailer-list@kiwi.cs.berkeley.edu" now operational
by Raph Levien 17 Dec '03

17 Dec '03

Hi all, I have written and installed a remailer pinging script which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, at http://http.cs.berkeley.edu/~raph/remailer-list.html Please do not take the uptime figures too seriously, at least for another week or so. The script has only been running reliably for a few days. Please let me know about any other remailers which I missed. I've only included remailers which can mail to arbitrary addresses, so I already know chop and twwells are missing. If you've got a Web page, please feel free to include a link to this page. If you think your Web page is relevant to the subject of remailers, let me know and I'll link it in. Comments and suggestions welcome! Raph Levien

1 0

HOPE
by John Young 17 Dec '03

17 Dec '03

Responding to msg by adam(a)bwh.harvard.edu (Adam Shostack) on Mon, 15 Aug 5:41 PM > Anyway, thats my brain dump on clipper from HOPE. >There were a fair number of cypherpunks there; anyone >else want to offer additions or corrections? Thanks for the report Adam. If anyone wants the NY Times light-hearted article on HOPE today email me. John

1 0

Nym server?
by nobody＠kaiwan.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- So now do we need a Cypherpunks Nym Server? I notice that somebody else is using my alias... ah, well. For the record, the Diogenes who just got active on Cypherpunks isn't me, and, as you can tell by checking corresponding signatures, I'm the one who called attention to the 6-digit PGP ID clashes, related them to the birthday paradox, and recommended increasing the ID length back in April (Raise your hand if your PGP key ID is F3AF75). It shouldn't come as a surprise: as with everything else in cyberspace, Vernor Vinge predicted it in True Names a decade or so ago, when he noted in passing that the protagonist Mr. Slippery downloaded a massive chunk of bulletin board to his home machine and scanned through it for messages to him, tossing (manually, I think) messages to the several other Mr. Slipperys. Diogenes I -----BEGIN PGP SIGNATURE----- Version: 2.6 iQB3AgUBLk/w7/DWSFsVTVI5AQGa6AMLB4oFNC0k36qqimd6ci3hE1GTLLsfQO23 5vBQanWfmWZ5mSLJiI6ufnwIsXMqMGYhfKgGA+V+K+qb8nHDXrQU+W8ITPnxBSsG KFaPdD7D4Qe1A+x4LCM+nfB4eLJQpX4wxwQ= =FPdH -----END PGP SIGNATURE-----

2 1

Re: ecash-info
by Zipper 17 Dec '03

17 Dec '03

> I found the original message. Digicash has a great product, but their > marketing skills are rather weak. They need someone that knows how to put > their product out into the world. Since just about every store I go to > seems to be a Telecheck customer, you should definitely try to hook up with > them. I can see big $$ for both of you. Try to talk to the man (David > Chaum) himself. > Thanks. I send e-mail to the digicash.support.nl with no luck. After you responded, I was interested enough to web out to them until a core dump dropped me back to reality. I FTP'd some of their promotional stuff including Chaum's articles. For the most part I have been lurking and thought e$ would be nothing more than a pipe dream, until I saw the beta testing msgs. Now I am a little more interested and I am looking for any and all additional research I can find. I think it would be kinda nifty to come up with some kinda' experimental beta test here in the States. I'll do some headscratching and see with what I can find out. > It would be great if you could share any info you might obtain with the > list. Most of us are eager to become customers... > > --Lucky I will CC relevent messages to the list. Only, any system I develop would have to have a centralized database to prevent double-spending and fraud. I don't quite understand how they are going to work around such a problem, and I can probably surmize why the total lack of response from them. -- Joe N. Turner Telecheck International turner(a)telecheck.com 5251 Westheimer, PO BOX 4659, Houston, TX 77210-4659 compu$erv: 73301,1654 (800) 888-4922 * (713) 439-6597 Key fingerprint = EF E3 D5 8A EE F6 EB BB FA C6 BF 3E 12 70 FF 8E

2 1

Re: ecash-info
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 8:22 PM 8/15/94 -0500, Zipper wrote: >I think it would be kinda nifty to come up with some kinda' experimental >beta test here in the States. I'll do some headscratching and see with >what I can find out. Me too. With that idea in mind, I called them about 6 weeks ago to get some stuff sent to me in the mail, and got put on the blower David himself. After I picked myself up off the floor, I told him how some cronies and I were interested in linking up with a bank to try a market test. The idea was that the bank puts up a (forgive me, but they'll understand it better this way, I swear) "drive up window on the information highway", and some third third party (or even the bank themselves) would issue and underwrite the digicash. If the bank doesn't do it, I was hoping there would be a market for third-party underwriters. That's where most of my team's skills might work, anyway. Anyway, when I screwed up the guts to ask, Chaum told me that the going price for the underwriter's license/code was $275K plus a percentage of the net profits. He said that it would include some development support. He said that he'd send some stuff, and he got my address, but I never got anything back either. The price didn't seem too outrageous to me at the time (Boone Pickens: "You can name any price you want, if I can set the terms"), but the problem is, there's no data to determine what the market would be. I guess that's why they call it risk capital. >From what I've read in the press about him, Chaum has talked to very large banks about this, and hasn't seemed to get anywhere with this except for non-internet uses (automated tollbooths, smartcards, etc.). It's possible he sensed my relative playerlessness and blew off the follow-up. Seeing the increase in traffic about his inactivity in promotion leads me to believe that he's either working hard in getting his product market-ready, which makes sense, or he's dropping the ball, which I would charitably say is an unfair reading of the facts. I think that accusing him of not properly promoting his product misses two points. The first is, everyone who is the least bit interested in e$ knows what Chaum is doing, and that's everyone who could do anything with the information, thus his promotional activities on that front are quite successful, I would say. The second point is if he really is bringing new code to market, increasing expectations until the code is ready could cause more harm than good. I agree with you. I expect that if a bank with a significant institutional, trustee, or transaction processing presence stepped up to the plate on this something interesting could happen. I am interested in approaching a bank here in Boston with those credentials once I have something (or even someone) to go in there and talk to them with. > >Only, any system I develop would have to have a centralized database >to prevent double-spending and fraud. I don't quite understand how >they are going to work around such a problem, and I can probably >surmize why the total lack of response from them. My own auto de fe on all this is that in the early stages, most digicash will go straight to the bank to be cashed out. Enough people will be sent to jail at this stage that people will be very careful not to double spend in later secondary transactions where a piece of cash is spent several times before being cashed out. Eventually, the protocols will be imbedded so far into the software's user interface that it will be very hard for the average person to double spend by accident. Professional criminals who do it on purpose will be as prevalent as counterfeiters are now. There will be a few determined people who will get caught inevitably and go to jail. I don't expect the level of fraud in digital cash to be much higher than that of credit card fraud, which as we've discussed here, is pretty low. I expect that the level of digital cash fraud will be about that of counterfeiting now, which is pretty damn low, I bet. I like this. I must say that the last month or so has been a really good month for e$ discussions here. Thanks to all who have been talking about it. We should remember that certain people around here are very good at what they do, and should be paid attention to even when their delivery can be upsetting for one reason or another. I chalk it up to interface fatigue, in the sense that there are certain abrasions that occur when so many brains of different viewpoints bump against each other here on the net. Another way to look at it may be another form of friction, the transaction cost of the information you get by interacting on the list. That's certainly appropriate to a discussion of internet commerce, eh? Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1