December 2003 - cypherpunks-legacy

Re: Encryption: A Testimonial
by peter honeyman 17 Dec '03

17 Dec '03

> Actually, you could fool a lot of people by creating a hidden disk > partition. Nobody would know there was anything hidden unless they did > a detailed sector-scan of the disk. Is there any good software for > doing this with modern operating systems? this is very easy in unix: put your secret stuff in a directory, then mount a file system on that directory. peter

2 1

use cypherpunks-request@toad.com to unsubscribe
by VACCINIA＠UNCVX1.OIT.UNC.EDU 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Is there some reason that all these people are unsubscribing to the list? It's getting quite annoying. To anyone who wishes to unsubscibe, please do so to cypherpunks-request(a)toad.com, I do believe that's the correct format. I already know why your unsubscribing, you don't have to tell me either of the two reasons. Scott G. Morham !The First, Vaccinia(a)uncvx1.oit.unc.edu ! Second PGP Public Keys by Request ! and Third Levels ! of Information Storage and Retrieval !DNA, ! Biological Neural Nets, ! Cyberspace -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLOnGuj2paOMjHHAhAQFeegQAoLjOfj3QrpZrSadjNwCMGHKgvyWarqXM RsD3ZoOLKFZ3bIY52cD4ZlxKEe6a/XeRnnSfwBJiNRDw9N7hpMoiNDWUWOSJJ7bb mZsSLkjF3daGGjikRXdqJWjpPVSMoVgERjY/76+lMMu/PKkzmxPa8vIn5vikIU9q 8BxidRWlcGs= =8WA2 -----END PGP SIGNATURE-----

1 0

CYPHERPUNK CRIMINAL t-shirts
by Stanton McCandlish 17 Dec '03

17 Dec '03

Several people apparently missed the original post and have no idea what t-shirt is being referred to. Here it is again. So far I've gotten about 30 "I want one" responses. I'm not sure if the customization is doable, especially the digital signature, but we'll see. _______ begin fwd ______________ > L. Detweiler has a rather hefty essay in the latest Risks on the > subject of `pseudospoofing', social parasites, "a criminal group > called the CryptoAnarchists" (with members such as "Eric May" and > "T.C. Hughes"), and such matters. I will not forward it to the > list, unh unh, no way. Reminds me of one of my proudest moments: L.D. (who this time claimed their first name was Linda; what a pseudospoofer!) in a fit of rage labelled me a "CYPHERPUNK CRIMINAL", caps L.D.'s. I'm thinking of having one of those little desk signs made, saying "Anton Mechanism, Cypherpunk Criminal" just for kicks. Or maybe a t-shirt. Hell I could market these, personalized: Stanton McCandlish, mech(a)eff.org [pgp sig here] CCCC Y Y PPPP H H EEEEE RRRR PPPP U U N N K K C Y Y P P H H E R R P P U U NN N K K C Y PPPP HHHHHH EEEEE RRRR PPPP U U N N N KKK C Y P H H E R R P U U N N N K K CCCC Y P H H EEEEE R RR P UUU N NN K K CCCC RRRR IIIII M M IIIII N N A L C R R I MM MM I NN N A A L C RRRR I M MM M I N N N A A L C R R I M M I N N N AAAAA L CCCC R RR IIIII M M IIIII N NN A A LLLLL Anyone buying? _____________ end fwd __________________ They'd be black w/white lettering of course, so they glow mightily under the black light. What I'm looking to do is *maybe* make these shirts, mostly in XL, but some XXL's also since people ask for them, and in a good weight of cotton, then sell them at a not unreasonable profit. Probably $10 or $15 + p/h. This will not be done immediately, I'm still trying to figure out how much it would cost to do this, especially if they are customized. Probably will make a non-custom version, and if possible a custom one that would cost a little more. Time will tell, but I can't guarantee anything yet, since many of the details are up in the air, and I'll have to see whether or not I can afford the initial outlay (I'm planning to move by Jan., so this proj might get backburnered until Feb. or something. If you are in, just send a note, and I'll add you to the list (probably w/o replying) of people that want one. Please specify if you would NOT be interested if it's not customized, as that's significant. Now back to the regularly scheduled flames, code haggling and NSA bashing. -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G -- Stanton McCandlish mech(a)eff.org 1:109/1103 EFF Online Activist & SysOp O P E N P L A T F O R M C R Y P T O P O L I C Y O N L I N E R I G H T S N E T W O R K I N G V I R T U A L C U L T U R E I N F O : M E M B E R S H I P @ E F F . O R G

1 0

Re: CryptoCards
by Carl Ellison 17 Dec '03

17 Dec '03

One reader writes: >please send your contacts since I need to do price comparisons. Thanks. OK -- it's enough work typing that I'm sending this to the whole list. These are about a year old so they might have changed. Racal-Guardata 480 Spring Park Place - Suite 900 Herndon VA 22070 TEL 703-471-0892 FAX 703-437-9333 (my contact: Marc Paulina) Cylink 310 No. Mary Ave Sunnyvale CA 94086 TEL 408-735-5885 FAX 408-735-6645 (my contact: John C. Kennedy; jk(a)cylink.com) Digital Pathways 221 West Grand Avenue Montvale NJ 07645-2019 TEL 201-391-5100 FAX 201-391-9138 Security Dynamics One Alewife Center Cambridge MA 02140-2312 TEL 617-547-7820 FAX 617-354-8836 (my contact: Susan Symanski) Enigma Logic 2151 Salvio, Suite 301 Concord CA 94520 TEL 510-827-5707 FAX 510-827-2593 - <<Disclaimer: All opinions expressed are my own, of course.>> - Carl Ellison cme(a)sw.stratus.com - Stratus Computer Inc. M3-2-BKW TEL: (508)460-2783 - 55 Fairbanks Boulevard ; Marlborough MA 01752-1298 FAX: (508)624-7488

1 0

Re: All our eggs in one basket?
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Some of Jim's points can be addressed with existing protocols. When the bank sends you cash which you have withdrawn they would want to send it in such a way that they get a return receipt from you. That way they can prove you have received it. Schneier's book describes such a "digital certified mail" protocol in section 6.3 of his book, but it looks like it uses a lot of data. More concise implementations may exist. Other forms of cheating could be imagined. I could send cash to a company, and they could refuse to send me goods, but claim that they had done so. Or I could receive goods from a company, but claim that they never arrived. These could also be addressed with certified mail, either paper or digital, depending on whether the goods are physical or electronic. In an online system, the bank could refuse to accept a cash deposit, even though it was valid cash, claiming that it had already been deposited. To prevent this, the bank would have to record who made each deposit in the past and stand ready to reveal this information. A merchant could collude with the bank to provide forged deposit records to help with this scam. I don't see how to solve this one, but if it were done on a large scale people might become suspicious about the excess of apparent double-spending via a small number of merchants. The bank's reputation would suffer, as long as people found out about it. Perhaps customers should demand that banks publish statistics about (apparent) double-spending in order to detect this scam. Hal Finney hfinney(a)shell.portal.com

2 1

Thanks.
by A.J. Janschewitz 17 Dec '03

17 Dec '03

Thanks to the several who have responded to my info request ... I'm all set.

1 0

Nightly Business Report
by mkapor＠kei.com 17 Dec '03

17 Dec '03

Announcement suitable for reposting. Please pass this around all the usual places. On Thursday, November 25th, the Nightly Business Report, which is broadcast nationally on PBS, will feature a Thanksgiving Day special on "The Informationm Highway". Guests include Ray Smith, CEO of Bell-Atlantic, and Mitch Kapor of EFF. Check local listings for times. I taped this yesterday and think it will be worth watching. ................................................................... Mitchell Kapor, Chairman <mkapor(a)kei.com> Electronic Frontier Foundation *** Join EFF!!! Send mail to membership(a)eff.org for information ***

1 0

Re: All our eggs in one basket?
by jim＠bilbo.suite.com 17 Dec '03

17 Dec '03

> How can I prove that the bank did not send me the money? > > The withdraw protocol must somehow produce a receipt, > signed by *me*, saying I receiving the money. If the bank > cannot present such a receipt, then the arbitrator > shouldn't believe that the bank really sent the money. > > Yet why would I sign a receipt before verifying that the > bits the bank sent me was a valid chunk of digital money? > Does this mean the bank sends me valid digital money first > and I reply with a signed receipt? > Perhaps the bank would send the valid chuck of digital coin first. If I failed to reply with a signed receipt, the bank could invalidate the digital coin. I assume the bank could register the coin in a "voided coin" registry, placing my "name" in the registry along side the coin's ID. If I kept the coin, without sending a receipt, and later tried to spend it, I would eventually get caught. The coin would make its way back to the bank and when it arrived, the bank would see that it was a voided coin and it would know that I was the one who first tried to spend it. Here's the protocol so far: 1) I send the bank a signed request asking to withdraw $10,000. The bank could use this request to prove it was given permission to withdraw money from my account. 2) The bank withdraws the money from my account, mints digital coin X with value $10,000 and sends it to me. 3) I validate the coin, and send a signed receipt saying I received coin X with value $10,000. If I fail to send the receipt, the bank places my "name" and "coin X" in a voided coin registry, and refunds my account for the value of the coin. What if I send the receipt, but the bank puts the coin on the voided coin list anyways *and* fails to refund my account? I would want some way of proving that I received a valid coin, sent the receipt, and the receipt was received. To do this, we modify step 3). Instead of simply sending the bank a signed receipt, the bank and I would engage in a simultaneous contract signing protocol which would result in both parties receiving a "receipt" of the coin transfer. If the bank tried to cheat me by putting the valid coin in the voided coin registry, I would be able to prove that the bank sent me the coin (I still have the coin) and that the bank received a receipt (I have a copy of the simultaneously signed receipt). If I tried to cheat the bank by saying I never received the coin, the bank would be able to prove that I *did* received the coin (the simultaneously signed receipt indicates that I *said* I received the coin). The bank also has the signed withdraw request proving it was authorized to withdraw money from the account. If I received the coin, yet fail to engage in the receipt signing protocol, the bank would place the coin in the voided coin registry. If the bank withdrew the money yet failed to send me the coin, I could show the arbitrator my last two bank statements (before the cheating). If the bank could not produce the transfer receipt for the disputed withdraw, the arbitrator would rule in my favor. How does all this sound? I'm not claiming to have just invented something. I'm just trying to find out if I correctly understand the withdraw of digital coins from a digital bank account. Jim_Miller(a)suite.com

2 1

anonymous postings and trust
by Black Unicorn 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Consider this -> Date: Fri, 19 Nov 93 13:15:20 GMT From: jrk(a)sys.uea.ac.uk (Richard Kennaway) Subject: Useless anonymity We are accustomed to seeing useless messages of various sorts on this and other electronic forums. Messages that quote a long article only in order to add "Me too" at the end, messages of no interest to anyone but the individual they are directed to, content-free banter, ego-driven flame wars, and so on. They still happen -- inexperienced people are always joining the net - -- but most people eventually learn to avoid making these faux pas. <- I agree. Especially with regard to the "Me too" analogy. - -> Anonymity brings a new class of useless message, of which the following from Black Unicorn <unicorn(a)net.digex.access> is a recent example. I quote it in its entirety: >Having worked in Liechtenstein banks, I can assure you numbered >accounts exist. <- You would have preferred that I quote the entire thread and then add my comment? Or is it the lack of accompanying detail in the comment that you resent? - -> "Black Unicorn" is an obvious pseudonym, and I'm assuming that it is not one with an established reputation. (For all I know, "Black Unicorn" might be as famous as the Legion of Doom, but for the sake of argument I'll assume that it isn't.) <- To begin, I have been active in cypherpunks list since about last fall or winter (the exact date escapes me). I left during the summer to return home (Liechtenstein) and returned to the states with new internet arrangements recently. I don't claim to be reputed on the list, but I hope likewise that I am not notorious, certainly not on the level of the "Legion of Doom. Oh, just so everyone knows, I'm a he, not an it. - -> What is the use of an unsubstantiated assertion, from an unreputed[*] source, with no means of verification? Having read Black Unicorn's bald asertion (sic), I am as ignorant as before of whether numbered accounts exist, in Liechtenstein or elsewhere. <- What use is an unsubstantiated assertion from a "reputed" source? It is likewise dependent upon your evaluation of credibility. What I see here is a fundamental difference in the concept of anon posting. I hold a JD from Georgetown and a masters in International Relations to boot. Part of my marketability in the job market was the appearance of a conservative and level headed, status-quo loving, policy wise, right wing, go getter. Considering my employment and the nature of my (rather questionable) intellectual pursuits, (cypherpunks fitting the bill when one considers the political views of my employer and colleagues) it makes little sense to post as my self, but I prefer not to post as anXXXX(a)anon.penet.fi either. My access account is a nice compromise. Publicly at any rate. In E-Mail, should you wish to so correspond, I would be happy to discuss more specifically, my employment or my experience. To do so publicly is to shoot myself in the foot. I might add that for other purposes, I use anon.penet.fi as well, but this is when I'm more interested in not having any accountability what so ever. Under these circumstances, I understand the reluctance to give any weight to a post, in fact I would argue that most of the time, those who post through anXXXX don't intend that their posts be given much weight. Usually these are harassment posts or questions that posters don't want later attributed to them. The purpose is to avoid a great deal of attention, other than by those in the know (with the question example at least). You are perhaps ignorant of Liechtenstein's banking policy, most people are ignorant of Liechtenstein. My intent was to at least advise the poster that his/her research was not yet in enough depth. I really was, and am, not in a position to comment on banking policy in a public way in much detail. Even commenting at all was within an ethical gray considering my former and current connection with the industry. If what you're looking for in every post is proof, then you might as well ask for a digital signature from a large bank in Liechtenstein. A digital signature from His Serene Highness Prince Hans-Adam II might come closer. Even then it comes down to how well you trust the signature. Strictly speaking, by your argument, anything I post is to be ignored. Even posts with regard to weather (subject matter appropiateness non-withstanding). Should you be more interested in detail, I would be happy to discuss what I can in person, by telephone, or in encrypted E-Mail, in descending order of the detail I would be willing to disclose. - -> New ideas or arguments can be useful regardless of their source. <- Harmonize this with your previous and later position that my post is entirely without value. Did I contribute nothing at all? - -> Likewise pointers to places where evidence may be obtained. Assertions by reputable sources may be taken on trust (I place far more weight on Perry Metzger's comments about numbered accounts than the Black Unicorn's). <- (1) providing specific past employment information about myself publicly would tend to place me in a compromising position. (2) the amount of weight you assign any post will depend on your experience with that posters previous record and accuracy. If I used the pseudonym "Tom Jones" would you be happier? It's still not my name is it? Seems to me you are expressing trust reservations that should be based on time gained experience and not the superficial appearance of my name. If your position is solely that you have never seen posts by me before, and therefore are unaware of my credibility, fine, but characterize your criticism in that frame, not by ranting on anonymous posts. If my name had been Majud Rajakad, would a trust factor (positive or negative) be implied? What about Roosevelt Washington, or Fred Rosenberg? - -> The quoted message does none of these. It is wholly useless, a waste of its author's time, and of ours. <- I enjoy posting to cypherpunks. Hardly a waste of my time, I cannot speak for you. - -> [*] "unreputed": a word I just coined as an opposite to "reputable", meaning not "disreputable", i.e. having a bad reputation, but having no reputation at all. <- Gee, thanks. - -> - -- ____ Richard Kennaway __\_ / School of Information Systems Internet: jrk(a)sys.uea.ac.uk \ X/ University of East Anglia uucp: ...mcsun!ukc!uea-sys!jrk \/ Norwich NR4 7TJ, U.K. <- - -uni- (Dark) -----BEGIN PGP SIGNATURE----- Version: 2.3 iQCVAgUBLO03axibHbaiMfO5AQFXmAQAlLvcJ+A5W5ZTH8lUjuJtInyqkeqKFtlj zRFE7h+5h1KWcXbx7r5HzHKGZf2YQycR+l+Jn+WDSZ/nizAagMJuo+VLhvffi7+a U5y7eg4cXzrW3pG0eCwR53Ivll6AxZGS56aAuJAiUQafuZOvHHa8loMTAjlT3P4O siQtqR/6ruM= =ksGs -----END PGP SIGNATURE-----

1 0

Re: All our eggs in one basket?
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

Although Jim's protocol doesn't quite work, as Eric pointed out, because of the re-blinding, it does suggest another approach. If the bank sent you a coin and you claim you never got it (maybe you're telling the truth, maybe not), they can just send it again. You can't cheat because at best this will allow you to get two copies of the same coin. Contrariwise, if the bank cheats and never sends you the coin, just ask them to send it again. They have no basis for refusal. Here we see a case where the ease of duplication of digital money is actually an advantage, rather than the disadvantage it usually seems to be. Hal Finney hfinney(a)shell.portal.com .

2 1