December 2003 - cypherpunks-legacy

Chimerically Misquoted
by Jeff Davis 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- From: "Jim Sewell" <jims(a)Central.KeyWest.MPGN.COM> The term Cypherpunks is amorphous, thus subject to use and abuse by the masses. When people like Jeff Davis and Phill Zimmermann say "The cypherpunks are generally opposed to Clipper" it makes us an "organization" which, like it or not, does have representatives and agendas. Unfortunately, perception defines reality. If we I've never said this in any forum, public or private. The only Zimmerman quote on cypherpunks I've ever seen was in the WSJ. He stated he was not a cypherpunk, he wore a suit when he contacted clients. In responding to this, I've opened myself to another spew by Perry, but what the fuck. If one has to take a cheap shot, one is already whipped. And I'm not here to win a popularity contest either. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLcXKAl/ScHuGXWgVAQFq9gP+MP1BlrWA5IMO6SMOBsB6UBaIxJQ33Dtv vwc37mUc3YoueFpoQJVDPEfYHzsVThJI1gJNGOV4ELtN/YYaQx9jDpyV+dsQfEtC F7g2Wyx6mlo6AP7E2PYomBgAQD54liHgCUQJPmxEQMW8fdTEoMQsg4GpLvejeQo4 mCh8x0pXGjM= =aJDt -----END PGP SIGNATURE----- -- PGP PUBLIC KEY via finger! JAFEFFM Speaking & Thinking For Myself! * eagle(a)deeptht.armory.com email info(a)eff.org * *** O U T L A W S On The E L E C T R O N I C F R O N T I E R **** ***** Committed to Free Public Internet Access for World Peace *****

2 2

well, I finally broke down.
by Matt Thomlinson 17 Dec '03

17 Dec '03

I finally broke down and felt guilty enough about not using magic money that I decided to spend the time and get it. Funny thing, I can't even follow the simple directions hal posted about getting ahold of it. No wonder it isn't being used. ----------- Date: Mon May 2 23:07:00 1994 From: Hal <hfinney(a)shell.portal.com> <hfinney/daemon> [...] How do you actually use Magic Money? First you get a client program. ftp to /pub/mpj at ftp.netcom.com to find a DOS client. Sources to allow you to build Unix clients can be found at csn.org by ftp; start in the /mpj directory, read README.MPJ, then cd to the crypto directory. cd to pgp_tools, get mgmny10e.zip and pgptl10d.zip. ------------ uh-huh. I went to netcom and didn't see any dos client. again, please? In response to tim's recent posting, he asks why DC Nets, digitial timestamping services (and other pretty protocols) aren't being used. This is exactly what I asked a few months ago! We need to either have or create a use for these tools, or they'll never be used. I described a simple, simple version of digital timestamping a few months ago; there was little interest. Reasons? Not much use for digital timestamps, for one. Also, people were hesitant about stepping on bellcore's toes. So what are we to do? I'm not going to spend the < half day it would take to set up a digital timestamp service if it isn't ever going to be used. Matt Thomlinson University of Washington, Seattle, Washington. phone: (206) 548-9804 Check my home page -- ftp://ftp.u.washington.edu/public/phantom/home.html PGP 2.2 key available via email, or finger phantom(a)hardy.u.washington.edu

1 0

Virtual Cash
by dwomack＠runner.utsa.edu 17 Dec '03

17 Dec '03

>One reason they haven't caught on is that there *isn't* a model. There >is software (cypherpunks write code! :-) to implement banks and >exchange coins (the tacky tokens themselves) but noone (as far as I've >seen) has come up with an "economic model" within which they could use >them. (In spite of perry's objections, the economic discussions *are* >relevant here... many readers seem to not understand the complexities >of money systems, without which *using* e-cash won't be practical, so >we need some major cross-breeding here.) But, don't we have a good model? Pre 1929, didn't most banks issue their own version of US currency, backed by their own reserves? If an easily usable program existed to generate the tokens (please, in decimal units, not in farthings, shillings, and binary!) any issuer could distribute them. Assuming the token signature couldn't be forged, each issuers "reputation" would determine the fair market price of a token. Thus, 1,000,000 Rubles = $550 (US); The market has determined that the Russians don't have a strong financial reputation. In the cypher world, someone who issued tokens and redeemed them for pure gold at 100 tokens per oz. would quickly have a very strong rep., while those who turned out billions of the things backed by nothing wouldn't have much of a rep. Merchants might (or might not!) accept tokens from an unknown source, or from a known weak source. This could even lead to "central clearing houses", who would issue tokens under their own name in behalf of others, based on a balance of good funds (i.e., gold, silver, US Dollars, or whatever). They might charge a fee for such services... of course, in an unregulated environment, there would be risks of fraud. If I might suggest, the key is widely ported, inexpensive, easy to use software to generate the tokens. Let people start to mint, distribute, buy, sell, and redeem the things. A market (with market values) will develop....just as it does in countries that wind up using cigarettes for currency. Would it not be possible to have a program that 1. Accepts a strong password 1.a Accepts an identity and address 2. Accepts a denomination preference 3. Accepts a quantity preference then 4. Generates tokens with a signature as in PGP or, when tokens are received, 1. Shows the issuer id and address 2. Shows denomination and quantity of each 3. Verifies signatures 4. Stores tokens (perhaps with no way to extract or duplicate them?) 5. Displays storage by category, denomination, issuer, and so forth 6. Can DESTROY tokens (i.e., take them off the market) and, perhaps most importantly, there has to be a way to prevent copied tokens from being distributed without restriction. (i.e., Sandy sends Dave 5 of his tokens. Dave, being unethical, copies the 5 tokens and sends the same 5 tokens to everyone on the C.Punks list. Now Sandy has *_hundreds_* of people with the same counterfeit tokens! It would be as if anyone with a copier could counterfeit US currency) Can a program prevent such behavior? Has this already been done with Magic Money? Or is the program still waiting to be written? Regards, Dave

1 0

A distribution solution!
by lassie!jim%lassie＠netcom.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- PGP distribution to the masses. To preface this message first I would like to state that the clue full people here on the Internet forget that the rest of the world is truely clue less. Of course they also may consider you as the clueless ones. It is often stated that PGP is available on numerous Internet FTP sites and many BBS's. The average person knows as much about FTP sites as they hear on the evening news about the information superhighway. They may keep financial books or maybe write books on their computer but they do not have substantial online experiance and they may have a need for secure data encryption or secure way to send data to a publisher, business partner etc. Disk mailers are still sold rather widely. The average person trying to download PGP from their local BBS has a few steps to go thru. These clueless computer users once again may be unfamiliar with the intricacies of online BBS use but does not mean that they should not be allowed to access a good crypto program. First they must find a bbs number localy to call. Then they must wait X number of hours before the phone is not busy to connect. Once online they have to register and do a call back verification and then they can access the file area where PGP should be only to find it is not on this board. So they download a list of BBS's in their area and start going thru the same call, verify, is it there loop. This may be an endless loop in some areas. Anyway this is a mute point as the clueless average user has never heard of RSA or public keys or PGP. Should criminals have PGP or other crypto software? Should distribution be regulated to only law abiding citizens? Should guns be registered, or should gun owners be registered. The average low level drug dealer uses both the common plastic baggie and the digital pagger. Maybe the government should regulate the sale of baggies at supermarkets, after all you have to have a container to put drugs in to sell them ("hold your hand out I'll drop an oz. of coke in it"). Then again there could be a five day waiting period on pager and celular phones sales and instalation. This would definatly solve many problems with those pesky drug dealers. Of course there is always cars that could be regulated. They are contributory to many crimes and deaths. How would you make sure the person you are selling your used car to will never drive while intoxicated or break any speeding laws. You can not. What's the point here? Well if there is a mandated crypto standard then every zip on internet of PGP or other crypto software could disapear overnight, just deleted by the system admin under penalty of law. There would still be copies on local BBS's but as we have discovered the average computer user does not access these. How could people change this I wonder? People talk about handing PGP or other crypto software out but there is a substantial cost to the return of each disk. 1 disk=one user. In my opinion the easy way to do it would be this: 1) Find someone with a free use BBS that would like more traffic on his BBS. 2) Upload the files for PGP and other crypto software on their system in maybe a special file area. 3) Take out an add in the Sunday paper (maybe get the BBS owner to pay half of the cost)that reads as follows; "!!!FREE!!! Unbreakable data encryption software. ###-#### 8N1 file area is CRYPTO !!!Absolutely FREE!!!" They now know where and how to precisely find the stuff and what it does. Now the average person has access to the software and use of the software in a rather large scale. If you had a choice to encrypt your data for free or pay to add some chip that is not secure. If you take the secure factor out of the equation then all that is left is the fact that one is free and the other costs good hard earned cash. I don't know about you, but I learned rather young that "If it is free, get two of em!". Thanks for your time! :{)} -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLcXai1fzDU5jV4uhAQH3KAP/ee88w1f0kAyYt8ipShd1+DQ0D4oTSle3 L6PbieU0ODJstkXgRsXzD7m4Pf3+xIp0MsN2eYhjP09OFK/OI/VfhhtF9mX9HxJ6 sE74XEo+MRM7kq2O8DkIfZ8oVxrs7W3RTbqulnUz6a5aF2YtLevPuMg15pFyqQrD xol2UYgEKFE= =Ea5b -----END PGP SIGNATURE----- -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3a mQCNAi3EyycAAAEEALFXi8P43juu9a6L30CUHbNqQ2RtqTueq4wPdc8ov9UTnKZR dCoQBFUk0HPxQs86yN0g+fQV3YXtDOdQzyMGglq+eqAouRsNlvUaFXl/PJcQmjuh anCvC2bNB121j+RgpqtagW2rmzqfc2upnS913lhZ4cW1LTPw11fzDU5jV4uhAAUR tDZKaW0gTmFsYmFuZGlhbiA8bmV0Y29tc3YhbGFzc2llIWppbSVsYXNzaWVAbmV0 Y29tLmNvbT60H0ppbSBOYWxiYW5kaWFuIDxUZW1wZSwgQXJpem9uYT60DkppbSBO YWxiYW5kaWFu =J781 -----END PGP PUBLIC KEY BLOCK----- -- * Spelling errors are intentional and international * Jim Nalbandian netcomsv!lassie!jim%lassie(a)netcom.com Tempe, Arizona, USA N7SZS(a)K7BUC.AZ.US.NA No free man shall ever be de-barred the use of arms. The strongest reason for the people to retain there right to keep and bear arms is as a last resort to protect themselves against tyranny in government. <-------- Thomas Jefferson --

2 1

the value of money
by Hal 17 Dec '03

17 Dec '03

What is Magic Money? Magic Money is an implementation of one of the first "digital cash" proposals, described by Chaum, Fiat and Naor in Crypto 88. It is an "online" system. This means that the money must be checked with the bank at each transaction to make sure it has not been spent before. It was written by the pseudonymous Pr0duct Cypher, author of the PGP Tools library. What is digital cash? Digital cash (aka digital coins) is a cryptographic technique for creating information packets which can be authenticated as belonging to the issuing agency, but in such a way that no one can link a piece of digital cash to the transaction in which it was created. In other words, the user is issued a piece of digital cash by communicating with the bank via a special protocol. This cash bears a digital signature by the bank which can be verified by anyone, and which cannot be forged. However, the cash creation protocol is such that neither the bank nor anyone else will recognize that piece of cash as having been withdrawn at that particular interaction. This combination of characteristics makes digital cash an attractive option for electronic payments. The digital signature makes it unforgeable, while the lack of traceability protects the privacy of the person spending the cash (in contrast, say, to credit card use, where the credit card company learns many details about the spending habits of its customers). What gives digital cash value? That is what I am hoping people will discuss. Here is what Pr0duct Cypher wrote in his introductory message about Magic Money: > Now, if you're still awake, comes the fun part: how do you introduce real > value into your digicash system? How, for that matter, do you even get > people to play with it? > > What makes gold valuable? It has some useful properties: it is a good > conductor, is resistant to corrosion and chemicals, etc. But those have > only recently become important. Why has gold been valuable for thousands > of years? It's pretty, it's shiny, and most importantly, it is scarce. > > Digicash is pretty and shiny. People have been talking about it for years, > but few have actually used it. You can make your cash more interesting by > giving your server a provocative name. Running it through a remailer could > give it an 'underground' feel, which would attract people. > > Your digicash should be scarce. Don't give it away in large quantities. Get > some people to play with your server, passing coins back and forth. Have > a contest - the first person who (breaks this code, answers this question, > etc.) wins some digital money. Once people start getting interested, your > digital money will be in demand. Make sure demand always exceeds supply. As I indicated at the start of this thread, this model does not seem to be working. What steps could we take to give digital cash value? What are Tacky Tokens? Mike Duvos has been running an implementation of Magic Money that he calls Tacky Tokens. Sending mail to <mpd(a)netcom.com> with the word "Bank" in the subject will cause it to be processed by a Magic Money server and the result returned to the sender. How do you actually use Magic Money? First you get a client program. ftp to /pub/mpj at ftp.netcom.com to find a DOS client. Sources to allow you to build Unix clients can be found at csn.org by ftp; start in the /mpj directory, read README.MPJ, then cd to the crypto directory. cd to pgp_tools, get mgmny10e.zip and pgptl10d.zip. Build these on your system. I also made a half-hearted Mac port which still uses a console window. The client is pretty easy to use. First you initialize it, which involves creating a special public key which will be used for your communications with the bank. Then, whenever anyone sends you some Magic Money, you run the client with the name of that file; the client shows you the denominations of the incoming Magic Money digital "coins", and lets you choose new denominations for when you turn these in at the bank. This creates an output file which you mail to the bank. You'll get back another mail message from the bank which you save to a file and run the client on, and the new money is added to your collection. To spend money run the client with the withdraw option, pick the coins you want to spend, and they will go into a disk file. Send this to the person you are giving the money to. There are things that could be improved about this; the interface could be nicer, or it could be integrated better into the mail system. But I doubt that anyone has used it enough that they are tired of constantly switching back and forth between their client and email system. If we had that much cash being circulated then it would make sense to work on these UI issues. But I don't think these are the fundamental hurdles. I hope this gives those who have not heard of the software some idea of how it works and what its capabilities are. Hal

1 0

Re: Lobbying/Politics/etc.
by Richard Johnson 17 Dec '03

17 Dec '03

From the keyboard of: Julietta <albright(a)chaph.usc.edu> > One more thing- I recently completed a first ddrafty of a paper I > am working on regarding computer curveillance, Clipper, etc- and the > professor who read it asked me "What is the likelihood and what re the > reaosns for the NSA and other governments agencies wanting to monitor the > people?" Must the NSA have an institutional reason? Perhaps they'll have concensus problems too. Never-the-less, if the monitoring capability is there, it will (100% chance) be used for things like the following: 0) Legitimate suspicion of a crime being committed, or suspicion of sensitive information being leaked to undesireable parties. 1) Fishing expedition surveillance of 'suspect' groups and individuals, where 'suspicion' comes from political affiliation, contacts with foreign nationals, and the like. Example: the Committee in Solidarity with the People of El Salvador, a left wing social activism group, had their offices searched, had their membership infiltrated, and their communications monitored by the FBI or some TLA. There was no evidence of any wrongdoing -- the perceived association with 'commies' was enough for someone opposed to their aims to begin the harrassment. 2) Obtaining 'dirt' on political opposition, or simply snooping on their plans. Witness our late former President, Richard Nixon and the Watergate break in. Some point to quotes he made that show he believed the president to be above the law. 3) Selling personal data for profit. Witness the crooked flunkies at the IRS and elsewhere that illegally sell information about you to private detectives, credit agencies, and the like. I am not convinced that the current Cripple/Crapstone escrow plan will prevent some crooked cop from selling the keys to a phone or computer, or data gained from an intercept that should no longer be continuing, after his or her agency has obtained the key to decipher a wiretap. The whole NSA, FBI, or the various military intelligence groups don't have to be in complete organizational agreement for such things to occur. All it takes is one person, or a group, with the means and motive. The total lack of respect for the 'loyal opposition' shown by certain higher-ups in the NSA gives me little faith in organizational checks and balances. It's best to not give anyone the power to make the walls of our houses transparent, to driftnet for whatever info they might catch. Richard

1 0

Re: NII Summer Internship at the White House
by DRHilton＠kaiwan.com 17 Dec '03

17 Dec '03

Forwarded from another list: SUMMER INTERNSHIP AT THE WHITE HOUSE The Technology Division of the Office of Science and Technology Policy in the Executive Office of the President has the intention of hiring an intern this summer. The Technology Division is the part of OSTP that works on the National Information Infrastructure Initiative. We would like our intern to be qualified to help the build the White House World Wide Web server, which is likely to be open to the public in the fall. The position will pay between $3,800 and $4,700 for 90 days. The person selected will devote approximately half of his or her time to the Web server and half to general office duties such as answering telephones, making photocopies, and sorting incoming paper mail. Anyone may apply for this position by responding to Vacancy Announcement Number OSTP-94-02-AR (Student Assistant GS-303-3/4/5). Applications must be received no later than close of business Friday 6 May 1994. How to Apply: Send your SF-171 form (Application for Federal Employment, available at a public library or campus placement office) and a written narrative summary of your experience and/or education on a separate sheet, and a SF-15 (Application for 10-point Veteran Preference, if applicable). Where to apply: Office of Science and Technology Policy, Technology Division Room 423, Executive Office of the President, Old Executive Office Building, Washington, DC 20500. You may send your completed SF-171 by fax to 202- 456-6023. Applications must be *received* by the closing date and will not be returned. Relocation Expenses will *not* be paid to the applicant selected. A security prescreen will be conducted. The applicant tentatively selected for this position may be required to submit to urinalysis to screen for illegal drug use prior to appointment. After appointment, the employee will be included in the agency's random drug testing program. Applications will be accepted from all qualified persons. Consideration will be extended without discrimination for any non-merit reasons such as race, color, religion, gender, national origin, political affiliation, marital status, age, membership or nonmembership in employee organizations, or nondisqualifying physical handicap. Selective factors: Experience operating a personal computer and using word processing software; experience in locating and assembling information for reports, briefings, or meetings. Quality ranking factors: Ability to organize, follow procedures, prioritize tasks and complete deadlines; knowledge of grammar, punctuation, and spelling; ability to communicate effectively both orally and in writing; ability to achieve cooperative working relationships with all levels of staff. Important additional information: If you want to show us what you can do please send the URL to your Web home page in the subject line of an e-mail message to interns(a)ostp.eop.gov. Do not put any other information in the subject line, just http://your.own.address. No phone calls or faxes please. Be creative with your home page. You are not required to list telephone numbers or other information you would not want to be publicly accessible. Good luck!

1 0

Digital Cash
by Black Unicorn 17 Dec '03

17 Dec '03

So has anyone tried to solve the problem of double spending and the online requirement of digital cash? It seems digitial cash is really only digital "check" right now as it must be verified at the bank before it can be show to be "valid." Is there any way to take cash offline? Or is this merely the copy protection problem rehashed? -uni- (Dark)

5 4

Re: WSJ article on PGP
by lcottrell＠popmail.ucsd.edu 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- I must say: I was somewhat stunned to see my name in the WSJ. I guess P.Z. has made use of the information he gathered. I wonder if the people mentioned were all the people who responded to Zimmerman's request for legitimate PGP users. -----BEGIN PGP SIGNATURE----- Version: 2.3a iQCVAgUBLcYFxVVkk3dax7hlAQFp0wP+I2TloCk72yqO/hdrwZLv3DDpYlxWN2eY Q8Hea6YTwBSo5lTtZ3Jc/M6wRmOGIispftvaq3wdlnfm1Ul3yBBg1eIe5zkFNtm+ bi0oCIOkJkcCjsvsMttvXX4olF5jhV5JIfO7DYuNN7XfzWKPocr15WjrByqbF5fp fZs1LFHVKGE= =gcc0 -----END PGP SIGNATURE----- -------------------------------------------------- Lance Cottrell who does not speak for CASS/UCSD loki(a)nately.ucsd.edu PGP 2.3 key available by finger or server. "Love is a snowmobile racing across the tundra. Suddenly it flips over, pinning you underneath. At night the ice weasels come." --Nietzsche

3 2

Attn DCF: Tacky Tokens for your protocol
by Mike Ingle 17 Dec '03

17 Dec '03

frissell(a)panix.com (Duncan Frissell) wrote: >In any case, I have developed a protocol that would allow the sale of >contraband with almost no risk to the seller and reduced risk to the >buyer. It's based on modern drop shipping techniques. I intend to >publish same when/if tobacco is criminalized. Let's get some net.commerce going. I'll pay you ten Tacky Tokens for a copy of this protocol. --- Mike

1 0