December 2003 - cypherpunks-legacy

Headline News
by jim＠bilbo 17 Dec '03

17 Dec '03

At around 9:45 AM Central DST, Headline News displayed the following "Factoid": [from memory] ------------- Two-thirds of US residents say cell phone privacy is more important than police ability to wiretap phones. source - Yankelovich Partners ------------- Jim_Miller(a)suite.com

1 0

Re: VISA Electronic Purse
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>At *Visa* International, the answer is: Replace cash with plastic. > > Last month, the giant association of card issuers announced >it had formed a coalition of banking and technology companies to >develop technical standards for a product it dubbed the >"Electronic Purse," a plastic card meant to replace coins and bills >in small transactions. Gosh, how many Real Men are going to carry an electronic "purse?"

2 1

nsa digital cash?
by tmp＠netcom.com 17 Dec '03

17 Dec '03

ok, so the nsa looked at commercial cryptography and said, `we need to control it'. and out pops clipper (quite an ugly baby, eh?) this makes me wonder. i bet that they see that announcement by visa for `digital cash' and go crazy. they are already thinking of how to put clipper into a nationwide digital cash system, don't you think? this brings up some serious issues. i doubt it will be long before there are some official government agencies developing the official u.s. digital cash system. in fact, it wouldn't surprise me if there are divisions in the nsa dedicated to doing it *this moment*. if there are any non-nsa agencies, too, the nsa will probably `pull an nist' and dominate their development. how? send in a few austere-looking spooks and speak in phrases like `imperative to national security' and `presidential directive' and *boom* the flimsy bureacrats are putty in their hands. so would anyone like to wager? i'd say that we have an official government group dedicated to digital cash standards in say, 4 years, with an official agency in say, 7 years. cpunks, are you going to be ready by then with your own cash? <g> btw, could someone tell me how the proposed visa cash system is different than debit cards (which exists today)?

4 10

Re: Sen. Kennedy Uses Code to Disguise Personal Data!
by cfrye＠ciis.mitre.org 17 Dec '03

17 Dec '03

>So, just how is this to be taken? Just as a bit of humor, not meant to be taken seriously. I left out the smilies where I guess I shouldn't have :-). -- Best regards, Curtis D. Frye - Job Search Underway!!! cfrye(a)ciis.mitre.org or cfrye(a)mason1.gmu.edu "Here today, gone ?????"

1 0

CRYPT
by Ryan Snyder--Consultant 17 Dec '03

17 Dec '03

I am trying to crack a textfile which has been encrypted with a program (for the IBM) called CRYPT. Can anyone help me with a method, a program which will break it, or a pointer to more information on how I might go about it? Thanks in advance. Ryan Snyder, Consultant | --->Finger me for my PGP public key.<--- ___ University of Montana CIS| |\ /| CS000RRS(a)SELWAY.UMT.EDU | Copyright 1994 by Ryan R. Snyder. | 0 | RYE(a)ILLUMINATI.IO.COM | |/_\| RYE(a)CYBERSPACE.ORG |

3 2

Re: CYPHERPUNK CRIMINAL shirts (?)
by cfrye＠mason1.gmu.edu 17 Dec '03

17 Dec '03

Phillipe- Yep - I received my order last week. The shirts look great, though I would have made the "Safety in large numbers" banner bigger.

1 0

Re: The AntiCash -- was: Electronic Purse Press Release
by nobody＠soda.berkeley.edu 17 Dec '03

17 Dec '03

Will I be able to buy these cards with (real, physical) cash at local stores? Will I be able to swap them with strangers?

2 1

No Subject
by nobody＠shell.portal.com 17 Dec '03

17 Dec '03

Since people are talking about new remailer features, can I suggest another one - how about single-use (or limited use) anonymous return addressess (ARAs) ? There are quite a few situations I can envisage where I might want to give an anonymous return address to someone that could only be used a limited number of times, or for a limited period of time (e.g. in the medium term, buying something over the network from a company with digicash, but not wanting to receive junk mail from them afterwards). How I'd see it working is this : You'd send a message to a remailer requesting an anonymous address token, along with the email address to send to, the number of uses you want and the time period (perhaps up to some maximum set by the operator of the remailer). In the future, you'd also send some digicash in payment for the token, the value based on the number of uses and time limit. The remailer would then create an encrypted token containing an id number and the address, either signed or with an attached random number. The id, number of uses and expiry date would be stored in a database, along with the random number if you were using that for authentication. The remailer would then mail the token (probably using an anonymous return address) to the requester. The database shouldn't need to be very large if only details of the outstanding tokens are stored. BEGIN NOTES I'm not sure whether it would be better to store the address in the token or in the database, but I suspect that storing it in the token is better since it avoids the possibility of anyone getting hold of a copy of the database and reading all the addresses stored in there. However, if it's in the token then if all keys of all remailers used are compromised, you can follow the entire chain even after the token is used up, whereas if it was deleted from the database the chain would be broken forever. Perhaps a mixture of mechanisms in the remailers would be best. Another option might be to keep the address completely seperate, so the token would merely indicate whether the message should be sent to the address specified in the ARA, not for a specific address that the token was requested for. END NOTES After the ARA had been sent to someone and they used it to reply to the sender, the remailer would recognize the token, and decrypt it to get the real address, database id and authentication. If the authentication was valid and the time/usage limit not exceeded, then it would forward the message to the email address enclosed (which presumably could be another ARA), otherwise it would just ignore the message. Obviously using only a single remailer would require you to trust the operator to limit usage correctly, however chaining several limited use addresses will solve any problems if one remailer is trustworthy. Example: Message to remailer might be something like (comments in {}, -- shows begining and end of messages) : -- Request-Token 5 {uses} 14 {days} ARA {or email address} { standard PGP-encrypted ARA goes in here } Request-Token-End :: Request-Remailing-To: remail(a)foo.com {ARA to send token to via remail(a)foo.com goes here} -- The remailer would create something like : -- Limited-Use-Token: 00000001/F4870921 (ID/random authentication) {ARA or Request-Remailing-To: goes here} -- This would then be encrypted with the remailer's public key, attached to the end of the original message (after the Request-Token line was stripped off), then fed into the remailer as usual. The sender would create the ARA using this token, and forward it to whoever they wanted to communicate with. When a message using the ARA came back, it would be decrypted as usual, and if the token line was valid the database would be checked for timed expiry, updated to indicate another use, then if valid, after the token line was stripped off the message would be remailed as usual. If noone else does this in the next few months then I may hack it into a remailer once I have my own machine to run one off.

2 1

Re: VISA Electronic Purse
by pcw＠access.digex.net 17 Dec '03

17 Dec '03

>>Gosh, how many Real Men are going to carry an electronic "purse?" > >Probably the same number of Real Women that are going to carry an >electronic "wallet". > >Eric Most women I know carry a "wallet" in their "purse".

1 0

re: CRYPT
by werner＠mc.ab.com 17 Dec '03

17 Dec '03

>Date: Tue, 5 Apr 1994 13:25:38 -0600 (MDT) >From: Ryan Snyder--Consultant <cs000rrs(a)selway.umt.edu> >I am trying to crack a textfile which has been encrypted with a program >(for the IBM) called CRYPT. Can anyone help me with a method, a program >which will break it, or a pointer to more information on how I might go >about it? Thanks in advance. This reminds me of cwb, I think, or else it's cbw (stands for codebreaker's workbench), that is supposedly a tool for breking crypt-ed text. I tried to make this tool work a couple of times, and never got it working. One fellow I corresponded with said it worked for him right out of the box. I eventually decided that it didn't work for me at least partly because it was too dependent on the vt220 display. I never actually ran it on a vt220. Did anyone ever do any work to improve cbw (or cwb)? Everyone is always saying what a joke crypt is, but I've never been able to crack it with anything I got on the net. What do people really use to break (BSD) crypted text? tw

2 1