December 2003 - cypherpunks-legacy

Creating privacy crises: Society hacking
by cactus＠bb.com 17 Dec '03

17 Dec '03

In the composition of my last message, I was thinking in the back of my mind about how we could foment an information privacy crisis. This could very well be a Good Thing, a societal hack to serve as a wake- up call. At the HOPE conference, there was someone selling CD-ROMs of the DMV records for Oregon for $125. The same folks promise to add more states soon: next in line is Texas. Perhaps one could generate a privacy crisis by collecting that information and conducting a mass mailing to every person in the database: "we have this information on you. So could anybody with $125. Call your congress critter and complain." Some people don't consider their DMV records critical -- so perhaps a mailing from a company of their credit history would open their eyes (More effort than the $125 + postage, but probably a better yield). It's just a thought and it would require some amount of time & money, but it's a doable hack with finite resources. Thoughts? Is this totally off the wall, or do y'all think that somebody with a small but not tiny amount of money would be into doing this? -- L. Todd Masco | "Large prime numbers imply arrest." - Previously meaningless cactus(a)bb.com | grammatically correct sentence. Now...

5 5

THE H.E.A.T. IS ON
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . C'punks, I'm so happy. I've found Acapulco H.E.A.T. in the New York area (18:00 Saturdays, channel 9). Time for another review. This week's episode, "Code Name: Archangel," had a couple of relevant privacy items, and it was a "no Fabio" zone, as well. Bikinis and gun battles were at a minimum, but those that were, were equally divided between the sexes. Anyway, a neo-Nazi (with a really baaad German accent) named "Steinholtz" planned to steal one of the da Vinci "archangel" panels which was being exhibited in Mexico. It was to be reunited in Germany with the three other panels. The idea was that this would be a symbol for the reunification of all the neo-Nazis, and would inaugurate the beginning of the Fourth Reich. A clandestine, world-wide, TV broadcast of the stolen panel would be used to unify the Nazis. There were also two subplots: one involving a Dutch Mata Hari type, and the other involving two of the H.E.A.T. members. ("Hey Tommy, I don' wan' jew dating my seester.") Anyway, since the bad guys use "antibugging devices," our heroes had to use hand-held through-the-wall mikes to listen in on their plans. Later, they were able to install a "sprinkler cam" right over the swastika covered table around which the plotters sat. (Curiously, the swastika they showed was a left-handed version of the actual Nazi one. No explanation given.) Our guys also had to scope out the church where the panel was being exhibited. There they found infrared heat/motion detectors which they foiled by wearing (heat conserving) wet suits. Hmmm. The panel was also protected by pressure sensitive mats and electronic eyes, but no guards! The last bit of technological chicanery came after the bad guys were captured. Using digital technology, the team spoofed the voice of Steinholtz and had him saying we should all live as brothers. Does was done as a voice-over to scenes from the Mexican festival of Santa Guadeloupe or some such. Gag. S a n d y PS The Stateside boss of H.E.A.T. is played by John Vernon who was "Dean Wormer" in Animal House. He only communicates with the team via encrypted videophone. It's obvious (due to some differences in dialog, pronunciation, etc.) that his scenes are not filmed at the same time or place as the rest of the show. In one episode, he kept referring to "M15" ("em fifteen") while the team talked about "MI5" ("em eye five"). ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

1 0

Achieving Privacy while Enabling Marketing
by Jason W Solinsky 17 Dec '03

17 Dec '03

[I sent a variant of this to several lists earlier this year. It was originally a response to a post on online-news asking what the future of advertising will be like. It suggests a system whereby marketers only get the information that they absolutely need and pay for what they get.] [The software is being debuged and will be ready "soon". I had thought I would be alpha testing it already, but its going to take me atleast another two weeks and quite possibly much more. I'm working on it :( ] Well here is my view of advertising, supported by a product that I will be indroducing latter this year: In the NEAR future, content in the new media will be nearly entirely divorced from advertising. Online media, be they magazines, interactive games, fiction, discussion groups, or simple news, will be paid for at full cost by the consumer. At the most, some of this content will contain hints about where advertisements should go and keywords suggesting types of advertisements which are particularly apt. [herein, when I say browser, I mean the instrument by which the user examines the content] The browsers that the reader/viewer uses to read/view/listen to the medium will pay the cost of the content from the user's electronic account almost transparently. The browser will then schedule advertisements to pay for the cost of the content. The browser has precisely one valuable resource, the attention span of its user. Periodically [the frequency is established by preferences that the user can set] the browser will conduct an auction. All the agents that are interested in taking up some of the user's time [either to deliver an advertisement or ask a question] submit a "profile" to a third party that is mutually trusted by the advertisers and the browser. The user also submits a profile. The agent's profiles contain two things: A) a routines which, given the characteristics of the user, returns a price that the advertiser is willing to pay for the user's time. B) the set of conditions which the advertiser is willing to agree to, and how much less it is willing to pay if it has to agree to those conditions. For example, suppose the user is a citizen of a cyberspatial government that prohibits fraud. If it is a popular government, the agent will have done one of two things: 1) It will have been pre-approved by the cyberspatial government's censors [who analyzed it to make sure that it wouldn't confuse the netizens who support that government] for either a one-time fee or a per use fee or both. 2) Its owner will have given the government a deposit from which to subtract fines (using a protocol that supports the use of a third party adjudicator). After doing this the agent will have received a certificate [probably one that requires a time sensitive number from the government to demonstrate its validity. There are many protocols for doing this. This allows the government to collect its "per use fees". Now acquiring this certification has cost the advertiser money, so the profile includes information on how much less the advertiser is willing to pay if the user requires agreement to the anti-fraud laws of the government in question. The user's profile will contain: A) the answers to the questions that have been asked of it. These are completelly uncertified. B) certified characteristics. These may simply be answers which have been certified by third parties as time invariant [make sure that the user doesn't change his answers all of the time] or they may be certifications by vendors that the user spends X dollars on product Y each year, or they may be certifications by a third party that the user has bought a gift certificate for a class of goods. [For example, certification that a user has bought a $100 gift certificate for any truck in class X for Y dollars, something that certainly is worth something to truck advertisers.] All users will also have several certified characteristics describing how frequently they look at advertisements. Most of these certificates also require a fee for verification. So the user will not be able to demonstrate the certificates without first paying the certificate issuers a small fee. [Presumably, in order to fight the false issuance of certificates there will be anti-fraud agencies which in turn also ceritify the parties issuing the certificates.] C) The user's preferences. Users may require more money for femenine hygene commercials than for beer advertisements. Users may also pay extra for advertisements that promise to be entertaining. This promise would be backed up by an agreement that requires less entertaining advertisements to pay a penalty while more entertaining advertisements get a discount. After these commercials the user would rate them. The algorithm used to determine who gets what would keep the amount that the user pays constant. Presumably the algorithm would be tweaked so that non-commercial entertainment could be sold through the same medium. Jokes could show up and promise to be funny [there could even be certification agencies to verify this [the comedian's guild]]. The user would then rate the jokes and sufficiently funny jokes could make money. [Presumably jokes certified by highly acclaimed comic certification agencies would only show themselves if the user were giving them a price at which they could make money]. The governments to which the users belong would also be in this part. For each law that is important to the user, there would be an additional amount of money that the user is willing to pay for advertisements that comply with that law ranging from zero to infinity. Children's restrictions also belong here. The user could be subscribed to a law which gives a near infinite credit to those advertisers that can verify that they are suitable for children. Finally, users [and advertisers but I forgot to mention this earlier] could pay extra for advertisements that are in context. If the user was reading content about X and there is an advertisement related to X, the user or advertiser could be willing to pay extra to get an advertisement that is relevant to the current content. The third party puts all this information together and for each advertiser determines how much he is willing to pay. Then, it modifies the amounts the advertisers are willing to pay by the credits that the user offers. Finally these amounts are normalized by the resources that they require. 30 second commercials need twice as high an amount as 15 second commercials and many times more than visual pop-up and streamer commercials. The highest amount wins... but the highest amount pays what it was willing to (i.e. the credits that the user offers are just for determining who wins, not how much they pay. Depending on the content they watch, the cost of their net services, and their advertising preferences, some people will make money just by reading or viewing the screen while others will have to pay. The question of guaranteeing advertising time has come up. The way this will be taken care of is by establishing attention futures markets. Agents will be able to purchase futures on somebody's attention. So if coke wants its new advertising campaign to role out to X% of the population at the same time, it can buy futures. The futures will give coke the right to show its commercial to a certain person at some point in time between two times. If the commercial can't be shown, a penalty of Y cents will be paid to coke by the issuer of the future. The futures would be traded my arbitrage agents that think they can model the user's advertisement viewing patterns and by the browser which has an advantage as an insider. Cheers, JWS

2 1

Re: Voluntary Governments? (Sort of)
by blancw＠pylon.com 17 Dec '03

17 Dec '03

>From Jason W Solinsky: Are: "They [the malls] can take away your personal property by force and they are not governments?. . . . " Is Not: ". . . . . this is the first I've heard of defining government by the force it weilds." ............................................................. Definitions, definitions. Governments are defined according to some unknown determining factor, but force is recognizable immediately upon being threatened by it. Fighting fire with fire can be confusing, trying to decide what difference it makes when it all looks the same. Blanc

2 1

Snore...Re: e$: buyinfo, internet commerce, and GMU
by Pat Farrell 17 Dec '03

17 Dec '03

Longtime c'punks push D now... Just in case we have a zillion newbies, which I doubt, but judging from the email I've gotten on the PJD piece, I can't tell... I'm at GMU, as are Peter J Denning, the SO of Dorothy Denning, and lots of other folks who agree or disagree with c'punks, including the department of PSOL which is a spinnoff of the Econ department (which hard-core pro-market), Brad Cox of Objective C and superdistribution fame, etc. Peter was my MS/CS advisor, and may still be my PhD commitee chair. Please at least look at the .sig. tcmay(a)netcom.com (Timothy C. May) writes: >> There are some people from GMU (Program on Social and Organizational >> Learning") talking [stuff elided] > Brad Cox at GMU is one of the "superdistribution" advocates. In > addition to his article in the latest "Wired," he's had pieces in > "Byte" and elsewhere. The GMU econ/PSOL folks were heavily into AMIX, which was a commercial faliure. Cox is getting a lot of press and is positioning his team to get some serious NIS&T money. There are serious privacy problems with Cox's superdistribution. There may be solutions, but so far, nothing that I've seen mitigates the 1984 aspects of Cox's ideas. I agree with Tim's comments on the snore factor of IMP-interest. Those folks couldn't get past credit, let alone get into untracable digital cash. If you take the time to read the PJD post that I sent out, even non-c'punks see digital cash, credentials without identity, and other technological ideas as both good and inevitable. Of course, six months ago, it looked like eric and sandy were starting the first intergalictic bank of e$. I was ready to sign up and deposit real money so I could join Tim in the Caribbean RSN. > I'm gonna miss these parties when I move to the Caribbean!) Gee, I thought you got 180 days in country once you are an official Ex-patriot. That is a lot of partying... Yo Tim, where is the F-ing FAQ so the newbies can have a clue? Pat Pat Farrell Grad Student pfarrell(a)cs.gmu.edu Department of Computer Science George Mason University, Fairfax, VA Public key availble via finger #include <standard.disclaimer>

3 2

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 11:36 PM 8/21/94 -0400, Jason W Solinsky wrote: >> Of >> course, the issuer could publish the prices based on the compounded >> interest accrued *for each certificate*, for the time period it's >> outstanding, possibly complete with the compounding factors for each >> compounding period used. (a day, a month, a year, or even continuous over >> the life of the instrument) Lot of overhead there, but mutual funds do it >> all the time. You'd want to just take their word for it, I suppose, and >> trust their price, right? > >OK, I see the problem. You are assuming that certificates will be issued >at a consistent set of notional values. (like ten bucks, five bucks ect.) >The correct way to do things [:-] is to set the notional value of new >certificates based on the trading value of old certificates. Suppose the >first certificate had a principal of $10 and is now worth $11, then the >new certificates that I issue will have their principal adjusted so that >including the effect of interest rates, my new certificate is worth as much >as your old certificate. Thus, there is only ONE value that needs to be >published at any given time. Open-end mutual funds do this now, every share is issued at a the price of a dollar. The problem comes when the value of the suspension pool (it's starting like water treatment plant) backing up that certificate increases. A digital cash operation is another open-ended mutual fund. If you don't price it in terms of something real, like a dollar, not in terms of itself, then you introduce an unnecessary level of complexity, not to mention regulatory gobbledegook, because that really is a scrip mechanism. I just think that it's easier all around to keep a constant notional value (a buck is a buck is a buck). Then to mess with a fluid pricing mechanism for something which is supposed to enhance convenience and liquidity in internet commerce. Let banks and governments worry about the relative prices between their currencies, and let that price be the price of e-cash for now. An e-cash issuer has to worry about his competition and the price of their cash. That's bad enough. Occam's razor, KISS principle, and all that. In theory, though it probably won't happen, an underwriter could issue a greater amount of digital cash than regular cash paid for it (e$1.00 for $0.95, for the sake of argument). The cash flow from the interest on the suspension account (due to long cash lifetimes on the net, for example) would be paying for operations, and profits, and a competitive market forces the underwriter to sell at a slight discount. See? This is exactly the way you price bonds. The case of zero interest digital cash is exactly like that of a zero-coupon bond. The ecash is then spent one or more times on the net at its "par" or face amount, and then the underwriter makes money or eats the difference when it is redeemed. > >Seting prices based on convenience instead of value derived? *BLECH*. That >sort of thing is anathema to free markets. There's probably the hoariest old saw in economics which says "The cost of anything is the foregone alternative." Convience *is* value derived. Market liquidity is convience (more like necessity, actually, certainly not anathema, but who's quibbling). Market liquidity is value derived. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

2 1

Future NSA spy machine
by John Young 17 Dec '03

17 Dec '03

Responding to msg by ianf(a)simple.sydney.sgi.com ("Ian Farquhar") on Mon, 22 Aug 9:38 AM >You're talking about silicon fab lines here, Tim. As >far as I am aware, Cray has never fab it's own chips. >Indeed, most of their boards which I have seen (I, II, >Y-MP/8 and Y-MP/EL) have used chips sourced from fairly >well- known vendors, such as VLSI Technologies. > >The original series of systems (I, II and X-MP) >actually used huge numbers of three types of chips. >From memory, one was a couple of NAND gates, one was a >register chip, and the third was a couple of K of SRAM. > More recently, the full Y-MP's have been implemented >in commercial ECL gate arrays (6500 gates per chip for >the full Y-MP's), and the original EL used CMOS 100K >arrays. I have been trying to get one of the computing >industries choicest pieces of marketting junk: the >Cray Y-MP Gate Array paperweight. :) Of course, given >my recent career change, I don't think one will be >coming my way anytime soon for some strange >reason.... Ian, Not asking for state or trade "secrets" but: 1. Is MIPS new "supercomputer" R8000 in the running as array elements for super-supercomputers? 2. Who is in the offing to succeed Cray and others as NSA's grateful suppliers? 3. Will there be more on-base hardware and software production, a "circling of the wagons" as crypto becomes more public? 4. And, thus, an even sharper (and more secret and competitive) line between governmental and commercial crypto hardware and code? 5. Who is NSA (or other TLAs) underwriting as lesser known SRCs, not-for- or for-profit? This is an update on where the jobs are for the "finest mathematicians" other than TLAs. 6. Is NSA (like CIA and NRO) bifurcating into an even more super-supersecret arm and another friendly, public one in response to wider use of crypto and ostensible pressure from the likes of Senators Moynihan and Kerrey? (And the recent RSA to-dos, murder threat, PKP lawsuit, are ploys.) FYI, zero, hopefully minus, security clearance here. Cheers, John

1 0

Notary signing
by nelson＠crynwr.com 17 Dec '03

17 Dec '03

Does anyone know of any legal problems with a party asserting that they have a notarized photocopy of certain id, representing that a third party is who they say they are? If I take someone's money, get a notarized copy of their id, and sign their PGP key, can I be sued? Obviously, I don't trust any non-lawyers to answer this question, but does anyone know of an encryption-aware lawyer to whom I could pay money for an opinion? -russ <nelson(a)crynwr.com> http://www.crynwr.com/crynwr/nelson.html Crynwr Software | Crynwr Software sells packet driver support | ask4 PGP key 11 Grant St. | +1 315 268 1925 (9201 FAX) | What is thee doing about it? Potsdam, NY 13676 | LPF member - ask me about the harm software patents do.

1 0

Re: In Search of Genuine DigiCash
by rah＠shipwright.com 17 Dec '03

17 Dec '03

At 2:24 PM 8/21/94 -0700, Hal wrote: >Well, I still don't follow this analogy. By this reasoning virtually every >commodity that someone is willing to buy and sell is a callable bond. The >local gold dealer may sell me gold coins for cash, take the cash, put it in >the bank and collect interest, then buy my coins back from me later. Is the >gold a bond? Am I "calling in my bond" when I sell the gold to him? I don't >get it. OK. I'll try again. The difference between digital cash and your examples of gold and cash is that that gold really *is* a commodity. It can be melted down, and recombined with other gold into any unit of measure you want, as long as the purity of the metal is the same, and that's a scientifically verifiable process. An ounce of gold is utterly indistinguishable from another ounce of gold. In the case of cash, there's a certificate number on each one, issued by the issuer. Thus it has a set of specifically identifiable future cashflows associated with it. Since it is directly related to a "risk-free" security (the US dollar) and it is collateralized with a pool of money which accretes interest, it acts just like a bond. If it walks like a bond, and quacks like a bond, it's a bond, yes? Anyone can dig up more gold but when it's melted with other gold, who's to tell which one's the gold they dug up? Only the issuer can issue an issuer's certificates, be they cash (in the old banknote days), bonds, stock, whatever. A bond is a unique discrete entity. More to the point, it's a promise to pay a specific cash amount at some specified time, or upon redemption by the purchaser. So is digital cash. Gold, on the other hand, is a continuous commodity. Different stuff. Probably not much help, but I'm trying here. I really am. Is that any better? By the way, "calling the bond" is actually exercising an option, and yes, the finance guys will tell you that there is no difference. You can use option pricing methods to price lots of stuff, and some people do it with commodities. Remember my goofy (but true) statement that a bond is really a string of embedded call options? It's in the book I referred to (Fabozzi, Fixed Income Mathematics, Probus Press, 1993, isbn 1-55738-423-1, pp 249-315). >Let's see, I'm selling spindles for $2.59 and you come up with a piece of >ecash you bought ten years ago for $1.00, which is now worth $2.59, and I >sell my spindle to you for it. I deposit the cash in the bank and it's worth >$2.59. Now who isn't this fair to? How is it different from you putting >$1.00 into your interest-bearing checking account ten years ago and writing >me a check for $2.59 today, the amount your $1.00 grew to? The problem is, you have to price the cash before you use it to buy something, and then you and the seller has to agree that that's the value of it. To do that, you or the person you're offering the cash to need to somehow communicate with the underwriter, thus destroying the anonymity of the cash transaction, and also increasing it by the communication costs, and creating an on-line cash system when we wanted an off-line one. Of course, the issuer could publish the prices based on the compounded interest accrued *for each certificate*, for the time period it's outstanding, possibly complete with the compounding factors for each compounding period used. (a day, a month, a year, or even continuous over the life of the instrument) Lot of overhead there, but mutual funds do it all the time. You'd want to just take their word for it, I suppose, and trust their price, right? Mutual funds are priced in exactly this way. A mutual fund share has a specific value at purchase. It is specifically identified and compounded over the time it is held, in theory, anyway, because there are accounting and programming tricks to get the same result with less overhead and still maintain the audit trail. Those values are computed and accumulated as if they were on an individual share basis. Really. I swear. I've priced mutual funds and their returns and used them to compile data used in portfolio managers' performance evaluations. I didn't say that that you couldn't do it your way. I just said it costs more than just dumping the certificate numbers into a redemption database, keeping the interest, and pricing the e-cash at issuance to reflect your costs of operation and your competitive pressures from the marketplace. > >Sorry, I guess I'm missing a lot of your points. I'm also sorry. I'm doing the best I can here. I hope I took a better shot at it this time. > >Hal There's nothing awful about keeping the interest, folks. (Unless you're a moslem, of course :-) ) It's really just a type of liquidity premium paid to the underwriter to offset whatever risk (business risk, and legal risk at this point) taken to issue e$ for use in internet commerce. As more people get into internet commerce and underwriting it, then the premium goes down because the risk goes down. I think this whole discussion about where the money gets made is beside the point. The fact is that some combination of exchange fees and interest on the "suspension" account balance will offset the costs of underwriting ecash. People can make money underwriting e-cash. If the market's there, anyway... ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

3 2

Snore while they snoop
by John Young 17 Dec '03

17 Dec '03

Responding to msg by solman(a)MIT.EDU (Jason W Solinsky) on Mon, 22 Aug 1:42 AM Tim says: >> nothing that I've >> seen mitigates the 1984 aspects of Cox's ideas. You say: >I'm afraid I'm not familiar with the aspects of which >you speak. Has he proposed some sort of nightmarish >enforcement system? NY Times wrote yesterday on "metering" of software usage by soft and hard means. This type of monitoring could easily, Clipperly, "1984"-ishly, record and report on other activities of the user. Recall alarms here recently about covert features of operating systems. Harmless looking hard devices may hide even more monitoring features, steganographically (my bag). John

1 0