December 2003 - cypherpunks-legacy

re: Intolerance on the list (was Re: Sgt Russell)
by SGT=DARREN=S.=HARLOW%ISB%MCTSSA＠nwsfallbrook3.nwac.sea06.navy.mil 17 Dec '03

17 Dec '03

Forwarded to: inet[cypherpunks%toad.com(a)pucc.princeton.edu] cc: Comments by: SGT DARREN S. HARLOW@ISB@MCTSSA -------------------------- [Original Message] ------------------------- Russell, I appreciate your letter to me. My political views are very conservative. I know that this puts off a number of people, but we are each entitled to our own opinion. I feel that we do need a government in power, but that they have a limited role in our society. If we didn't have at some ruling power in control, the country would be in total anarchy and we would be taken over by some intolerate country. The beauty of our system of government protects our rights. We need a military to protect everyone's ass in this country. I feel that the government infringes to much on other peoples rights in this country as it is, especially with the current president. At least with a conservative government in control, they want to keep the money and the power in the hands of the people. The use of cryptography within our system, IMHO, is to allow us a right to privacy. Personally I feel that the Clipper chip, is a severe infringement upon our rights, and I do NOT support its use. Notice that I use PGP and not PEM or DES. If someone is smart enough to use RSA, then they deserve to be able to talk in privacy. I know that it can be used for alterior motives, but that is the risk with any tool that is available for use. I hope this helps to explain my opinions a bit better. I welcome you comments. BTW, where are those political pieces that people have written. I would like to look at them, to further educate myself. Sgt Darren Harlow - Computer Security MCTSSA, Camp Pendleton, USMC Internet: harlow%isb%mctssa(a)nwsfallbrook3.nwac.sea06.navy.mil or another less reliable & slower: harlow(a)mqg1.usmc.mil Voice: Comm: (619) 725-2970 DSN (Autovon): 365-2970 Fax: Comm: (619) 725-9512 DSN (Autovon): 365-9512 PGP Public key available upon request "The views expressed are my own, and always will be..."

1 0

Re: Press Release on Secure NCSA Mosiac
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

> This secure version of NCSA Mosaic allows users to affix digital signatures > which cannot be repudiated and time stamps to contracts so that they become > legally binding and auditable. In addition, sensitive information such as > credit card numbers and bid amounts can be securely exchanged under > encryption. Together, these capabilities provide the foundation for a broad > range of financial services, including the network equivalents of credit and > debit cards, letters of credit and checks. I doubt that these electronic financial instruments will be designed to offer new protections to individual privacy. As more commerce moves onto the net, opportunities for database linking will multiply drastically. In such an environment, electronic dossiers of buying and spending habits will be far easier to develop. > To effectively employ public-key cryptography, an infrastructure must be > created to certify and standardize the usage of public key certificates. > CommerceNet will certify public keys on behalf of member companies, and will > also authorize third parties such as banks, public agencies and industry > consortia to issue keys. So once again we have the command-and-control style key certificate hierarchy. Everyone is neatly ordered and positioned in the structure. A place for everyone and everyone in his place. > Such keys will often serve as credentials, for > example, identifying someone as a customer of a bank, with a guaranteed > credit line. I suppose it goes without saying that the kinds of privacy-protecting credentials we have been discussing are not what is being discussed here. Rather, we have more authentication, more registration, more tracking of every electronic financial move we make. > Significantly, all of the transactions involved in doing routine purchases > from a catalog can be accomplished without requiring buyers to obtain public > keys. Using only the server's public key, the buyer can authenticate the > identity of the seller, and transmit credit card information securely by > encrypting it under the seller's public key. Because there are fewer servers > than clients, public key administration issues are greatly simplified. Evidently the "commerce" that is being planned here does not anticipate much demand for encryption of messages from sellers to buyers; rather, the important thing is encryption in the opposite direction to protect those credit card numbers. This also, of course, limits RSA's financial commitment in making its technology available; my reading is that end-users get only the ability to validate signatures for free, and that getting to use their own keys will involve royalty payments. > Secure-HTTP enables incorporation of a variety of cryptographic standards, > including, but not limited to, RSA's PKCS-7, and Internet Privacy Enhanced > Mail (PEM), and supports maximal interoperation between clients and servers > using different cryptographic algorithms. I was pleased to see that in their later message they added support for PGP to this list, although it seems that they are still thinking mostly in terms of "officially sanctioned" systems: > Cryptosystem and signature system > interoperation is particularly useful between U.S. residents and non-U.S. > residents, where the non-U.S. residents may have to use weaker 40-bit keys in > conjunction with RSA's RC2 and RC4 variable keysize ciphers. This is outrageous! Where on earth did they get the idea that non-U.S. residents have access only to 40 bit keys and RC2/RC4? As though the only encryption the rest of the world has is whatever the U.S. government deigns to let cross its borders? What an insult to the rest of the world. And what an attempt at self-deception to pretend that these export controls are effective. I sincerely doubt that the international network community will accept such a limitation in what claims to be an international standard. The one good thing that may come from this initiative is that more people will be using and relying on encryption. Given the widespread skepticism about the government in this country, it will be that much harder to get a Clipper-like program into place. But the initiative does clearly show the pernicious effects of the combined restrictions of the RSA patents and the NSA export controls. Together [RN]SA provides a structured, ordered system which provides the minimal possible privacy necessary for electronic commerce. Far more is possible, but is un- likely under the current legal regime. Hal

1 0

CRYPTO: Money laundering and traceability
by hfinney＠shell.portal.com 17 Dec '03

17 Dec '03

(In honor of the Extropians list discussion elsewhere in this thread I include an Extropians-style message prefix.) An issue related to money laundering is money traceability. I posted something on this a couple of weeks ago but I have a little more information now. We are inclined to believe that with cryptographically anonymous digital cash, "money laundering" will be trivial. A simply sends the cash to B, and there is no way for the bank or anyone else to link the two together. While this is basically true with existing digital cash proposals, there is one kind of linkage that is possible. A knows and can recognize the cash which B holds. A and the bank could cooperate so that if B goes to the bank to deposit his cash (or deposits it electronically into an account linked to his True Name), B's anonymity can be broken. This has good aspects and bad aspects. On the good side, it should make robbery and extortion harder. If you are forced at gunpoint to enter your PIN into your cash smartcard, transferring cash to the robber's "electronic purse" (love that name), then later you can call the bank and report the numbers of the stolen cash. When the robber tries to deposit it, he can be caught. Similarly, this could be a boon to law enforcement "sting" operations. When the feds pay off the anonymous assassin-for-hire or kidnapper, and he goes to deposit the cash, again he can be caught. The other side of the coin, though, is that despotic governments can use these tools to control and restrict what their people can do. If the revolutionaries try to use cryptography to isolate and protect each cell from the others, traceable cryptocash may expose them. Keith Henson posted the start of an interesting story he was writing last year, about some eco-activists using cryptography for protection as they worked to sabotage some polluter. This kind of dramatic scenario might become less possible with traceable cash. (It's possible that some banks would allow truly anonymous accounts, so that even if the cash were recognized as it was turned in, the robber would not be caught. Still, the bank could refuse to honor the money in this case, preventing the criminal from profiting by his misdeeds.) The new information I mentioned comes from a paper by David Chaum in the Eurocrypt 92 proceedings: "Transferred Cash Grows in Size," by Chaum and Torben Pryds Pederson. Chaum considers off-line cash systems where the money does not necessarily have to be returned to the bank after each transaction. His main conclusion is, as the title suggests, that the cash must grow in size at each step. But a secondary conclusion is that under the right circumstances a payor can always recognize his cash at a later point, even after it has passed through many hands. Chaum describes these circumstances as the case where the payor has infinite computing power, but it appears that the same effect would be possible if the bank cooperated with the payor, as would be likely in the kinds of cases I mentioned earlier. The fundamental problem is the impossibility of having the cash be "re-blinded" as it passes from Alice to Bob (after it was "blinded" as Alice withdrew it from the bank). If this kind of multiple blinding were possible, so that neither Alice nor the Bank could recognize the money that Bob holds, multiple-spending could not be detected. Chaum's arguments appear to apply to virtually any electronic cash system which can prevent double-spending. They suggest that traceable cash will be the rule in any digicash system. People planning their future lives of crime under the new regime will need to take this into account. Hal

2 1

Another invasion of privacy
by Mike Markley 17 Dec '03

17 Dec '03

There was an AP story yesterday about how several states are using prisoners to input data about traffic accidents and such into databases. I believe the state that they focused on was Arkansas. An attorney received a phone call that his SSN was being sold by prisoners that had gotten it from an accident report. The state allows people to use their SSN as their drivers license number. This prisoners also have access to everything else on the report, your license number, your home address and potentially your work and home phone number. Does anybody know what other states are using prisoners for this type of work? I'm about ready to cut up all my credit cards and start paying cash for everything that I buy. Mike. -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-= Mike Markley || The opinions here do not represent the mmarkley(a)microsoft.com || opinions of my employer. Attempts to || associate the two are pointless. "I want to look at life, In the available light" - Neil Peart -

1 0

Re: Laundering money through commodity futures
by wcs＠anchor.ho.att.com 17 Dec '03

17 Dec '03

One problem with using bet-doubling systems to pay bribes with, whether it's in the futures market or in the casino, is that you not only have to convince the bribee to accept the bribe and participate in a money-laundering process, you have to get him to be willing to accept a few powers of two losses before receiving the bribe. If the bribe is small relative to the liquidity of the bribee, that's fine, as long as you've got enough trust between you that the bribee isn't worried about you walking away when you've won n*2**4 and she's lost it. But if you're trying to bribe, say, an enterprising southern lawyer whose husband's a politician, with a high fraction of her net worth, she's *not* going to be in a position to cover your bets for n*16 even if she *does* trust you. On the other hand, finding an enterprising broker to switch owners of futures contracts for a small extra commission may not be so hard.

1 0

Re: BEST Inc.
by GERSTEIN＠SCSUD.CTSTATEU.EDU 17 Dec '03

17 Dec '03

-------------- On Tue, 19 Apr 1994 04:15:01 Thomas Riggley <jester(a)grex.cyberspace.org> wrote: >On Mon, 18 Apr 1994, Jeremy Cooper wrote: > >> > >> > I was in a BEST store yesterday, and attempted to pay by check. They >> > asked for ID to verify the check and when I handed them my military ID, they >> > asked for my driver's license instead. I gave them my driver's license and >> > they used it and the magnetic strip on the back of it to verify my check. I >> >> [stuff deleted] >> >> >From what I know, there is no law that says you have to keep that >> magnetic strip up to date. Just have a little meeting between it and Mr. >> Refridgerator magnet and you could end up with some surprising results. > > Is this true? I am a NY state resident. I am under the impression that >altering either the bar code or the mag strip on the back of my license >would be as illegal as say changing the picture (Not that this is possible >in with the new NY licenses). I do not know the legality behind this but >I am aware that altering a license in ANYWAY is illegal. Although what >you are suggesting is VERY difficult to prove, it is still I would think >illegal. Unless anyone has any legal information to the contrary.... > > I would also guess that these states that have the mag strips on >their license also have fines for non-oprative strips. If they do not, I >am sure the law will be created so enough! > -Tom For what it's worth, you can de-magnetize anything you want just by going to the store. I work at a pharmacy, and they have "inventory control tags" on some of the "hotter" items. When someone wants to buy one of these items, we put the tag (actually just a magnetized strip) on a special pad that demagnetizes it (and ATM and credit cards that are put on it too :)) Also, since I live on a university campus in New Haven, security is a big thing here. We now must use ADT keycards as well as physical keys to get into the buildings. The first semester they were used, I blitzed three of them just by carying it with me all the time. We never found the reason, but I think it has something to do with the fact that I'm around computers all day. (Incidentally, there were reports of peoples credit cards being wiped by these things as well as them setting off theft detectors at record stores). Just another 0.02¢ for the pot..... adam "After this, nothing will shock me." ---------- "In a Time/CNN poll of 1,000 Americans conducted last week by Yankelovich Partners, two-thirds said it was more important to protect the privacy of phone calls than to preserve the ability of police to conduct wiretaps. When informed about the Clipper Chip, 80% said they opposed it." - Philip Elmer-Dewitt, "Who Should Keep the Keys", TIME, Mar. 4, 1994

1 0

Key Servers
by fhalper＠pilot.njin.net 17 Dec '03

17 Dec '03

Does anyone have a current list of Key Servers. I have tried several and all are either "temporarily" shut down or it is an unknown address. I just need an address for one. Thanks, Reuben Halper Montclair High -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.3 mQCPAi16KosAAAEEAMUwRni4a9+GbuAhHDLcBWK60hCJUYxhr2hYokpELAhx0ejp 2fq61Tu9Hjn051CN8Xy5nu6sv2ODfG/t59l4DJSb5pirQaII3zaX0rMX0ydwGDoW YakL4ow1lNY+d/k14KpIuUW404+fNuNhIGSkdVLQIfbOgh0preK7/P44AKvdABEB AAG0JlJldWJlbiBIYWxwZXIgPGZoYWxwZXJAcGlsb3Qubmppbi5uZXQ+iQCVAgUQ Lam+x9xF3PzIgw7tAQHPogP/VmoF5AHJNBFlpxl1tvHAzrMLE8nkpengs94Y8zmF 1r5+hk0TaYeEEUzYf1QNfflya5md3WKeXnI3WhO2SRpdH953AD/tNmxw2LLEegat 5sI1XNPuNqxeompiHFRnCz4dI14qjDvRwnPay187/Q5q2F3m0nP8qA6wgl59mDq3 FuCJAJUCBRAteitx4rv8/jgAq90BARTHBACh99OJtGXATm01BUa+u6WHU5CBc2FN F5z29RpTA/JTrgUhn4qeZ19iCIlhe1wi0D3QQH0wN7FrMp6onMw49KFU05/KLDLb JSWdCzjbl/wPEG8z//O6+Pqzj+ZcNM9Rm0b08/QdVoQZMljXkl19Gq2P/D4ceewe WAKePQ2ciFdNbw== =K4ez -----END PGP PUBLIC KEY BLOCK-----

1 0

Re: Sgt Russell
by tim werner 17 Dec '03

17 Dec '03

>Date: Tue, 19 Apr 1994 12:29:25 -0400 >From: "Perry E. Metzger" <perry(a)snark.imsi.com> > >Strikingly, these people feel gravely insulted >when one points out the fact that their posts read like random text >generators driven off of markov chains, the statistics for which were >derived from bad xeroxes handed out by drooling individuals on the >streetcorner who rave about the aliens who are remote controlling us >through our shoelaces. It's not our shoelaces, it's invisible wires in our heads, that's how they put the thoughts there, they couldn't possibly be doing it through our shoelaces, get real. tw

1 0

[Q} IBM's NetSP encyption; what is it
by Harry S. Hawk 17 Dec '03

17 Dec '03

I read: > IBM also plans to integrate security features based on > IBM-developed NetSP encryption technology, which provides sufficient > security for tapping corporate data. NetSP is not subject to US export > controls and can be implemented outside the US. > [05-24-94 at 19:00 EDT, Copyright 1994, International Data Group They are using this with a new service that will compete with AT&T's PersonalLink (which uses RSA encypt via Telescript). Does anyone know anything about NetSP, how secure it is, etc. FYI, the service is agent "based" > Moreover, Intelligent Communications service will include a permanent > personalized agent, called an Alter Ego, which contains a range of > user- specific information. The Alter Ego is a "rules-based static > agent" that can respond to, or filter, incoming messages on behalf of > the user. > [05-24-94 at 19:00 EDT, Copyright 1994, International Data Group -- Harry S. Hawk habs(a)panix.com Product Marketing Manager PowerMail, Inc. Producers of MailWeir(tm) & PowerServ(tm)

1 0

Re: PGP 2.5 is outside...
by Linn Stanton 17 Dec '03

17 Dec '03

In message <9405251315.AA06738@ next1.tem.nhl.nl >you write: > We'll try to make a nice new PGP 2.3c, which will be 100% compatible with > the 2.6 version. (Bug fixes from 2.3 to 2.4 from Branko Lankester are already > applied, now the compatibility problem will be to let 2.3 know it is 2.6) Why not have that version advertize itself as 2.6? Then everyone would see a key that says its 2.6, and which would be legal (under different rules) worldwide. Linn H. Stanton <stanton(a)acm.org> The above opinions are exclusively my own. If anyone else wants them, they can buy them from me. Easy terms can be arranged. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6 mQCNAi3iC/MAAAEEAOj2cr49PeFwa78Swqf3nBZHspCfZ+IgX8nGU8rbm2oJ6VYj u8o2M4c3Nv/tkoou24gDtM43/jSrRAalcX40pbGRqWJkkayJ52J8o4KupCrgsKLg fBE5P4tcUo9KaeJIaOfItJ2qrfTOcFuN7GiyTQ1E2/FGPSHDoqz3kXhxoZcNAAUR tCFMaW5uIEguIFN0YW50b24gPHN0YW50b25AYWNtLm9yZz4= =H8OV -----END PGP PUBLIC KEY BLOCK-----

1 0