December 2003 - cypherpunks-legacy

Re: How to legit encryption
by Jeff Gostin 17 Dec '03

17 Dec '03

tim werner <werner(a)mc.ab.com> writes: > This is a neat way of expressing a good idea, but I wouldn't count on it. > A language can probably be construed as something that can be understood by > anyone who learns it. Even though I speak PGP, I still can't understand > what you say without a key. There's probably no legal precedent for that > yet, but look what they've done with the rest of the Constitution so far. Ok, what if PGP-encyphered text were argued to be COMPILED? In that case, the original SOURCE CODE was being shared, and the COMPILER being held secret. Source-reading keys are available upon request. Or some twist like that. :-) What do you think? All of a sudden, we have compiled source code being pushed around that is VERY difficult to reverse engineer without the proper authorization. --jeff

1 0

e$ : NetBank legality
by Hal 17 Dec '03

17 Dec '03

I'm curious about the legality of NetBank in the context of our earlier discussions about demand deposits and Chaum cash. These people will take your money and give you electronic tokens, and they will take the tokens and give you cash (minus 20%). Does this sound legal? Are they a bank? I wonder what their tax liabilities are. Sales tax on selling the tokens? Is this a barter system? If so, they're supposed to get SS#'s and such. Maybe you have to give that information if you sign up as a vendor, but legally I'd think ordinary users would have to be reported to the IRS as well, and it doesn't sound like they're doing that. This whole thing sounds pretty questionable legally. It will be interesting to see how it comes out. Hal

1 0

e$: NetBank
by rah＠shipwright.com 17 Dec '03

17 Dec '03

There's an outfit called NetBank, which is selling e-cash-like *certificate numbers*, through a dial-up BBS on a 900 line, in any denomination you want, which you can e-mail to vendors to buy stuff with. In fact all the interactions with the bank (deposits, breaking "bills" into smaller denominations, etc.) are done with switch codes in e-mail. It's extremely ungainly, and it looks userous too, to the extent that they charge 20% (each way?) to cash you in and out. I hoovered out all the stuff in their infobot (netbank-info(a)agents.com) and I really haven't plowed through it all yet. If you folks are interested I'll summarize it for the group and/or redirect my dumpster-divings on the subject to you individually in e-mail. Just let me know. 'Course you're welcome to play with their infobot yourselves, I suppose ;-). It looks like someone did some serious work on this, folks. That's just a philosophy major from Missouri talking, of course. I wonder who they are? I heard some discussion about them here, but I can't seem to find the thread in my e$ article stash.... Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) "There is no difference between someone Shipwright Development Corporation who eats too little and sees Heaven and 44 Farquhar Street someone who drinks too much and sees Boston, MA 02331 USA snakes." -- Bertrand Russell (617) 323-7923

1 0

List Dead Again!??
by j.hastings6＠genie.geis.com 17 Dec '03

17 Dec '03

Wow man. No letters waiting? No way. Could be GEnie, or majordomo again. Anyone get this? Please respond. Kent - j.hastings6(a)genie.geis.com

1 0

Re: e$ : NetBank
by analyst＠Onramp.NET 17 Dec '03

17 Dec '03

>There's an outfit called NetBank, which is selling e-cash-like *certificate >numbers*, 8 digit numbers only. No internal checksums or verification. Merchants must send an email message to verify that the money is previously unspent and receive fresh bills. >It's extremely ungainly, and it looks userous too, to the extent that they >charge 20% (each way?) to cash you in and out. I hoovered out all the >stuff in their infobot (netbank-info(a)agents.com) >Bob Hettinga > Agree about ungainliness. They aren't yet set-up with PGP or PEM, although they say they are looking into it, so they currently suggest that if you want to send encrypted mail, that you generate a key to be XOR'd with all messages to and from. They do provide the C code for the encryption, though ;) >From reading all of the info from the above infobot, it looks like they only charge the 20% once, to the merchant when he tries to redeem e-certificates for $USD, which they will pay out at the end of each month. They claim in their docs that the 20% is the cost of their 900 number service, so I suppose their business plan is to make money on the float, since they are not charging transaction fees for making change, verifying e-cash, etc. If they accepted credit cards they might be in much better shape. I would much rather see real Chaum-style electronic money, but have not yet received a response after signing up for their beta test. I wonder if NetBank's style of serialized e-certificates provide the 75% of the functionality that most people need to ignore better alternatives, especially if, as with Pr0duct Cypher's money, their is a big learning curve to go up before they can use it. Any pointers to other near-term e-cash systems? I am very interested in setting this up for relatively small transactions (<$50) in the not-to-distant future. Thanks for info. -- Benjamin McLemore <analyst(a)onramp.net>

1 0

Re: My anonymous remailer
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: Still, though, I think this would do more harm than good. I get about : 20 to 40 messages a day through my remailer, and only 5 or 10 of those are : encrypted. Switching to a policy that would require chaining and encrypt- : ing to make it useful would make it a lot harder to use the remailer. If Agreed, but it would also force us to get off our butts and make integrated remailer-aware mailers work properly, as opposed to the broken kludges we have at the moment. In the long term it would be for the better. (Every single time I've tried anything fancy with chaining and encryption, it hasn't been delivered. And I don't consider myself incompetant.) : The other problem I see with Graham's idea is that I'm not sure the : technology is there to provide good security in the face of this much : information. Not many of the remailers add delay, and a lot of people don't : like it when they do. In that case it may be easy to figure out what Again, fixing this up would be for the better good. You can just imagine that the FBI is already watching all remailers closely under arm-twisting from the Software Publishers Association, not to mention the NSA doing likewise for their own reasons. I think we *should* force ourseles to make traffic analysis visibly impossible. If we can crack an anon posting path with the same information available to an attacker who can monitor all the lines, our system is broken. We should put it up for peer-group testing just like a new encryption algorithm. I believe the security of current remailers is a joke against a real attack. It's *only* good enough to hide identity from other usenet readers. We might as well all use only one-hop remailers and stop kidding ourselves that the multi-hop stuff does any good at all. (I don't believe the anti-traffic analysis support of the current remailers is any good, which is why any postings I've made through remailers have been single-hop in clear. I just don't post anything that would get me in legal trouble. OK, maybe a couple of posts I've made would be personally embarrassing if I were outed, but I wouldn't be by any LEAs that were watching. They'd just be able to use logged postings in criminal cases) : path even a chained encrypted message took. Even the delaying remailers, : if they published message sizes, would usually reveal their in-to-out : correspondance. So I think it is premature to do this. Until we have : remailers which can support cryptographically strong message padding : with standard message sizes, running on un-hackable systems with delays : and batching to confuse the in-out relationships, it would be counter- : productive to do what Graham suggests. Precisely my point. Except I see it the other way - as long as we're not forced to implement these measures properly, they'll never happen. : service it's hard to know what features to provide. In particular, if : cleartext output is prevented, how much does that impair the usefulness of : the network? My instinct is that it hurts a lot, although it would be nice : for the operators since it would eliminate most sources of complaints. I meant that cleartext *input* should be prevented. Cleartext output however can be 'outed' in accordance with policy, even if it's personal mail. Also it can be silently dropped on the floor by the last-hop admin without any comeback, for whatever egregious reason he chooses, or even randomly. It's up to the sender to pick a route that works. If some remailer admin (like JGdeA, or was it John Stanley?) choses to allow M.M.F postings, then he can take the heat for them personally. It's impossible to tell an email recipient apart from a mail to news gateway, so we can't enforce encrypted output only, if we allow posting. However, the 'outing' policy makes it in people's best interests to encrypt to the destination user if they can. Unencrypted *mail* as well as news is also fair game for the last-hop remailer admin to delete on his personal whim. G PS When I say we should out all information, I'm only talking about information that's visible going in and out. If we ever get my earlier idea of chained encrypted reply-addresses to work, with time-sensitive keys that are deleted after a few days, I'm not suggesting publishing those keys. Certainly, we should assume that a few sites will be broken into, or even many sites, but as long as one site remains uncompromised, there's a strong link in the chain that holds up the entire chain.

2 1

Re: My anonymous remailer
by gtoal＠an-teallach.com 17 Dec '03

17 Dec '03

: From: Hal <hfinney(a)shell.portal.com> : service it's hard to know what features to provide. In particular, if : cleartext output is prevented, how much does that impair the usefulness of : the network? My instinct is that it hurts a lot, although it would be nice : for the operators since it would eliminate most sources of complaints. I said in my previous post that that wasn't what I had meant, but thinking about it, it's worth considering. After all, if anyone really missed the functionality of anon posting to news, people could set up news gateways that accepted encrypted articles for posting, decrypted them, and injected them. Again, whoever did that would be taking direct responsibility for what was injected, and it would cleanly decouple the posting function from the anon remail function for those who didn't want to do both. G

1 0

Majordomo results
by Anonymous 17 Dec '03

17 Dec '03

>>>> who cypherpunks

1 0

Majordomo results
by Anonymous 17 Dec '03

17 Dec '03

>>>> who cypherpunks

1 0

Re: Det./tmp/Nym on Netcom
by tim werner 17 Dec '03

17 Dec '03

>From: whitaker(a)dpair.csd.sgi.com (Russell Whitaker) >Date: Mon, 25 Jul 1994 12:05:04 -0700 > > nym(a)netcom.com > tmp(a)netcom.com > >Bryant was >at liberty to say that the user accounts "tmp" and "nym" were the same >person. I noticed that both tmp and nym mentioned in one of their early posts that they had read up about cypherpunks in the archives at soda, or some such, and that it was ok to launch right into the discussion, since he/she was up to date with the issues. This was followed, of course, by the usual long and boring happy horseshit. I also noticed a common net phenomenon: since Sue D. Nym appeared from his/her name to be female, some men were more likely to come to his/her defense when he/she was flamed. This reminded me of the blurb I read in Wired (bad magazine, I've since stopped subjecting my eyes to the green print on red background) about men using names like "Janet" trying to sweet-talk lesbians on IRC and eventually finding out that "Karen" was also a man. tw

1 0