December 2003 - cypherpunks-legacy

Re: Is it legal for commercial companies to use PGP?
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 09:07 PM 7/17/95 -0400, tim werner wrote: >>... I was talking to one of the sys admins at >>A-B, and he said that we weren't allowed to use PGP to encrypt our mail, >>because Viacrypt owned the commercial rights. Actually, it's less clear than that. It's pretty clear what you can do with ViaCrypt code; just read the license to see who can use it, and you can send any kind of messages you want over it, even for money. On the other hand, the definitions of "non-commercial use" for RSAREF and IDEA are far less clear (and they're clearer for RSAREF than for IDEA, and I got the impression from what I read somewhere on the net or in the PGP docs that the initial permission from Ascom-Tech for use of IDEA with PGP was pretty informal, and that they've been trying to tighten up what's covered.) (Also RSAREF licenses have changed from version to version, and the license PKP uses to distribute versions of RSAREF may also have changed?) Selling software containing the code is pretty clearly commercial. Non-commercial messages from your personal non-business machine are clearly non-commercial. Providing a service of encrypting and decrypting messages for people for money sounds like it's _very_ probably commercial. Encrypting and decrypting messages to/from your business that deal with money are a very gray area. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

1 0

Re: bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

At 12:24 PM 7/17/95 -0500, Phil Fraering wrote: >I'd also like to point out that this system indicates that during >an attack/disruption on a traditional dc-net, the disruptor can >tell what the original person was trying to send, even though noone >else can. > >And then perhaps XOR the data with something offensive, and if the >original sender tries to re-send, broadcast the result of the XOR, >resulting in a total net output of the offensive material. That's difficult - you have to identify that the sender is sending the same message while the message is being sent, rather than one or two bit-times later, and you can't fake encryption with an unknown keyid or digital signatures. (Digital signatures aren't something everybody would use very often on a DC-net, since the purpose of the net is to be anonymous, but since you can do anonymous broadcasts, you can anonymously post a signature key for your nym if you want to.) Also, there's no need to combine jamming and posting an offensive message; they both work well separately. I suppose you could do that if you only want to harass the net a bit (e.g. replace all trafic to remailer X with new remail to whitehouse.gov, or replace all postings from Cancelmoose with complaints about censorship), but basically DCnets degrade rapidly if the social structure of the net members does. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

SurfWatch for employees (ugh)
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Consistent with the trend towards treating employees like children, Webster Network Strategies has announced (but apparently has not shipped) a product similar to SurfWatch but aimed at an employment environment. The product is called "WebTrack" and supposedly supports access lists of URLs, where access can be allowed to "all but these sites" or "only to these sites". The product also can be configured to log all Web usage by users subjected to its reign of terror. :) WebTrack is priced at $7,500 with an annual subscription to its list of interesting (err, forbidden) sites priced at $1,500. The article in the 7/10/95 Infoworld doesn't list contact information for Webster Network Strategies. What is it, two months between deployment of software designed to restrict net access to one segment of the population perceived as especially vulnerable and the subsequent application of that technology to other target groups? My bet is the next target group will be university students, followed by "affinity marketing" with various repressive organizations (whose names I elide in the interests of greater Cypherpunk harmony, pick your own and imagine them here.) Of course, the next step is to use restrictive licensing/distribution terms (a la Netscape/Mozilla) and a nifty freeware/software package available only from a site which also carries porn (or other forbidden fruit) to make the customers/purveyors of this crap twist in the wind a bit. Break the terms of the license and get the software somewhere else? Avoid using the coolest new thing because you're hooked up via we'll-think-for-you.net? Doh. (Pedants need not point out that personal choice (and personal filtering) are always appropriate, and indeed empowering. Neither WebTrack nor NetSurf are marketed to help people subject themselves to a regime of repression - they are intended and sold to allow the purchaser to control what others (perceived as having fewer or no rights) will read and view. ". . inasmuch as you have done it unto one of the least of these my brethren, ye have done it unto me." Matthew 25:45) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMAtWUn3YhjZY3fMNAQH8EAP/aFXe7uI1EuIB31L8h7H+5l3Mg1aQE7e9 i86FnqwGMDg5JlDvJD05dXOBXeInvKtc6ZD0Us+qwDmg2ISo/Yu0QCfedTBgZ7fq s/3WFwtOcpiBG7YTkxGJrvB+r4KIgodb9QSGEQ8yofKaRLT33IkgO3ijxrnyoNkX vm/tZ8EnoV0= =hrOo -----END PGP SIGNATURE-----

3 2

Re: "Judgement Proof" and Putting Up or Shutting Up
by an250888＠anon.penet.fi 17 Dec '03

17 Dec '03

>> >and, conspiracy theories non-withstanding, we the people do not govern >> >America --we are only given a short list of politicians who have sold >> >their soul to CFR's satanist inner circle. >> >> What's CFR? >> > >Council on Foreign Relations. or Code of Federal Regulations. ---------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. If you reply to this message, your message WILL be *automatically* anonymized and you are allocated an anon id. Read the help file to prevent this. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

WebTrack URL/Contact Info
by lmccarth＠cs.umass.edu 17 Dec '03

17 Dec '03

The WWW site for Webster Network Strategies and its WebTrack software is http://www.webster.com/ According to that page: How to reach us: E-mail info(a)webster.com Call (941) 261-5503 Fax (941) 261-6549 Write to WNS, 1100 5th Avenue South, Suite 308, Naples, FL 33940

1 0

SurfWatch for employees (ugh)
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles <greg(a)ideath.goldenbear.com> writes: > Consistent with the trend towards treating employees like children, > Webster Network Strategies has announced (but apparently has not > shipped) a product similar to SurfWatch but aimed at an employment > environment. The product is called "WebTrack" and supposedly supports Forcing workers to keep their minds on their work? Shameful... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu7mN74r4kaz3mVAQEWhgP9FDkAtsbPMVk5/FTCGaImFu7Iqllw0Y55 Rv2gXxVdiYKmK449i1+PQhJvpnLJE5qVRqMeCjhcysrbI/WK9RUDP+6FVenfDjWZ Kxh385qzNWE1sJTv92ii3g4dbIp7yziePJc9ZH6HqZ9i1MAyQfjEPutNcE5xgLSH hBUYN0Q1cPE= =l0BB -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Is it legal for commercial companies to use PGP?
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- jgrubs(a)voxbox.norden1.com (Jim Grubs, W8GRT) writes: > As I recall, the following is a correct scenario: a customer can use PGP to > send credit card numbers to a vendor he's making a personal purchase from, > but the vendor must use Viacrypt. If the customer is buying something to use > for business, BOTH must use Viacrypt. In practice, I'd probably buy Viacrypt for legal reasons but use PGP anyway. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu5iN74r4kaz3mVAQF11QQAiNccy69sb5OA1jmOpErqqZNJ4sNx3smW tAJQ3lD1op4qlPIO48vxwkvr+IaQyyOkf797+9Ca1z9WtxgwSamo32BQnPQZ6Pbm Vipmpwrabrxq67TOrGgxNp3UN7oBZl3eyad0hIj6ENzs8u1wi3wkHUV/3z341XB7 u953orkOZSk= =UYrt -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

4 3

Mondex (forward)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Thought this might be of interest... forwarded with permission.. >From Andy Meredith (meredith(a)bcs.org.uk) on the ecm list : On Jul 18, 9:21am, Marcel van der Peijl wrote: > Subject: Re: e$, c$$$, Cyberbucks & ECash - terminology. > > > electronic cash (also digital cash) is a general term for > > > the concept of encrypted messages that have inherent value > > > - as opposed to credit notes or electronic checks. I guess > > > that the Mondex smart cards have ecash in them, but that > > > seems different. > > I am such a bad reader! You are right. This is a good definition > of electronic cash or digital cash. Mondex is questionable. The > card has an account, and uses crypto to proof it is a real Mondex > card, so you'd better believe it when it says it took the money > of it's internal balance. I would vote this is not digital cash. I am participating in the Mondex pilot scheme in Swindon. It took me a great deal of pushing to get _any_ details at all. The details I did get didn't go into the encryption schemes used or any such fun stuff. It did in fact take quite a while for me to realise the significant differences between ecash and Mondex. As they didn't, in the end, make me sign an NDA, I guess I can share. 1 - The Value is not encrypted on the card, that is held as plain text, it is the front door on the card that is heavily guarded. If therefore you can inject value into the card from the back door, it is then taken as real money. The logic being; Hey it managed to get through all that security which is imposible for anything except another mondex card to do, it must therefore be Mondex money ... that's Ok then. There can never be a software only version of Mondex as it stands. The trust is in the front door, not the cash values themselves. 2 - Some of their transaction monitoring is very "Big Brother"esque. As you can imagine, if a card is seen to be creating money but not consuming it, there IS a problem. Therefore whenever you get some money from a "hole in the wall", the bank sucks over your transaction log & error log. It will of course only ever use this for security monitoring. It will never follow the likes of AMEX and start stock pilling these transactions, using it's knowledge of the which physical entity own what card ID, and using the cross reference for market research/direct mail/consumer profiling. No of course not. That would be TOTALLY unethical ... 3 - Mondex is billed as "Electronic Cash", but you won't find the concept of anonymity in there anywhere. They talk about it, but I haven't seen them write it down explicitly. One could suggest however that that "Cash == Anonymous", so the scheme would have to be anonymous for them to have a right to the "Electronic Cash" title. > So what is the name for schemes like this? How about "Stored Value Card" >-- End of excerpt from Marcel van der Peijl One interesting thing that I noted. When I read through the technical blerb on ecash a while back, I had to sit back and think very clearly, and read very slowly. However, it was relatively easy to understand the bits, and then even easier to put the bits together into a system. The reason, I suggest, is that if you understood all the encryption technology behind ecash, and had the requirements that it has for anonymity and security (hand in hand). You would reinvent ecash. Maybe the layering would be subtly different, the real one ond your independant derivative wouldn't interact, but ... If however you were to have asked me to explain ecash a week later, I would have been totally stumped. It is a very elegant system. Mondex, on the other hand, worried from the word go. It just didn't seem to add up. Apart from everything else, why were they being so damned secretive. I read and thought, and read and thought. Then it finally dawned on me. Mondex just simply doesn't have the same requirements list as ecash. I was prejudging the requirements from my previous exposure to ecash. Ask me to explain Mondex to you now ... what do you want to know :) Andy M (this is my opinion of information gained outside of company time. It is not the opinion my employer.) And : On Jul 18, 12:29pm, Marcel van der Peijl wrote: > Subject: Re: Mondex > > I am participating in the Mondex pilot scheme in Swindon. It > > took me a great deal of pushing to get _any_ details at all. > > Of course! Security through obscurity has always been a good way of > protecting your systems... ;) Absolutely. That's why VISA have lost so little money :) > > 3 - Mondex is billed as "Electronic Cash", but you won't find the > > concept of anonymity in there anywhere. They talk about it, > > but I haven't seen them write it down explicitly. > > Hahahaha. Let me explain. You can buy the card anonymously. This > gives anonimity.... > NOT! Actually, you can't. You need to supply bank details in order to get one. At least you do for the Swindon trial. The cards in use here are in fact combined ATM and Stored Value ;) cards. They have all your bank details in a mag. stripe on the back of the card. The current batch of EPOS terminals don't use this stripe, but I wait with interest. > They are forgetting that tracebility plus one link of a person to an > 'anonymous' account is the same as identification. Sainsbury's (et al) sussed that one a while back. Hence the introduction of "Customer Loyalty Cards" (yuch!!). Thereby allowing them to bind purchases/times/locations => Credit card numbers => Physical customer addresses & therefore demographic data. Only in this situation for Credit card number read Mondex card ID. > Do you realise any ATM, and a lot of stores, have security camera's > embedded? No, they wouldn't use that to link a person to a card, > would they? That would be unethical... No need. They have not only formed the link, but they are getting you to fill in the damned form :) > > How about "Stored Value Card" > For Mondex, perfect. What about FV? And NetChex? Don't know about these ones. > About your perception of ecash: I admit that the blurp on our server > does not fully cover the system in such a way it is easy to remember > and explain. Not at all. If you had asked me to explain the system while it was still fresh in my mind, I would have had no trouble. It is very neat and logical, but it is also pretty intricate. Apart from anything else, I didn't feel it was necessary to hold on to the mental model of how it works. I liked it. However, Mondex ... >-- End of excerpt from Marcel van der Peijl Cheers Andy M

1 0

AYN_ran
by John Young 17 Dec '03

17 Dec '03

The New Yorker, July 24, 1995: "Twilight of the Goddess." A critical look at Ayn Rand and her work. Thirteen years after Rand's death, her books still sell more than three hundred thousand copies a year. Not since the popular novels of almost a century before, bent on refutations of Darwin or God, and offering what George Eliot called "a complete theory of life and manual of divinity, in a love story," had there appeared so vividly accessible and reassuring a guide for the cosmically perplexed. As late as 1991, the Library of Congress found that a majority of Americans surveyed named "Atlas Shrugged" as the book that had most influenced their lives, after the Bible. AYN_ran [About 57K, in three parts]

1 0

Re: S. 982 Kyl-Leahy(-Grassley) NII Protection Act
by Carl Ellison 17 Dec '03

17 Dec '03

I read it and it looks OK -- except, as I said in e-mail to Senators Kyl and Leahy, we can't let ourselves believe that legislation can keep computers safe from hackers. Many of these threats are outside the reach of US law. Instead, we need good firewalls, encrypting file systems, etc. - Carl

1 0