December 2003 - cypherpunks-legacy

Re: Certification
by Rabid Wombat 17 Dec '03

17 Dec '03

You seem to have spammed the wrong mailing list. Most of us do not want to become certified sales / marketing droids, although we occaisonally keep them around the office as pets. On Wed, 21 Jan 1998 sales&marketingproz(a)diku.dk wrote: > > > "From: Steve Camfield, SME Board of Directors > > > It is my privilege to formally invite you to become certified in sales or marketing > management. Certification sends a clear message to your customers and colleagues &… [View More]

1 0

Eureka! Sat Jan 24 '98
by eureka＠eureka.abc-web.com 17 Dec '03

17 Dec '03

Welcome to Saturday's issue of Eureka! KARA'S ADULT PLAYGROUND With 15 live sex shows, 1,300 Hardcore XXX videos, 1,000s of Hardcore and Softcore Pix, the VaVoom monthly magazine, Kara's exclusive monthly centrefolds, adult games, erotic stories and even casino and sports betting, you won't be going out for weeks particularly now that you can get a FREE trial - your eyes will be popping out of your head! Hahaha! Kara's Playground ...... http://www.rjbtelcom.com/eplay.html PLEASE … [View More]

1 0

Poll shows Bill G. popular & MS monopoly supported [CNN]
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > POLL SHOWS BILL GATES' POPULARITY GROWING > > Gates poll graphic January 23, 1998 > Web posted at: 1:58 p.m. EST (1858 GMT) > > (CNN) -- The popularity of Microsoft Corp. Chairman Bill Gates among > Americans is growing, according to a CNN/Time magazine poll, and > almost half of the computer users interviewed favor having the > company become the … [View More]

3 2

Sucking Sound...
by Jonathan Wienke 17 Dec '03

17 Dec '03

10 13

Re: How to eliminate liability?
by John M 17 Dec '03

17 Dec '03

Bill, Thanks for your response. Such a simple idea, I kinda figgered (was hoping) that it was already thought of, but I hadn't heard of it. I have been meaning to buy Schneier's book... One of my points, however, is that if the division of the encrypted information is done properly, even if the private key were deduced by whatever means, all they would find is (for instance) the high order bits and some ECC, but nothing that could be used to regenerate any meaningful information … [View More]without the other parts. Because of this, I have been asking myself, how could any one datahaven operator be held responsible for holding classified, porn, or other information if they only have a meaningless slice of it? Perhaps this is more a legal question (even more out of my league) than anything... Any comments? >Secret Sharing is easy, and there are a number of implementations with >useful properties like being able to read the original from K of N parts.* >The problem is how to implement it in ways that protect the server >operators as well as the information providers. For instance, >the author's client software can do the split and send the shares too >different servers, and make sure the readers know how to find the pieces; >this can even be automated enough to make it convenient. >This not only makes it hard for the Bad Guys to find the pieces, >it makes it impossible for the data haven provider to know what's >being stored there, and even if the site is siezed it doesn't give up >the critical information. This is a Good Thing, and we've discussed it. > >On the other hand, what happens if a Bad Guy wants to entrap the operator, >by planting child pornography, pirated software, and TOP SECRET data >in the data haven, advertising on Usenet and then calling the cops. >Anybody, including the cops, can retrieve the contraband and bust them. >So what are the alternatives, besides obviously encrypting your disks >so it's harder to determine what's on them besides the plant, >and the ever popular "don't let them find your physical location"? >Perhaps the data haven can do the split and farm the data out to >other data havens - but how do they know the data they're receiving >is really a slice of contraband data instead of Yet Another Plant? >It gets pretty convoluted. > >[* You can read about secret sharing in Schneier. ] > Thanks! > Bill >Bill Stewart, bill.stewart(a)pobox.com >PGP Fingerprint D454 E202 CBC8 40BF 3C85 B884 0ABE 4639 > ______________________________________________________ Get Your Private, Free Email at http://www.hotmail.com [View Less]

2 1

Group works on way to make Net payments work.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 23 Jan 1998 13:28:39 -0800 (PST) From: William Knowles <erehwon(a)dis.org> To: DCSB <dcsb(a)ai.mit.edu> Subject: Group works on way to make Net payments work. Organization: Home for retired social engineers & unrepented cryptophreaks MIME-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: William Knowles <erehwon(a)dis.org> SAN FRANCISCO (Wired) - Someone out there is actually worried that you might end up with a … [View More]desktop littered with different digital wallets or that you might not get a receipt for your pay-per-view time visiting an X-rated site. In fact, a group of 30 electronic payment companies are working on a protocol that would ensure that all digital wallets and cybercash registers will know how to talk to each other and issue the proper digital "paper trails." Spearheaded by ecash pioneer, Mondex International, the group is working on an way to make a single digital wallet on the desktop to interact with the payment systems designed by everyone from CyberCash to AT&T to Wells Fargo Bank. By using XML (extended markup language), the protocol is designed to ensure interoperability among the software used by buyers, sellers, and financial institutions to carry out online transactions. The open trading protocol hasn't gotten half the attention that SET, the secure electronic transaction protocol, has. And, at first glance, its job may not seem as crucial since it's not about guaranteeing the security of transactions. But those aboard the new protocol-defining body say their system of compatible operations is key to getting consumers to really embrace e-commerce. "Imagine if you've got an IBM wallet, a Microsoft wallet, and a VeriFone wallet," suggested Mondex International development co-director, David Burdett. "Unless you have some standard way in which these wallets can communicate with each other and with merchants, you aren't going to end up with interoperability and the consumer's going to have to have lots of different wallets on the PC." The goal of the open trading protocol is to make transparent the traditional steps in a transaction: the offer for sale, agreement to purchase, generation of receipt, and attendant paper trail. And to make it all happen with no more than a click of the buyer's mouse. "(The open trading protocol) is trying to replicate in the virtual world what people have in the real world: things like invoices, making payments, getting receipts and delivery of goods," said Burdett. And to guarantee that you can have real-world accountability, even for virtual purchases. "If you're only getting delivery of virtual goods over the Net, such as software or entertainment content that you pay for, there's no physical delivery at all; but you still want a receipt and all the other normal aspects of a transaction," Burdett said. A preliminary version of the proposed common language was posted early this month to the OTP Web site, by the 30-member consortium, which includes CyberCash, DigiCash, IBM, MasterCard, Mondex, Netscape, Oracle, Sun Microsystems, VeriFone, and Wells Fargo Bank. Conspicuously absent from the coalition are Visa International, which reportedly declined to join the coalition when invited by Mondex, and Microsoft, which apparently opted out of the group's plan because it is busy developing an alternate standard called the Value Chain Initiative. Still, Microsoft's absence isn't expected to thwart widespread adoption of the protocol. "There's a lot of flexibility with these protocols," said Zona Research analyst Vernon Keenan, who pointed out that the group protocol and Microsoft's version are not necessarily mutually exclusive. "The key factor to determine adoption is whether ... the major commerce server players incorporate these protocols." And it seems at least several will, since they've already joined the ranks of open trading protocol proponents. -- The information standard is more draconian than the gold standard, because the government has lost control of the marketplace. -- Walter Wriston -- http://www.dis.org/erehwon/ For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/> [View Less]

1 0

Re: Physical Meet: Saturday Feb. 14? (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > > I would like to set the Feb. physical meeting for Saturday the 14th at the > > normal 6-7pm time. > > > > An alternate would be the following 21'st. > > > > Any major objections to the 14th? Suggestions on location? > > Let's shoot for the 21st. My wife will kill me if I try to leave > the house on the 14th. :-) Any other suggestions? I personaly don't care so unless somebody else speaks up before Sunday I'll go ahead … [View More]

1 0

GoLive CyberStudio2
by John W. Adams 17 Dec '03

17 Dec '03

Hello Mac User, Our records indicate that you downloaded a free 30-day trial of GoLive CyberStudio 2 from our web site. Your 30-day trial evaluation period has expired. Purchasing the full copy of the software now will allow you to continue working without losing any of your pages or sites. I can also include the new "CyberStudio 2" book by Peach Pit Press (an $18.95 value) for free. I'll need for you to contact me within 30 days so that I may facilitate your purchase. Since … [View More]

1 0

Internal Affairs: Looking for Lewinsky, from Netly News (fwd)
by Declan McCullagh 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Fri, 23 Jan 1998 15:41:04 -0800 (PST) From: Declan McCullagh <declan(a)well.com> To: politech(a)vorlon.mit.edu Subject: Internal Affairs: Looking for Lewinsky, from Netly News ******* http://cgi.pathfinder.com/netly/opinion/0,1042,1708,00.html The Netly News (http://netlynews.com/) January 23, 1998 Internal Affairs: Looking for Lewinsky by Declan McCullagh (declan(a)well.com) Call it the year the Internet brought down a … [View More]

1 0

IETF S/MIME to follow PGP in building in GAK?
by Adam Back 17 Dec '03

17 Dec '03

You may recall the furor generated by PGP Inc adding a GAK enabling feature thus making it easier for governments to impose GAK on the deployed PGP 5.x user base. PGP Inc called this feature CMR (Corporate Message Recovery) or ARR (Additional Recipient Request). Over on IETF S/MIME, right now there is a thread which looks set to add an almost identifical feature to S/MIME (spooky how similar the feature is even). Most of the regular contributors on S/MIME work for GAK sell out companies … [View More]anyway, so I figure this is pretty much a done deal. (S/MIME already has another form of GAK also, in that the X.509 key directory specs allow the directory to optionally keep _private_ keys also). I think the ARR mechanism is actually more dangerous than keeping locally escrowed copies of keys in PGP because of the web of trust model. (See: http://www.dcs.ex.ac.uk/~aba/cdr/ for my thoughts on this). In the S/MIME world where there is a more hierarchical approach to Certification, you can expect government run CAs which demand a copy of your private key also. (eg. the UK DTI document on crypto licensing proposals was talking about this method). For S/MIME, S/MIME style ARR seems fairly balanced in lethality to CAs which keep private keys. I wonder if Phil Zimmermann feels proud of himself now that S/MIME looks like it will adopt his CAK/GAKware design. You might be amused at this introductory remark from the proposer on S/MIME IETF: : As a side note, this is not a radically new concept as something very : similar has already been proposed and implemented by PGP. : : Flames welcome. The guy's proposal below. It was well received too. Someone else proposed adding it in as a core MUST S/MIME requirement to handle these additional recipient requests. (You can follow the thread on the hypertext archive at www.imc.org (look for IETF S/MIME mailing list, or by subscribing to ietf-smime(a)imc.org) Adam ====================================================================== Date: Fri, 23 Jan 1998 13:07:01 -0700 From: "Steve Russell" <steve.russell(a)worldtalk.com> Subject: Corporate Key mechanism To: <ietf-smime(a)imc.org> A new and somewhat radical thread.... Because I believe the following to be true: - Requiring key recovery is a bad thing (complexity, cost, implementation, etc.) - Companies do have a need to access mail encrypted to or encrypted by their employees (lost keys, legal investigations, etc) - We are all working on methods of satisfying US export requirements so that we can export a cryptographically useful product - The is a middle step between full key recovery and no hope of recovery which involves encrypting messages to a 'corporate key' in addition to a individual public key when sending a message. Basically, what is involved is changing the user certificate format to designate a field for a second certificate which represents the corporate public key appropriate for that user. An application intending to encrypt mail to that user MUST then encrypt the message to both the user key and the corporate key. By no means am I implying that everyone that implements S/MIME leave a back door into all of their messages. However, since most companies that are implementing secure messaging are setting up their own CA (Entrust, OnSite, Netscape, etc.) and they have control over what fields are populated and with what information, they are able to choose whether or not they need visibility into their own data. As a side note, this is not a radically new concept as something very similar has already been proposed and implemented by PGP. Flames welcome. Steve [View Less]

1 0