December 2003 - cypherpunks-legacy

SurfWatch for employees (ugh)
by jgrubs＠voxbox.norden1.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Greg Broiles <greg(a)ideath.goldenbear.com> writes: > Consistent with the trend towards treating employees like children, > Webster Network Strategies has announced (but apparently has not > shipped) a product similar to SurfWatch but aimed at an employment > environment. The product is called "WebTrack" and supposedly supports Forcing workers to keep their minds on their work? Shameful... -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: http://norden1.com/~jim/sylvania.html iQCVAwUBMAu7mN74r4kaz3mVAQEWhgP9FDkAtsbPMVk5/FTCGaImFu7Iqllw0Y55 Rv2gXxVdiYKmK449i1+PQhJvpnLJE5qVRqMeCjhcysrbI/WK9RUDP+6FVenfDjWZ Kxh385qzNWE1sJTv92ii3g4dbIp7yziePJc9ZH6HqZ9i1MAyQfjEPutNcE5xgLSH hBUYN0Q1cPE= =l0BB -----END PGP SIGNATURE----- -- WebCasters(tm) James C. Grubs jgrubs(a)voxbox.norden1.com 6817 Maplewood Avenue Tel.: 419-882-2697 Sylvania, Oh 43560 Fax: 419-885-2814 Internet consulting, HTML programing, Information brokering

1 0

Mondex (forward)
by Rev. Mark Grant 17 Dec '03

17 Dec '03

Thought this might be of interest... forwarded with permission.. >From Andy Meredith (meredith(a)bcs.org.uk) on the ecm list : On Jul 18, 9:21am, Marcel van der Peijl wrote: > Subject: Re: e$, c$$$, Cyberbucks & ECash - terminology. > > > electronic cash (also digital cash) is a general term for > > > the concept of encrypted messages that have inherent value > > > - as opposed to credit notes or electronic checks. I guess > > > that the Mondex smart cards have ecash in them, but that > > > seems different. > > I am such a bad reader! You are right. This is a good definition > of electronic cash or digital cash. Mondex is questionable. The > card has an account, and uses crypto to proof it is a real Mondex > card, so you'd better believe it when it says it took the money > of it's internal balance. I would vote this is not digital cash. I am participating in the Mondex pilot scheme in Swindon. It took me a great deal of pushing to get _any_ details at all. The details I did get didn't go into the encryption schemes used or any such fun stuff. It did in fact take quite a while for me to realise the significant differences between ecash and Mondex. As they didn't, in the end, make me sign an NDA, I guess I can share. 1 - The Value is not encrypted on the card, that is held as plain text, it is the front door on the card that is heavily guarded. If therefore you can inject value into the card from the back door, it is then taken as real money. The logic being; Hey it managed to get through all that security which is imposible for anything except another mondex card to do, it must therefore be Mondex money ... that's Ok then. There can never be a software only version of Mondex as it stands. The trust is in the front door, not the cash values themselves. 2 - Some of their transaction monitoring is very "Big Brother"esque. As you can imagine, if a card is seen to be creating money but not consuming it, there IS a problem. Therefore whenever you get some money from a "hole in the wall", the bank sucks over your transaction log & error log. It will of course only ever use this for security monitoring. It will never follow the likes of AMEX and start stock pilling these transactions, using it's knowledge of the which physical entity own what card ID, and using the cross reference for market research/direct mail/consumer profiling. No of course not. That would be TOTALLY unethical ... 3 - Mondex is billed as "Electronic Cash", but you won't find the concept of anonymity in there anywhere. They talk about it, but I haven't seen them write it down explicitly. One could suggest however that that "Cash == Anonymous", so the scheme would have to be anonymous for them to have a right to the "Electronic Cash" title. > So what is the name for schemes like this? How about "Stored Value Card" >-- End of excerpt from Marcel van der Peijl One interesting thing that I noted. When I read through the technical blerb on ecash a while back, I had to sit back and think very clearly, and read very slowly. However, it was relatively easy to understand the bits, and then even easier to put the bits together into a system. The reason, I suggest, is that if you understood all the encryption technology behind ecash, and had the requirements that it has for anonymity and security (hand in hand). You would reinvent ecash. Maybe the layering would be subtly different, the real one ond your independant derivative wouldn't interact, but ... If however you were to have asked me to explain ecash a week later, I would have been totally stumped. It is a very elegant system. Mondex, on the other hand, worried from the word go. It just didn't seem to add up. Apart from everything else, why were they being so damned secretive. I read and thought, and read and thought. Then it finally dawned on me. Mondex just simply doesn't have the same requirements list as ecash. I was prejudging the requirements from my previous exposure to ecash. Ask me to explain Mondex to you now ... what do you want to know :) Andy M (this is my opinion of information gained outside of company time. It is not the opinion my employer.) And : On Jul 18, 12:29pm, Marcel van der Peijl wrote: > Subject: Re: Mondex > > I am participating in the Mondex pilot scheme in Swindon. It > > took me a great deal of pushing to get _any_ details at all. > > Of course! Security through obscurity has always been a good way of > protecting your systems... ;) Absolutely. That's why VISA have lost so little money :) > > 3 - Mondex is billed as "Electronic Cash", but you won't find the > > concept of anonymity in there anywhere. They talk about it, > > but I haven't seen them write it down explicitly. > > Hahahaha. Let me explain. You can buy the card anonymously. This > gives anonimity.... > NOT! Actually, you can't. You need to supply bank details in order to get one. At least you do for the Swindon trial. The cards in use here are in fact combined ATM and Stored Value ;) cards. They have all your bank details in a mag. stripe on the back of the card. The current batch of EPOS terminals don't use this stripe, but I wait with interest. > They are forgetting that tracebility plus one link of a person to an > 'anonymous' account is the same as identification. Sainsbury's (et al) sussed that one a while back. Hence the introduction of "Customer Loyalty Cards" (yuch!!). Thereby allowing them to bind purchases/times/locations => Credit card numbers => Physical customer addresses & therefore demographic data. Only in this situation for Credit card number read Mondex card ID. > Do you realise any ATM, and a lot of stores, have security camera's > embedded? No, they wouldn't use that to link a person to a card, > would they? That would be unethical... No need. They have not only formed the link, but they are getting you to fill in the damned form :) > > How about "Stored Value Card" > For Mondex, perfect. What about FV? And NetChex? Don't know about these ones. > About your perception of ecash: I admit that the blurp on our server > does not fully cover the system in such a way it is easy to remember > and explain. Not at all. If you had asked me to explain the system while it was still fresh in my mind, I would have had no trouble. It is very neat and logical, but it is also pretty intricate. Apart from anything else, I didn't feel it was necessary to hold on to the mental model of how it works. I liked it. However, Mondex ... >-- End of excerpt from Marcel van der Peijl Cheers Andy M

1 0

AYN_ran
by John Young 17 Dec '03

17 Dec '03

The New Yorker, July 24, 1995: "Twilight of the Goddess." A critical look at Ayn Rand and her work. Thirteen years after Rand's death, her books still sell more than three hundred thousand copies a year. Not since the popular novels of almost a century before, bent on refutations of Darwin or God, and offering what George Eliot called "a complete theory of life and manual of divinity, in a love story," had there appeared so vividly accessible and reassuring a guide for the cosmically perplexed. As late as 1991, the Library of Congress found that a majority of Americans surveyed named "Atlas Shrugged" as the book that had most influenced their lives, after the Bible. AYN_ran [About 57K, in three parts]

1 0

Re: S. 982 Kyl-Leahy(-Grassley) NII Protection Act
by Carl Ellison 17 Dec '03

17 Dec '03

I read it and it looks OK -- except, as I said in e-mail to Senators Kyl and Leahy, we can't let ourselves believe that legislation can keep computers safe from hackers. Many of these threats are outside the reach of US law. Instead, we need good firewalls, encrypting file systems, etc. - Carl

1 0

Re: Anti-Electronic Racketeering Act of 1995 (fwd)
by Peter Trei 17 Dec '03

17 Dec '03

> I remember one of the sponsors of the CDA ranting about pornographers > "profiteering" from pornographic images on the Internet, blissfully unaware > that stuff downloaded from alt.sex.binaries.insert.your.fetish.here doesn't > profit anyone but the phone company (for the hours you stay online to get > it). I called up Exon's press secretary and asked him about this. He claimed that BBS's were uploading advertisments to the Net, and this was the 'profiteering' referred to. He was immune to reason on this, and felt that the CMU 'study' was rigorous. It's true that a some of the pics in those groups include stamped-in BBS names and phone numbers, but my impression was always that this was the BBS operators trying to do a little damage control - so that when random users post their pix (on which they claim copyright, ignoring the fact that most of their scans rip off magazine publishers), they can recognize the 'piracy', and also earn a little publicity. For a good backgrounder on the story, check http://www.cybernothing.org/cno/reports/cyberporn.html Peter Trei ptrei(a)acm.org Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation trei(a)process.com

1 0

Re: Zimmerman legal fund
by hoz＠univel.telescan.com 17 Dec '03

17 Dec '03

> >I just received a bit of mail asking about the Zimmermann Legal >Defense Fund, which, like many folks out there, I support. The writer >implied that he might give money because I suggest it in my sig, but >expressed questions about its legitamacy, and questioned if it's "just >someone trying to exploit the Zimmerman case" > >Could someone in the know talk about the relationship between FV and >the ZLDF? I don't like to spread misinformation, so I won't answer >based on conjectures. > I had similar concerns last month, so I emailed the following to csn.net!dubois ("Philip L. Dubois") > > Could you please inform me of the financial status of the fund > raising for the Phil Zimmerman case? How much money has been > collected, and how much has been spent, and what are the future > anticipated expenses? I might like to contribute, but "a normally > unreliable source" has claimed to me that something on the order of > $50,000 has been spent, and there is not even an indictment yet. > Is this true and is this reasonable? Is it true that some/all of > his legal services are being done "pro bono" (I hope I got that phrase > correct, maybe I should just say "for free") > > If you choose to reply, may I have permission to make your reply public? > > Rick F. Hoselton (who doesn't claim to present opinions for others) > I got back the following reply: > >Mr. Hoselton-- > >Since the government has not yet decided whether to indict Mr. Zimmermann, or at least hasn't >told us its decision if it has made one, we continue to accept donations to the Zimmermann >Legal Defense Fund. I've never added up the total amount of all donations to date, but I >doubt that it would be in the neighborhood of $50,000. I can tell you that several lawyers >have been working on the case and that all of them but me have done so pro bono, which means >that they have not been paid. Since I have been lead counsel and have therefore had primary >responsibility for the defense, I have not been pro bono, at least not entirely; I have not >billed for much of my time. We have no way of knowing how long this case will go on. The >government could tell us today that it won't indict, in which case it will be all over, or it >could indict very soon, or it could do nothing until June of 1996 when the statute of >limitations expires. > >You have my permission to make my reply public. > >Philip L. Dubois >Counsel for Philip Zimmermann > Rick F. Hoselton (who doesn't claim to present opinions for others)

1 0

Re: Anti-Electronic Racketeering Act of 1995
by danisch＠ira.uka.de 17 Dec '03

17 Dec '03

> >1. If the bill becomes law, how can someone who violates it be > >punished? > > > > - From the top of my head: > Subpoena your service provider's computer records. That's not a problem. He will find a lot of encrypted messages and images of nude girls. Both is not illegal. :-) > Intimidate your roommate > into testifying against you. I don't have a roommate. > Tapping your phone. I use encrypted modem connections and Nautilus. > Feds are in the business of putting people behind bars. They are _very_ good > at it. That's the question. How long can they put me behind bars? > I'm betting that the Feds will adopt as a working definition anything that > requires a key to decrypt the communications. That means compression > software, rot13, and most hash functions are ok. rot13 is not ok, 13 is the key. Someone should register at the department. :-) > Expert Testimony: "We experimented with 113,296 keys chosen at random and > the defendants algorithm took an average of 29,000 years to find each one. > It is our professional opinion, therefore, that the defendant is jacking us > around and ought to be keelhauled". Oh boy, wonderful experts.... Hadmut

1 0

Re: Here it is; bi-directional dining cryptographers
by stewarts＠ix.netcom.com 17 Dec '03

17 Dec '03

Context: Bidirectional DCnets, Alice and Bob simultaneously transmitting to each other. Interesting approach, though you do have to schedule it somehow. It's a different take on the uses of DCnets - the original was for an anonymous-1 to many rather than a 1 to 1 with only the two participants knowing, though in the first case the recipient can be known only to the sender if they want to arrange things that way through shared secrets or whatever. At 01:31 PM 7/17/95 +0100, Rev. Mark Grant wrote: >Yes, but presumably it's expected that they would be using secure >encryption on the messages that they're sending. That might still provide >some information about the message for traffic analysis, e.g. if you send >a PGP message you have your key-id at the beginning, and if you knew the >keys of all members of the DC-net you could XOR them and see who's >talking to who. Presumably people will use multiple key-ids on the net as well - Alice may have a general-use "Alice" key, and maybe also a general-use "Medusa" key, but Alice or Medusa may have also arranged with Bob to use a different key for traffic where he doesn't mind if she knows he sent it and he doesn't want anyone else knowing it's being sent to her. Also, he can do this anonymously, so she doesn't know either: Alice posts Plaintext("Hi, I'm Alice, key AAAA") Bob posts Encrypt(AAAA, "Hi, Alice, I'm Dr. X, Key XXXX, please post a key I can use to talk to you") Alice posts Encrypt(XXXX, Signed(AAAA, "Hi, Dr. X, use key AXAX")) Bob's message lets him send stuff to Alice without anyone, including her, knowing it's from him, since the name X and key XXXX are new randoms. Alice signs her response so Dr. X knows that key AXAX will really go to Alice and not to Mallet who's impersonating Alice; she doesn't really care who X is. If traffic analysis is a concern (Alice noticing, for instance, that she's getting a _lot_ of requests from key AXAX for her remailer to send stuff to destination ZZZZ), Bob can keep sending her new requests for keys and ids, and not reuse them more than he thinks is safe. >I'd have thought the most significant problem would be reserving the >blocks in an anonymous fashion while not allowing denial-of-service >attacks. Since anybody can send bits at any time, and nobody can tell who without lots of collusion, you can't prevent denial-of-service (well, I assume not, unless there's something rather non-obvious in the literature.) The Bad Guy can decide if it's more fun to jam the reservations or the messages. What reservation does for you is gives a short inefficient period (with possible collisions, backoff-and-retry, etc., depending on algorithm) that you can use to reserve a longer one-user period for message traffic, so you can spend most of your time talking instead of haggling over interruptions. One way to do reservations is to use some variant on Slotted Aloha for the reservation period - for example, everybody picks a random id number for the session, (with odd parity or odd high-bit to make collision detection easier), waits a random number of slots, and then sends their id number. If there's a collision, wait and retry, maybe with exponential backoff. After the first slot that's got data and looks like it doesn't have a collision, anybody who thinks that it was their number picks a different number, waits a short random number of slots and posts; first one wins. (If you're using 32-bit randoms and have fewer than a million players, the chances of two undetected collisions in a row are really small, even if people cheat a bit on their backoffs.) Winner announces how many slots he's going to use up for his message, so you know when to start again. # Thanks; Bill # Bill Stewart, Freelance Information Architect, stewarts(a)ix.netcom.com

2 1

Re: Free The World Web Server project.. :)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 07:10 PM 7/16/95 -0500, David K. Merriman wrote: >> The web page would generate a random letter, allow the user to edit >>it, further (possibly offering the alternate phrases) before he clicks >>on the [Send] button. >> > >If someone in the DC area wants to set up such a system, I'll gladly donate >an Intel SatisFAXion 200 fax/modem, complete with manuals, etc. > >This would be a Good Thing, IMHO. The "Experiment in Remote Printing" had this idea about two years ago. They have well established, free, email to fax gateways around the world (including DC). See their WWW page: http://www.dis.org/fax/faxsend.html DCF "And that is called paying the Dane-geld; But weve proved it again and again, That if once you have paid him the Dane-geld You never get rid of the Dane." Rudyard Kipling

1 0

Re: Automated Rant Generators and Letter Generators
by tcmay＠sensemedia.net 17 Dec '03

17 Dec '03

David Conrad told me he meant for this to go to the whole list, but only sent it to me by mistake. So here is his post. At 4:14 PM 7/18/95, David R. Conrad wrote: >Tim May <tcmay(a)sensemedia.net> writes: >>Bart's comments about using Knuth's typographic work are interesting, to >>the extent that letters need to look handwritten. In the Mac market, it's >>possible to send in some handwriting samples and get back a font that >>emulates the handwriting! > >I suppose the resulting font has only one form for each letter? (Although >I understand that when you send them a sample, you send several instances >of each letter; a friend was showing me an add for this.) The fact that >each letter is the same every time would be a giveaway. We need something >like Metafont, or at least choose from a number of different shapes. > >> ... So, the combination of >>handwriting fonts, automated rant generators (of varying rabidities), and >>fax capabilities gives a pretty good start. Using lots of handwriting >>samples, various other fonts, and a mix of styles in the letters will help. > >Another factor that would make it appear more authentic would be spelling >and grammar errors. The grammar errors could be built into the rant >generators (an occasional dangling modifier, an incomplete sentence or two); >spelling errors could be done by post-processing the output of the rantgens. >It's important to take into account the different types of spellos that >occur: commonly misspelled words (aquired, beleive); wrong homophone (their, >they're, there; two, to, too); transposed letters (transpoesd); near-misses >on qwerty keyboards (nesr-mosses); and words left out. > >-- >David R. Conrad, ab411(a)detroit.freenet.org, http://web.grfn.org/~conrad/ >Finger conrad(a)grfn.org for PGP 2.6 public key; it's also on my home page >Key fingerprint = 33 12 BC 77 48 81 99 A5 D8 9C 43 16 3C 37 0B 50 >No, his mind is not for rent to any god or government.

2 1