December 2003 - cypherpunks-legacy

No Subject
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Subject: Shoe-horning Mondex onto the Internet -- still won't fit There many high barriers to the shoe-horning of Mondex onto the Internet: + Was not designed for the Internet, rather for physical portable cards + Requires expensive hardware: >$100/board for a PC in start-up quantities + Accoring to inside sources, is vulnerable to MITM between payer and payee + According to inside sources, is grossly vulnerable to replay attacks (offline multi-spending to different parties) + The designers have zero experience and reputation in the cryptographic and computer security communities + None of the Mondex designs have been published or peer reviewed. + The protocol cannot be published for security reasons, which means -- Mondex has security holes -- Customers who defraud Mondex-using banks have legal deniability in a court of law: they can simply request banks to produce the security protocols as evidence; if they refuse the case is thrown out of court (precedent: UK and US phantom-ATM withdrawal cases)

1 0

Re: ZD Net Update v.1 #2
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:11 PM 11/18/95, ZD Net / World Wide Web Edition wrote: >__________________________________ZD Net Update_______________________________ >v. 1 #2 11-13-95 > >Welcome to ZD Net Update, the free E-mail newsletter created especially for >registered users of Ziff-Davis Interactive's ZD Net/World Wide Web edition. >ZD Net Update is a bi-weekly bulletin that alerts you to new and exciting >developments on ZD Net. (rest of long newsletter deleted....) Ah, someone has once again subscribed the Cypherpunks list to a newsletter. Will the person who did this please have the decency to reverse this situation? (There are instructions at the end, but the syntax of the "unsubscribe" command may imply that only the site from which the subscribe was initiated can unsub. Whomoever subscribed us can unsub us.) Do I have to point out that just a single one of these long newsletters takes up more list bandwidth the most of the putatively "off-topic" posts do? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

JIBC Annoucement
by GORD JENKINS 17 Dec '03

17 Dec '03

----- Forwarded message begins here ----- From: junhan zhang <jzhang(a)ARRAYdev.com> Thu, 9 Nov 1995 12:11:10 -0500 (EST) To: gord(a)array1.arraydev.com Subject: JIBC Annoucement ________________________________________________________________________ Journal of Internet Banking and Commerce The goal of this publication is to inform executives, professionals, entrepreneurs, government employees and other key players on principal developments and trends in the rapidly evolving electronic commerce area all over the World. This free online Journal is a way to keep in touch, to share information, and to establish business contacts (networking) in the area of electronic commerce and banking on the Internet. Journal of Internet Banking and Commerce (JIBC) is primarily devoted to important announcements, original articles, guest columns, significant feature presentations from other publications, as well as survey, reviews, and letters to the editor. Technical discussions that belong to several other specialized lists will be kept to the absolute minimum. Our Journal will be issued no more often than two or three times a week, limiting material to the absolute minimum. We are definitely looking for quality, not quantity. Needless to say, we will be editing filtering and, where possible, summarizing, to provide our busy readers only with substantial information. Join this site and learn the trends in electronic commerce. We promise not to get too" techie". Not too many fights but lots of good discussion. We will need your articles , your letters, your contributions and discussion. The Journal is maintained and published courtesy of ARRAY Developments of Ottawa, Canada (http//www.ARRAYdev.com/). The Publisher, Nahum Goldmann may be reached at: Nahum.Goldmann(a)ARRAYdev.com. Or you can reach the editor and moderator, Gord Jenkins of JENKINS AND ASSOCIATES INC with any questions, comments or insights at: Jenkins(a)fox.nstn.ca (http//www.infop.com/karoma), Tel. 613-723-1581, FAX 613-723-8938. Please note that the mailing address for subscribe/unsubscribe is JIBC-request(a)ARRAYdev.com ************ World Wide Web information about this mailing list is available via: http://www.arraydev.com/commerce/JIBC/. Please send any questions on its maintenance to the list owner : <JIBC-admin(a)ARRAYdev.com>. Note that ARRAY Development is neither responsible nor necessarily shares opinions expressed on the list. This message is sent monthly to the JBCI list. If mail sent to you cannot be delivered successfully, your email address will be ruthlessly removed from the mailing list to prevent bounces for senders. If you believe you have been dropped, you can check your subscription status by sending mail to: majordomo(a)ARRAYdev.com Write in the body of message (NOT Subject:) JIBC Your_email_address This command will confirm whether you are on the current list of subscribers. To subscribe: Send email to JIBC-request(a)ARRAYdev.com Body of message (NOT Subject:) subscribe To unsubscribe: Send mail to JIBC-request(a)ARRAYdev.com Body of message (NOT Subject:) unsubscribe To contribute to the mailing list: Send mail to JIBC(a)ARRAYdev.com Notice the difference between the two email addresses for subscribing (JIBC-request) and posting (JIBC)! Send other inquiries to owner JIBC-admin(a)ARRAYdev.com To get a description of all valid commands: Send mail to majordomo(a)ARRAYdev.com Body of message (NOT Subject:) help As our Journal is a moderated list, there is no "digest" facility. ________________________________________________________________________ ------ Forwarded message ends here ------ -- GORD JENKINS e maik JENKINS(a)fox.nstn.ca tel 613 794 6735 fax 613 723 8938

1 0

Re: Request for URL'S
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 7:31 PM 11/6/95, Censored Girls Anonymous wrote: .... >I'd love to make a Cypherpunk URL page, >so if you will send your five favorite URL's >I'll put them all on a page like The Dreams Page, >(http:www.primenet.com/~carolab/dreams.html) >and turn it loose on the net. The following seems to be a pretty good nexus: http://www.quadralay.com/www/Crypt/Crypt.html There is, of course http://www.oberlin.edu/~brchkind/cyphernomicon/ A crypto legal centre: http://www.kub.nl:2080/FRW/CRI/projects/bjk/lawsurvy.htm Happy Hunting

1 0

Re: RealAudio website TEMPORARY PASSWORD
by Richard.Johnson＠Colorado.EDU 17 Dec '03

17 Dec '03

> > Username: cpunks >TEMPORARY Password: New.Norfolk > I assume that temp password will be changed to cypherpunks soon. Note that Username: cypherpu [8 char limit] Password: cypherpunks also works. Someone set it up a few months ago. Richard

1 0

e$: What's a digital bearer bond?
by rah＠shipwright.com 17 Dec '03

17 Dec '03

>Ps. I know I could probably look this up, but exactly what are bearer bonds? >I frequently hear them mentioned when market anonymity and money laundering >come up. It's the little questions which take the longest to answer... I wrote something here in cypherpunks this year called "The Book Entry / Certificate Distinction", which you might want to check out in the archives. Bearer bonds and bearer certificates (like cash) belong to the bearer. To be flip, possession is 100% of the law with a bearer bond. Bearer bonds can be stolen, but they aren't registered anywhere, which makes them useful for anonymity. All along the bottom of a bearer bond are little squares called coupons, which you cut out periodically and mail in to the issuer, and they'll send you back an interest check for that period's interest. Lots of financial phrases come from bearer bonds. When a bond trader talks about a bond's interest rate, she may use the word "coupon" interchageably, as in, "That bond has a 7% coupon.". Meaning, it pays 7% interest per year. Then there's the phrase "clipping coupons", meaning someone is retired or independently wealthy and living on their bond interest. Every month the interest on one bond or other would come due, the coupons clipped and sent in to the bond's issuer in return for an interest check. Most securities these days are registered to the owner somewhere, at a trustee, at the issuer, at a clearinghouse, or some combination of all. In fact, most securities these days don't exist in physical form at all and exist only on the books at clearinghouses and brokerages. This is why your stock broker squalls about "physical delivery" when you ask for a certificate. About a year ago, we talked about the Depository Trust Company, the clearing house for the New York Stock Exchange. They have entire issues there consisting of a single piece of paper in the clearinghouse vault which are traded entirely on a book entry basis, that is, only accounting entries are swapped when these securities change hands. There are several reasons for this. The putative reason is that as taxing authorities, like the Internal Revenue Service, have relied increasingly on various cash-flow taxes like the income tax for thier revenue, they have slowly regulated or legislated bearer bonds out of existence in favor of registered, and more to the point, book-entry securities. However, like everything else, law and regulation is really a creature of technology, and the technological reason that book-entry and consequently registered certificates are popular is because they're cheaper to handle locked down in a vault in a clearing house somewhere with the ownership changing hands by changing offsetting accounting entries at the buyer, seller, and clearinghouse. This is a direct consequence of financial systems organized on top of hierarchical communications networks, which was how all communication networks were organized before automated switching, and, more to the point, microprocessor switching made them more and more geodesic in structure. You might want to check the archives for more of my rants here on that subject. The thing about digital certificates, of which ecash is only the camel's nose in the tent, is that while electronic, they're actual bearer certificates. You get a lot of great non-sequiters when you talk about them. "Digital bearer certificates", when you can't actually touch them to "hold" them, Electronic "physical" delivery, and the like. So, with a digital bearer bond, you would have in effect a bundle of digital certificates. One would be for the principal and whould be good for the repayment of that principal on the date the bond was called or the redemption date, however the bond offering is written. The other certificates would represent coupons, one for each interest period for the life of the bond. These digital certificates, in combination increasingly geodesic networks enabled by exponentially falling microprocessor prices and strong cryptography, theoretically allow secure, point-to-point trading of any security of any amount with instantaneous clearing and cash settlement. The current hierarchical capital market model, with brokers, "wholesalers", and central exchanges has been collapsing for decades since the advent of electronic trading systems (glorified computer bulletin boards, really) like NASDAQ. With the coming of digital certificate technology on public networks, these markets will be "surfacted" into smaller and smaller concentrations of information and capital. I have no idea what markets will look like when we "return" to things like digital bearer bonds, but there's a prima facie example now on the web as we speak. This week Mark Grant just upgraded his Electronic Cash Market (ecm)-based cyberbuck (c$) webpage "trading post", so that it will take the new Mark Twain ecash. That means that it will be possible to trade old Digicash beta-certificate c$, which sold for 5 cents US per c$, and instataneously clear and settle them for Mark Twian ecash on-line. No checks have to be sent between trading parties to buy these certificates anymore, which should lower transaction costs significantly, not to mention the float on the money while the trade settled. It was curious that people were buying these things to begin with, as they had no value at all except their uniqueness, anonymous electronic transmissibility, and a promise from Digicash BV to issue only a millon of them. Yet now, with the market made infinitely more liquid with the introduction of real-time cash settlement, things will get, as Alice said, "curioser and curiouser". Digicash still has some large number of these things in the "treasury" unissued. I believe these original beta-test certificates have both payee and payor anonymity, especially if traded offline, which has been how they've been traded through the ecm. More fun with numbers. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The e$ Home Page: http://www.webstuff.apple.com/~vinnie/Rah >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

Re: CANADIAN PRESS REPORTS (was Re: CSE gets flak on TV)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Sat, 18 Nov 1995 anonymous-remailer(a)shell.portal.com wrote: > >Taking three successive news stories from three days ... (press stories, > >I've since pulled for my own reference) and pasting them together to > >indicate some type of Machiaevellian?? (sp) exercise is simply "not done." > > I still feel such a sense of violation with what LD did, such an utter > sense of helplessness at the character assassination I've suffered at his > hands, that I feel that I must take some token action to "set the > record straight". Something which clears my name. > > Here is the TRUE unedited story for the list which Deitweiler felt he > had to TWIST to the nth degree. His attempt at making mountains out > of mole hills will not succeed with this one. This story truly is a non-starter. Big deal. It really has no relevance to this international list. This is simply a Canadian matter. So Canada spied on its allies -- Mexico and South Korea particularly -- and possibly picked up some information which helped Canada to outbid the United States on a lucrative wheat deal with China. So what?? As they say ... you snooze you loose. Deitweiler's attempt to get American farmers into the picture isn't going to work. The part about wheat sales isn't even remotely relevant to the story. It's a single paragraph. CSE has a mandate and follows it. No one needs to listen to Deitweiler's rantings and whinings, and his so-called outrage. As the box at the end of the story shows, Canada simply doesn't currently have the budget to do a really broad search of the United States or Mexico. It just can't pick up every American's phone calls. The story isn't about that. It's simply about listening in on a woman's phone call to her doctor. His attempt to make more out of this than what is actually there, and in the process to sully my good name won't work. Let the readers judge for themselves, based on the ORIGINAL stories rather than LD's cut and paste and his personal *commentary*. And hopefully no one will judge me, for his words. Let the story simply speak for itself. SPY WORLD Electronic snooping part of the trade game with friendly countries Intelligence agencies comb the airwaves for useful data Jim Bronskill The Canadian Press OTTAWA Intelligence experts said Monday it's no big secret that Canada's high-tech spy agency snoops on friendly countries for financial gain. Increasingly, intelligence agencies around the world are using their antennas, computers and codebreakers to gather economic information, said Wesley Wark, a University of Toronto history professor. Some of Canada's largest trading partners -- including the United States, France and Japan -- comb the airwaves for useful information, so Canada would be foolish not to join the game, said Wark. "I don't know what a friendly power in the economic sphere is, exactly, these days," he said. "That seems to be a very ambiguous term." Canada's secretive Communications Security Establishment -- an arm of the Defence Department -- collects and analyses communications traffic on the activities of foreign states, corporations and people. Jan Shorten, a former CSE employee, told CTV News in an interview Sunday the agency spied on Canada's allies and trading partners -- including Mexico and South Korea -- by eavesdropping on embassies, consulates and diplomats. In a follow-up segment for broadcast Monday, Shorten said the CSE frequently intercepted telephone conversations and faxes of Canadians working at foreign embassies in Canada. The government acknowledged earlier this year it uses CSE data to help develop foreign and defence policies. In New Zealand where a meeting of Commonwealth countries just wrapped up, Prime Minister Jean Chretien did not deny Canada is spying on allies. "This is an organization that works within the law of Canada," Chretien told reporters. "They do not report to me on a daily basis and I cannot make any comments on if they are spying on anybody, I don't know. "But they have a mandate to check a few things around the world. Probably somebody is listening to us at this moment." The prime minister also said that of any laws have been broken, "somebody will have to pay the price." In a book published last year, former CSE employee Mike Frost told how the agency electronically picked up information that helped Canada outbid the United States on a lucrative 1982 wheat deal with China. Such clandestine behaviour may be unethical, but countries do it, said U.S. journalist David Kahn, who has written extensively on intelligence matters. "It's just too valuable to give up," said Kahn, a visiting historian at the National Security Agency, the CSE's much larger U.S. cousin. "I wouldn't be surprised if the United States was trying to break Canadian codes." Ottawa maintains that the CSE, the NSA and their counterparts in Britain, Australia and New Zealand have all agreed not to spy on each other. The government also says the CSE does not target Canadians and scrupulously abides by Canadian laws. Shorten said the CSE stepped up its operations against foreign embassies in Canada in 1991. She recalled hearing conversations of Canadinas employed there -- even one woman's phone call to her doctor. An appalled Shorten eventually confronted her boss, who assured her the practice was legal. The agency is obligated to destroy information about Canadians it scoops up in its electronic net, said Wark. A rare exception might be a phone call describing a terrorist plot. [The story also had a little box with some Quick Facts in it] QUICK FACTS EMPLOYEES: About 900 1995-96 BUDGET: $113 Million HQ: Sir Leonard Tilley Building, behind a three metre fence tipped with barbed wire in south Ottawa. ROLE: Secretive arm of Defence Department monitors and anlyses communications about activities of foreign states, corporations and individuals. Also helps government stop Canadian signals from being intercepted. SHARES: Intelligence with counterparts in United States, Britain, Australia, New Zealand. And that's all she wrote ...

3 2

Visual Basic 4.0 encryption prog.
by Eric Anderson 17 Dec '03

17 Dec '03

I just scored a copy of visual basic 4.0 and I was wondering how feasible it would be to write a program for Window$ 95 that would use RSA or IDEA and the Win95 exchange interface. I plan on buying Applied Cryptography probably on Fri. when I get paid. My requirements/goals are: 100% compatibility with M$ Exchange, ease of use (Point & Click/ drag & drop) and last but not least, STRONG public key encryption using "off-the shelf code. So my ??? Is this: Is it possible? Or should I just go out and buy a C++ compiler. I don't really care about ITAR or any of that other BS, I just won't put MY name on it.

3 2

negative reputation (was: WRITTEN CODE)
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- - -----BEGIN PGP SIGNED MESSAGE----- Daniel 'genius' Charpentier <drcharpe(a)hamlet.uncg.edu> wrote: > he mentioned his desire to see more cryptographic program code and > I didn't want to see this initiative die. I am a new commer to > cryptography and I know I shouldn't be posting yet but that is > what I thought cypherpunk postings was supposed to be in the first > place ( program code, protocols, and algorithms ). Please don't > flame me to badly for this message. I am doing everything I am > supposed to before posting ( reading the FAQ's, the entire > cypherpunk archive, and APPLIED CRYPTOGRAPHY by Bruce Schneier ) It sounds like you are afraid of getting a negative reputation. Well don't be. Simply create a persistent pseudonym and sign your messages with it instead. That way, if it turns out that everyone disagrees with you and/or flames you to death, you can simply disgard your old pseudonym. Otherwise you keep your pseudonym and continue to post under it. This technique is not new, so you may already have seen it in the archive. Logically, a pseudonym is simply a public key. However you may want to give it a human-readable name so other people may more easily refer to it. If you decide to do this, I suggest that you do not name the key on its first post because there is a high probability that you will decide to disgard the key. If you name it and throw it away, then you have unnecessarily cluttered up the limited name space. - a new entity, as yet unnamed - -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMK5/P42Fr67QcvwZAQGVdwP5AaE5MR8JztPBv1k/0GdVlZSzuBBMboRW d7Ofyw2EloKS7YTgb+ZoGDT92h+n5Yzpp5Jb5+0zm8iDLQbm0RTQJxE86Ty4DrO4 5w1CUCSa8VF4mTVoRvyaYrWHTq4uxOj4LAPC6Zxx5qIPUSRgceWoYsmEoarIYYLU FEhnF34o5m0= =T80R - -----END PGP SIGNATURE----- - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzCuftgAAAEEAL35udZ/l0s590SjtzSM9eAepxAGe9Mp38ZoTsvfmNQh008W sLtiYKmSYKBPuuRZIpYBZEjLZry5p6xHUpsKuflNXy7sdeHBviU+x8J57ip4DLx2 +tlv4dtjLKxzVGEqEfWOb3oRHCJ1t2IgV5A9RBzp2SXke56pTo2Fr67QcvwZAAUT tBxhIG5ldyBlbnRpdHksIGFzIHlldCB1bm5hbWVk =h9Uo - -----END PGP PUBLIC KEY BLOCK----- - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMK5/9SoZzwIn1bdtAQFS0wF+NyWTvLIZr05q8O4LOCgM0W1lHKBy+iu3 P3k3Yy7+FIS15erO88CDpwIBbywqQ+Pa =wJn0 -----END PGP SIGNATURE-----

1 0

Spammers' Email List Obtained!!!
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Using only the tools provided by the spammer, and without compromising system security in any way, we have obtained the full list of email addresses that were used by the bulkd(a)valleynet.net direct email spammer. I am not going to tell the public how to get it because I do not want this list to fall into the wrong hands. There are several curious features about the list that strongly suggest that it was purchased from other spammers. I *strongly encourage* the person who formerly used the bulkd(a)valleynet.net account to apologize to news.admin.net-abuse.misc and provide us with the source of the list immediately. - -rich llurch(a)networking.stanford.edu -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMK6E943DXUbM57SdAQHopwP/aY+cRnmrtUBhILl7lvfeQakrpW+uLwuY J1jR6SrSFdiZ+rGM8D4tc5HarOrU77X2zjpqDNOFySJ+yukP3eXvKny3v+3ndUGA ozbnH5EnshOQZE0hQ+aV9TKu+zM0ihfT65PxuvgehPnBi+CgSRHtDddhjuWMvRSD aNGKoAyZLaA= =mKyw -----END PGP SIGNATURE-----

1 0