December 2003 - cypherpunks-legacy

Blacknet
by LaurianneA＠aol.com 17 Dec '03

17 Dec '03

Are you still up and running with Blacknet? I just need to know if you can use some info. Message me here.

1 0

Re: Using deterministic programs to select private RSA keys.
by norm＠netcom.com 17 Dec '03

17 Dec '03

At 10:38 AM 10/17/95, Martin Diehl wrote: .... > I suggest that if you capture the time in microseconds between > keystrokes and insert the least significant 8 bits between the > corresponding characters (i. e. <letter1> <time2 - time1> <letter2> > <time3 - time2> <letter3> ... <letter nnn> <time until double CR - > time nnn>) and MD5 the set of values, the resulting "random" value > will be different for both people who type different input texts as > well as those people who type the same input text. .... Indeed, but the point of the proposal is a determinate and reproducible program behavior so as to gain confidence that the output is correct by comparing output of several programs. .... > As regards the observation that MD5 produces only a 128 bit result, > you could call MD5 after each nn values (at least 16) have been > entered. In that way a few lines of input and associated timing > values could easily generate a value of the same order of magnitude as > the number of 1K primes. .... Sounds good.

1 0

Yardley's 1st ed. "Black Chamber" $25+
by baum＠apple.com 17 Dec '03

17 Dec '03

I found one in a bookstore. I didn't buy it, but I'll go back and get it & ship it if someone is interested. ************************************************** * Allen J. Baum tel. (408)974-3385 * * Apple Computer, MS/305-3B fax (408)974-0907 * * 1 Infinite Loop * * Cupertino, CA 95014 baum(a)apple.com * **************************************************

2 1

I want to learn!
by VINCENT810＠aol.com 17 Dec '03

17 Dec '03

Can someone please show me the ropes on becomeing a cypherpunk!!!! Thanxs.

1 0

Re: java flaw
by James A. Donald 17 Dec '03

17 Dec '03

At 06:59 AM 10/17/95 UTC, jerry the golden retriever wrote: > A security feature in Java scans for viruses before activating the > applet. I hope that this is false. Even if one had genuine artificial intelligence, it would be impossible to detect all viruses, only particular viruses and classes of virus. If Java is secure, virus scanning should be unnecessary, indeed impossible, because there could be no code configuration capable of acting as a virus. If virus scanning occurs, then it is possible to write a virus in Java, then Java is inherently insecure. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

4 3

Re: transaction costs in anonymous markets
by sdavidm＠iconz.co.nz 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In article <Pine.SUN.3.91.951016011355.2241A-100000(a)eskimo.com> Wei Dai said: "Maintaining anonymity requires that communications be done through special untraceable protocols." I think it is important to keep in mind exactly what we mean by anonymity in these discussions - there seems to be a bewildering array of flavours. Take three situations where anonymity might be useful: 1. The State Authorities come and take you away for subscribing to a publication advocating the end of socialised medicine. 2. The State Authorities come and take your assets away to pay for socialised medicine. 3. The Private Hospital comes and takes your assets away to pay for your lifesaving operation. [Avoiding 1 is (in my opinion) an unmitigated good; avoiding 2 is obviously desirable; but avoiding 3 could well be counter-productive.] This points to two categories of anonymity: Meat anonymity - there is no way of knowing which human is responsible; and Asset anonymity - there is no way of linking a particular human, transaction or activity to any particular asset, or vice versa. The point being that sometimes one will be desirable without the other. Concentrating on meat (or combined?) anonymity, there are (at least) two sorts; Legal anonymity - where the split between asset and meat is the result of the interposition of some legal structure (eg. Trust, corporation etc), the ultimate owners/controllers of which are unknown; and Digital anonymity - where the identity of the actor is mathematically unknowable (at least, at the limit). Obviously, these sorts can be layered, with legal entities transacting as digitally anonymous parties, and the owners of those legal entities protected by digital anonymity. In addition, we can distinguish between digital anonymity that allows no link between separate transactions (anonymity proper[?]), and digital anonymity that does allow links to be drawn between separate transactions or activities (pseudonymity). Similarly, we can distinguish between the various anonymous properties of transactions: A. Private Transactions. Each party to the transaction knows the identity of the others, but no third party can know who is transacting with whom. B. Unilateral Anonymity. One party to the transaction is known, but the other is unknowable. An example might be subscribing for a digital security with ecash - the issuer is known, but the purchaser is anonymous. C. Bilateral Anonymity. The identities of both parties to the transaction are unknowable. This might be the case on a cypherpunk stock exchange... "The current state-of-art (i.e. RemailerNet) adds several hours of transmition time to each message to achieve effective untraceability. Contract negotiation, for example, becomes very difficult under these circumstances." My experience of contract negotiation is that a delay of hours would be immaterial. Don't forget that email, fax machines, and even the telephone are relatively recent phenomena (not to mention the photocopier and the word-processor). Most super-tight deadlines are self-inflicted. "If these costs remain high, but anonymous markets develop regardless, it will be interesting to see how these costs affect the structure of the markets. Will special protocols for contract negotiations develop to minimize the number of round-trip messages?" Doubtless. In areas where complex transactions really have to be entered into at short notice, a lot of the negotiation goes on in advance, often by trade associations. ISDA, for instance, is forever producing standard terms and appendices so that all manner of arcane derivative transactions can be more or less negotiated over the phone. Cheers, Dm -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMISijFlo3j8JHzalAQENEAP/UJTSvhAR534mh1KUQZQC1JYxZeROUaDf 6Nd42yxCmLbbSa72dEAB69jdfDHBj2sj6Jf6jL+HAGTrfG6I/dNJuKu9MaaCw64z MKe0efTCmD2caehOv9lf5tI2uJ0vAql8UdCC5gj3NhkxKr/uEAvcbIlt/Z60mmEu 4P2hxCv1u/o= =U8gP -----END PGP SIGNATURE----- [Palmtop News Reader - Beta Version 3]

2 2

Re: Security Spectra (Oops)
by P.J. Ponder 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: 17 Oct 1995 14:13:10 GMT From: Jeff Williams <williams(a)va.arca.com> To: cypherpunks(a)toad.com Subject: Re: Security Spectra P.J. Ponder writes: > In your recent post to the cypherpunks mailing list you proposed a > taxonomy of security weaknesses and vulnerabilities, adding that these Please watch your attribution. Vlad Nuri proposed this rating scheme. Oops. Sorry about that. ------------------------------------------------------------------------- On another matter, what's wrong with Mr. W of NetScape Communications subscribing to this list, maybe even posting once in a while if he feels like it, and in general just being a list subscriber like the rest of us? Remember, as Mr. PM says - 'It's not a group, it's a mailing list'. Mr. Weinstein's sig file says his posts are his own opinions, anyway. NetScape biggies have certainly posted on this list before and probably will again when they have something they want to send to the list, like a press release. Cut Jeff some slack. (apology to international readers, that's an Americanism for quit busting his chops.)

1 0

if-comp: Project to make Fact true (fwd)
by s1018954＠aix2.uottawa.ca 17 Dec '03

17 Dec '03

This is something I got off the Idea Futures computers list. (The Fact claim is that a 512 bit number will be factored by '97) I don't know if the following address has been posted here before. ---------- Forwarded message ---------- Date: Tue, 17 Oct 95 13:45:40 PDT From: Robin Hanson <hanson(a)hss.caltech.edu> To: if-comp(a)merak.com Subject: if-comp: Project to make Fact true A team at Bellcore seems to be planning to try and make the claim Fact true. See this web page, and the forward in particular: http://kayak.npac.syr.edu:2008/ They plan to use the web to allow lots of machines to easily participate. They will start with a 130-digit number and work their way up to the 155-digit number required to satisfy the claim. Will they succeed by the end of '97? A crypto expert friend of mine claims their chances are 90%. I have bet accordingly. Robin Hanson hanson(a)hss.caltech.edu http://www.hss.caltech.edu/~hanson/ 818-683-9153 2433 Oswego St., Pasadena, CA 91107 FAX: 818-405-9841 818-395-4289 Div. Hum. & Soc. Sci. 228-77 Caltech, Pasadena, CA 91125

1 1

[ANNOUNCEMENT] eCash reality !!
by usura＠berserk.com 17 Dec '03

17 Dec '03

e-WAVE [issue 42], a dutch language electronic newsletter published by Riverland Publications, reports that DigiCash has reached agreement with a big US bank to make eCash real. DigiCash promised the 'scoop' to Newsweek, so in next monday's issue of Newsweek we will know wich bank that is. (They are also said to be talking with a Dutch or Belgian bank or financial institution). Since there has been cut a deal with the monetary powers I wonder if we get the whole anonymous ecash or a 'diluted spieces'. -AJ- For the many subscribers of the cypherpunks mailinglist that are able to read Dutch, here is the portion of e-WAVE that has the announcement. <g> ------BEGIN QUOTE------ Tijdens de toelichting op de toepasbaarheid van Digicash's encryptie-technologie op stemmen, komt het vermaarde e-cash ter sprake. Dinnissen heeft een primeur maar mag nog niks verklappen: 'Volgende week maandag zullen wij bekend maken met welke grote Amerikaanse bank Digicash in zee gaat om e-cash tot een legitiem en valide betaalmiddel te maken.' WAT!!! E-CASH LEGAAL?! Wow, gelijk de cyberbucks natellen. En met welke bank? 'Kan ik niet zeggen.' Ook nog Nederlandse of Belgische banken? 'Er zijn ook gesprekken dichter bij huis, ja.' Kan dat eigenlijk zomaar? 'Er zijn afspraken gemaakt met monetaire instanties. De scoop is beloofd aan het Amerikaanse tijdschrift *Newsweek* dat op die maandag uitkomt.' (Shit) Spoedig meer hierover. For more information mail: erwin(a)wave.riv.nl ------END QUOTE------ 88888b d888b 888b 88 8P 888888 88888b 888 888b 88 88 d888b 88 88 88 88 88 88`8b 88 88 88 88 88 88 88`8b 88 88 88 ` 88 88 88 88 88 88 88 88 88 88888P 88 88 88 88 88 88 88 88 88 88 88 88 88 `8b88 88 88 d8888888b 88 `8b88 88 88 , "" 88888P `888P 88 `888 88 88 88 `8b 88 `888 88 `888P 88

1 0

Re: Netscape rewards are an insult
by Westcan1＠softnc1.softnc.com 17 Dec '03

17 Dec '03

:: Request-Remailing-To: cypherpunks(a)toad.com Subject: Re: Netscape rewards are an insult > > Promoting the notion that hackers are earnestly attacking > > Netscape and reporting its bugs increases its credibility to > > the stock market porkers. Is that not why dear > > all-too-attentive Jeff has been assigned duty on this list, > > feeding peanuts to chimp hackers and champ newshacks? Whoa!! > I'm afraid you're a little out of line here. > I've worked with Jeff at a couple different companies > over the last 6 years. Besides being a very good programmer > he's also one of the people I consider the most resistant > to corportate bullstuff (beleive me, we both got a lot of it at MicroUnity). > I'm sure he's on this list because he thinks it's a good > idea to pay attention to it. Maybe he is, but I'd rather hear everyone speak for themself. You can speak for you. And you can let Jeff speak for himself. And I'd rather that Netscape speak for itself, too. Is Jeff or any of the other netscape posters here officially?? Or are they here, just out of personal curiosity (without their employers knowledge, I mean ...) cause they have a whole lot of spare time on their hands to learn about cryptography and security. I wish one of them (or Netscape) would make an official comment to make sure that the record is straight, and that there is no mis-reporting. > What the hell is wrong with you people? Up 'til a few months > ago, the oft-heard refrain on cipherpunks was "why won't the > software vendors listen to us?"... now they're listening, Yep, they seem to be listening. They just don't seem to be talking. Can someone say something, please?? Is it true that: - Netscape has known about this problem since last week's scathing public attack and demonstration of the problem which included sample code posted to the Internet?? - If you run and use a Netscape client, that any machine anywhere in the world if it's on the Net could retrieve all of the files off of your hard drive or LAN?? Or even worse ... erase files on your Hard drive and wipe you out?? - Even if your machine is behind a firewall or proxy server, that there is no protection?? That you can't do anything?? Can someone comment, please?? (Carbon copy sent to: postmaster(a)netscape.com, cypherpunks(a)toad.com, cert(a)cert.org)

11 22