December 2003 - cypherpunks-legacy

newsweek oct 30 Levy digital cash article
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

a slick article by Steven Levy appears in the oct 30 Newsweek mag (cover Farrakhan). I'll let the ILF post it, but here are a few of the elements: - covers mark twain bank going live with Chaumian "e-money" - also a sidebar on Mondex.. - 1st virtual mentioned - Bruce Sterlings "heavy weather" e-money dystopia - Netscape flaw as example of the stakes - US government get into the act? - privacy concerns (EPIC Rotenberg quoted) - "tax may be voluntary" --Barlow - FinCEN worried about drug money I didn't find any obvious errors or overhyped paranoia, so I commend Levy on the article. it can be seen as a definite cypherpunk cap-feather. Levy is doing a really great job IMHO. an editorial in an earlier issue of newsweek about Rimm and pornography in cyberspace was dead bang on.. p.s. I'm very curious about the "information security" reference that someone gave earlier, has there been any more information here about that one? -- also, my question about whether one loses the downloaded Chaumian bucks if one's hard drive crashes was answered in the affirmative by Levy. hoo boy, I think this could become one of the worst new urban legends about losing money due to failed hardware/software. there is going to be a lot of paranoia about this item. I'll bet virtually all digital buck schemes will have to explicitly answer this question to a paranoid public: what happens if my computer crashes? part of my motivation for querying about losing cash due to a hardware failure was based on an interest in showing how the really "soft" system of credit card purchasing that we have now, while considered lame by a lot of cypherpunks, often protects the consumer. remember, Jane Sixpack is frequently locking her keys in a car. ecash that can be lost or stolen just like real cash may not be as attractive as say a credit card system whereby one can sometimes call up the company and say afterwards, "I didn't really mean that". cypherpunks should consider that one of the key things we think is the strength of ecash--namely privacy-- may be a key area the opposition to untracable cash transactions can tout as a weakness or problem. it seems to me that the very techniques that tends to enhance privacy also tend to make the spending "more dangerous" in the sense that one cannot backpedal or one can lose it, irretrievably, more easily. for a public with the IQ of Joe and Jane Sixpack, this could be a serious concern. identification is key to helping people retrieve lost or stolen checks, etc. "have you ever locked your keys in your car? don't use digital ecash. you might lose it and never get it back." I suggest that Chaum definitely consider this a major aspect in his marketing campaign. it could be a very serious soft spot in widespread public acceptance of ecash. rumors could float, "ecash is dangerous to the consumer". hopefully we can head this one off at the pass. imho, the future will never see complete digital cash, or complete identification. they are likely to mix a lot. however I think ecash may become very respectable, and ultimately become far more common than identified transactions are today. but its really amazing how no serious alarm flags have been going off in the legislative arena about digital cash. I suspect this is going to become a white-hot public policy issue. if you thought the fights over terrorism, wiretapping, or pornography laws were messy, just wait until legislators pinpoint digital cash as the horseman of the infocalypse. fireworks will fly. may you survive interesting times. <g>

5 5

Digitial Money [SHAMELESS PLUG FOR BOOK]
by cman＠communities.com 17 Dec '03

17 Dec '03

Leslie Lundquist, a co-worker of mine here at Electric Communities, together with Dan Lynch from Cybercash & Interop fame, has written a book called _Digital Money: The New Era of Internet Commerce_. It should appear in stores "real soon now"; it can be ordered right now from any book store for $24.95. The book is intended as an overview of current and projected digital payment systems and commerce, and contains basic background information on the underlying technology. It is intended for the general reader: this is the kind of book a techno-weenie might buy for his or her manager to help them understand some of these issues. Note that this is a different book than _Digital Cash_, by Peter Wayner. I'm not in the loop on this, but this appears to be "one of those things" and not intentional on anyone's part. For more information, e-mail leslie(a)communities.com

1 0

I resubmitted the CJR
by Raph Levien 17 Dec '03

17 Dec '03

I have been told by several people that I did it wrong. Apparently there are two addresses: one for mail, and one for couriers. The first time, I sent it by mail to the courier address. This time, I also sent a fax. From what I've heard, I should be receiving a tracking number within a few days. Also, for those who were wondering, the "Arlington, CA" address was merely a keying error. The actual envelope said VA. I will keep the list up to date with any further developments. Raph

1 0

Re: rejection of CJR
by Peter D. Junger 17 Dec '03

17 Dec '03

I happened to speak to Mr. Capilino at the Office of Defense Trade Controls this morning, and mentioned that the Commodity Jurisdiction Request for the T-Shirt had been returned and read him the message to that effect. He told me that that was the wrong address for mail, since it was used only for currier deliveries, and that they have stopped accepting even currier deliveries there since the Oklahoma city bombing. He suggested that those who want to apply for the Commodity Jurisdiction determination should call him at 703-875-7396. He will fax the current information on how to submit a CJR to anyone upon request. He did not say so, but I rather think he looks forward to getting the T-Shirt request. -- Peter D. Junger--Case Western Reserve University Law School--Cleveland, OH Internet: junger(a)pdj2-ra.f-remote.cwru.edu junger(a)samsara.law.cwru.edu

2 1

Diane Rehm Show just ended
by Carl Ellison 17 Dec '03

17 Dec '03

You just finished a show on terrorism (WAMU, 10-11am, 10/26/95). Thank you. Some of your callers said most of what I would have said and I found that pleasing, since I wasn't able to call in. However, there was a theme which kept coming up and which wasn't addressed specifically. You might hold it in mind for future shows on terrorism: The FBI representative was saying that the goal is to *prevent* terrorism, not just to investigate and prosecute crimes after the fact. I heard Director Freeh (on 10/19 on All Things Considered) say something similar -- that the FBI's job was to protect the people (which can be be translated into "prevent terrorism"). This seems to be a major problem and perhaps the source of the concern about civil liberties. Terrorism might be a product of an organized, identified group and infiltration of that group might enable the FBI to prevent acts of violence. Of course, the permission to infiltrate suspicious groups has been used in the past to justify infiltration of non-violent but unpopular groups like the Sanctuary Movement. However, many of our recent terrorist acts appear to be the result of individual actions -- not those of organized groups. [Unabomber, OK City, train derailment] Infiltration is out of the question in such cases. The only way to prevent such acts is to put the entire population of the US under surveillance -- an authentic instance of Big Brother from 1984. The conclusion to me is that we can not task the FBI with the job of prevention of terrorism. I suspect that we must insure that the FBI is formally and carefully restricted to the job of investigating and prosecuting crimes once they occur -- allowing the threat of almost certain prosecution to serve as a prevention -- rather than with the impossible job of prevention of such crimes. ------------------------------ Meanwhile, there was one question I had that no one answered: I didn't like history much as a student, but I vaguely remember other periods of domestic terrorism: bombings in the early 1900s, acts of violence associated with the labor movement, sabotage during WW-I conducted by German agents. There may have been many others. This seems to be a feature of life -- nothing recent, nothing special, frightening from its news coverage but not a serious threat to any one individual (because of the actual statistics around the threat -- comparing my chance of injury due to auto accident, plane flight or terrorist act (for example)). It would be interesting to know why we had the pause in terrorism during the Cold War -- or, for that matter, if we actually did. Could it be that the apparent return of terrorism is actually a perception rather than a fact -- as a result of shift in focus of the news media? - Carl +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | |PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | ``Officer, officer, arrest that man! He's whistling a dirty song.'' | +---------------------------------------------- Jean Ellison (aka Mother) -+

1 0

Usenet: pseudonymity's killer app
by pjm＠ionia.engr.sgi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Risks Digest 17.42 contains a Boston Globe story by Simson L. Garfinkel detailing the risks of the DejaNews (http://dejanew.com) Usenet archiving service. Not only does this service archive Usenet postings, it provides a "sophisticated system for retrieving 'author profiles' of the individuals who have posted messages." Many people are upset at what they view as an invasion of privacy. The article notes that: > But Usenet has actually been archived for a long time. Many schools, > for example, have backup tapes containing Usenet messages dating back > many years. Furthermore, says Madere, the National Security Agency and > possibly other law enforcement or intelligence organizations has been > cross-referencing and indexing Usenet for quite some time. "I know for > a fact that they do have a text retrieval database which contains > Usenet," says Madere. Creating a searchable index of Usenet " was > already done for what people might consider to be sinister purposes," > says Madere. "What we have done is made it searchable for useful > purposes." DejaNews will be archiving the alt, talk, and soc groups beginning later this year. That could result in many more people becoming upset at the service. It would appear that ISPs could make money from offering anonymous or pseudonymous accounts to their customers who would rather not have their postings used by marketers, employers, or neighbors. Providing protection from junk mailers is also more politically defensible in this society than providing protection from the government. This could be the catalyst for widely used and accepted pseudonymity on the net. Patrick May -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMI/tze5Yg08fDKehAQHUiwP/ePOJeQ5+R0+h0QQVJEziWFZvz0qCMooA 6jQXjDxWpxydas+KYCe9dt2yekjsh3Lr/bc+VHDtuTuE4l+m3HIFqk7uWxYk7iB6 fjIhuPMcmVSIg+lPOTFIlhfypmwE/6c4FHXiGb6N02Pc5E22BJFjECOdx1RNlJwv A8DbV/lAyGI= =FjnE -----END PGP SIGNATURE-----

2 1

MD5 and ITAR questions
by Simon Spero 17 Dec '03

17 Dec '03

I can't remember the exact details, so could someone give me a quick refresher- which of the following are considered ok under ITAR? MD5 as a checksum keyed MD5 for authentication keyed MD5 as a stream cypher Thanks Simon --- (defun modexpt (x y n) "computes (x^y) mod n" (cond ((= y 0) 1) ((= y 1) (mod x n)) ((evenp y) (mod (expt (modexpt x (/ y 2) n) 2) n)) (t (mod (* x (modexpt x (1- y) n)) n))))

1 0

[Dr. Fred] [FRED] (was: Re: Fred, Fred, Fred: Enough already!)
by Herb Sutter 17 Dec '03

17 Dec '03

At 07:51 10.26.1995 +0800, James A. Donald wrote: >At 11:58 AM 10/24/95 -0400, Robert Hettinga wrote: >> Can we please talk to Dr. Fred, the Poster Child of the Informal Fallacy, >> if we *really* have to, off line? > >Yes, please, will everyone please killfile Dr Fred. I am tired of seeing >things that are glaringly obvious explained in painful detail to someone >who is reluctant to understand them. At the very least, please put "Dr. Fred" or "[FRED]" in the subject line so my filter hits it ("Fred" alone is too general). Thanks. :-) Herb ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ Herb Sutter 2228 Urwin, Suite 102 voice (416) 618-0184 Connected Object Solutions Oakville ON Canada L6L 2T2 fax (905) 847-6019

1 0

No Subject
by Anonymous User 17 Dec '03

17 Dec '03

_______________________ Copyright EMAP Computers, 1995 Network Week, London, Vol 1 No. 8, 25 October 1995 Page 1 Lead Electronic cash card system faces possible legal action MONDEX BLOWS USERS ANONYMITY By Gavin Clarke and Madeleine Acey Mondex faces possible legal action after admitting transactions made with its supposedly anonymous electronic cash cards can be traced. Launched in December by Natwest, Midland and BT, the electronic card was promoted as easy to use and as anonymous as cash, with no trace being left. It was perceived that a significant percentage of the public avoided credit and debit cards because they preferred their spending habits to remain private. Simon Davies, Visiting Professor of Law at Essex University, has lodged a complaint with the Trading Standards Board demanding that Mondex change either the retailers card readers or its promotional material. It has been revealed that the readers keep records of up to 500 cards identities. The customers can keep a record of ten transactions. The retailer sends the money to the bank through a 9,600 modem-based Mondex phone Rob Jameson, Mondex project manager for the pilot in Swindon, said we can certainly trace where cards have been used. There are degrees of control that Im not prepared to discuss. There are other mechanisms in place but I dont want to go into that. Davies said this contradicted previous Mondex publicity material. It said In everyday use Mondex transactions are anonymous, just like cash A Mondex spokesperson denied last week that the company said its card offered anonymity. But the same spokesperson said in February 1994 that the cards anonymity would appeal to those with a cash psychology, such as cab drivers and other cash-in-hand business people. Mondex entered a new phase last week with the launch of specially designed public telephones that will allow its 8,000 Swindon trial customers to re-load their cards from their bank accounts. The Data Protection Registrar said people using Mondex and other smart cards should be made aware of the uses to which their card information will go. ---------- Photo of Mondex promotional material and caption : Mondex card use can be traced, despite claims of anonymity. ends --

2 1

A real payoff of the export-SSL bruting.
by Peter Trei 17 Dec '03

17 Dec '03

I know of two companies which are developing products incorporating cryptography. At both, the original plan was to distribute only a weak exportable version. Marketing & distribution didn't want to deal the hassle of stocking different versions, and worried that the export version would be seen as inadequate. Since the bruting of export SSL by the cypherpunk's key-cracking ring, this policy has changed. It is now clear that the exportable version can be cracked, and probably will be cracked, with all the bad PR that entails. Both companies now plan to release export and domestic versions. (Some overseas sales are better than none, and not everyone needs or uses the cryptographic capabilities). Speaking only for myself, Peter Trei ptrei(a)acm.org

1 0