December 2003 - cypherpunks-legacy

Re: ecash speed
by James A. Donald 17 Dec '03

17 Dec '03

At 12:21 PM 11/9/95 -0800, jim bell wrote: >I think that one thing that's needed is the concept of probabilistic payments. Problem: If the recipient verifies the coin infrequently, then someone can browse with slugs, accepting a modest probability of random URL failure. If the recipient verifies the coin regularly, then the cost of verification is still the same as ever. Another poster earlier suggested the following solution, which seems to me much better: When you access the home page of the Playboy dirty pictures web site, you automatically buy a bunch of seemingly random numbers from them: Every time you click on a URL, you spend one or more of their numbers. If you have some left over when you are through, you can keep them or cash them. This would mean two expensive transactions (high calculation and communication costs) per provider, instead of one expensive transaction per click. It also means that providers could make their tokens as cheap or expenisive as they wished, down to microcents if they felt so inclined. It also means that every shop around the world would be issuing their own money, making it impossible to trace anything in practice even if everything was traceable in principle. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: the revolution of microcurrency
by blancw＠accessone.com 17 Dec '03

17 Dec '03

>From Thomas Junker (in reply to Vlad): > this same idea works with software. you don't see > software as an end product. you see it as something that > is evolving over time. and whenever you send money to a > company for software, in this new system the idea is that > "I like this software, and I want to see it grow. here > is my contribution to that". People as marketplace players do not think like that. .................................................... This is a very important point to consider: how a person as a customer will _actually_ think. It is easy enough to propose schemes based on one's preferences of how one would like a potential customer to make decisions about services, products, and methods of payment for what is offered. But doing the customer's thinking for them doesn't automatically transform them into that line of reasoning. To better compute whether they will proceed according to how you have imagined, it is more realistic to consider how the other person reasons on the circumstance they are facing - from their perspective. Market researchers actually carry out tests for consumer response and acceptance of products or payment schemes in order to gauge their success. And there are many kinds of potential customers, who will make different decisions in regard of the same thing: some will find it a good idea to think about software in terms of "contributing to its growth" in the longterm, but some will have immediate needs which they are trying to satisfy and may think "I need a solution to my problem *right now*" and will look for the product/service which will solve their problem as it stands in the present. This is another attractive feature of "the free market": in it one can find all sorts of schemes & methods for solving all sorts of problems in different ways. There is no single type of consumer, no single circumstance, no one service or product or scheme which will satisfy everyone, equally, at all times. "May the Best Man Win", and "To the Victor Belong the Spoils". <g> .. Blanc

1 0

WebSTAR security challenge. Make $10,000 breaking in a site.
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

>From TidBITS: **$10,000 Internet Security Challenge** -- I wrote about the WebMaster Macintosh security challenge back in TidBITS-295_ and, as expected, no one was able to break WebSTAR's security and claim the prize of free passes to the WebEdge conference. Now the stakes have increased. Seven companies - StarNine, EveryWare, Maxum, ComVista Internet Solutions, WebEdge, Digital Forest, and Westwind Computing - have joined forces to offer a more lucrative prize of $10,000. The new challenge is similar: you must break WebSTAR's security to find information that's isn't available to the public and report it by midnight on 30-Nov-95. Check out the rest of the details online if you are interested. [ACE] http://challenge.comvista.com/ -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Secondary Ecash applications on hold
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

A few weeks ago, I promised you all to write some scripts that will lay the groundwork for some of the more unusual applications of Ecash. Unfortunately, I went straight from one contract to the next and didn't find the time to work on the scripts. I am currently in St. Louis, making sure that Ecash makes the impact on Internet commerce that many of us think it should make. Anyone on this list that ever thought of opening a shop using Ecash or is interested in Ecash in general is encouraged to email me at support(a)marktwain.com and share their ideas. TIA, -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

CSE gets flak on TV
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

For those who care, the Communications Security Establishment has been getting some flak for spying on Mex. during NAFTA talks and on Korea to help us sell Can. nuke reactors: (This rather mirrors the trouble their sister agency, the NSA, has been getting into) (sorry the online newscasts were rather vague) _________________________________________________________________ CP LOGO CANADIAN NEWS DIGEST Tuesday, Nov. 14 Electronic snooping part of the game OTTAWA (CP)--Intelligence experts say it's no big secret that Canada's high-tech spy agency snoops on friendly countries for financial gain. Increasingly, intelligence agencies around the world are using their antennas, computers and codebreakers to gather economic information, Wesley Wark, a University of Toronto history professor, said Monday. Some of Canada's largest trading partners--including the United States, France and Japan--comb the airwaves for useful information, so Canada would be foolish not to join the game, said Wark. Canada's secretive Communications Security Establishment--an arm of the Defence Department--collects and analyses communications traffic on the activities of foreign states, corporations and people. Jane Shorten, a former CSE employee, told CTV News in an interview Sunday the agency spied on Canada's allies and trading partners--including Mexico and South Korea--by eavesdropping on embassies, consulates and diplomats. ___ HEADLINE NEWS All times are Eastern Standard Time Date: Tue-14-Nov-1995, Time: 13:00 mexico and south korea are angry about reports that canada spied on them. the mexican government has filed a diplomatic note expressing its suprise and concern, and south korea has launched an inquiry. a former intelligence agent, jane shorten, says she spied on both countries, as well as japan, when she was with the communications security establishment. she says the c-s-e shifted its focus after the cold war from spying on the russians to spying on allies to get trade secrets. prime minister chretien says the organization is supposed to operate within the law. chretien says the c-s-e doesn't report to him on a daily basis, so he doesn't know if it was spying on anyone.

2 1

Re: NSA, ITAR, NCSA and plug-in hooks.
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

> > >I think it's 121.1, Category XIII paragraph (b) item (5): > > >"Ancillary equipment specifically designed or modified for paragraphs (b) > > >(1), (2), (3), (4) and (5) of this category;" > > > > Question: What makes computers in general NOT describable by such a > > paragraph?!? > >"specifically designed"? > >nathan That makes it easy: Just make sure that you also write a compressor or filter program with similar compatibility, and nobody can argue that the hooks were SPECIFICALLY DESIGNED for encryption.

1 0

Re: Crypto requlations & laws
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

> Could the person posting the location of the crypto laws please repost. http://www.kub.nl:2080/FRW/CRI/projects/bjk/lawsurvy.htm Bert-Jaap Koops

1 0

Re: credit card conventional wisdom (fwd)
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: Simon Spero <ses(a)tipper.oit.unc.edu> The printed digits above the embossed account number are the first four digits of the BIN (on Visa cards) or ICA (on MasterCards). They are there to discourage re-embossing of the card with another account number. ---------------------- You may be interested in knowing that this appears to vary depending on the card issuer (or possibly on when the card was issued). My MasterCard (from USAA) has no such printed digits; instead, the entire account number is on the back of the card, plus 3 (I would guess check) digits. -Allen

1 0

NSA, ITAR, NCSA and plug-in hooks.
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

I just found this tidbit while following Sameer's Apache WWW server link. For those who were wondering if plug-in crypto hooks were still watched out for. One wonders how the ietf folks are managing to promote internet-wide standards that are considered unexportable (Are they? What's the deal on photuris, PEM, ipsec and the rest of them?) Ps. I may be totally wrong, but I remember seeing something posted last month about some ZKIPS scheme in relation with Netscape (zero knowledge proofs with web servers, huh? Confused). ----------------------------------------------------------------------- [IMAGE] WHY WE TOOK PEM OUT OF APACHE On May 17th, 1995, we were asked by a representative of NCSA to remove any copies of NCSA httpd prior to 1.4.1 from our web site. They were mandated by the NSA to inform us that redistribution of pre-1.4.1 code violated the same laws that make distributing Phill Zimmerman's PGP package to other countries illegal. There was no encryption in NCSA's httpd, only hooks to publicly available libraries of PEM code. By the NSA's rules, even hooks to this type of application is illegal. Because Apache is based on NCSA code, and we had basically not touched that part of the software, we were informed that Apache was also illegal to distribute to foreign countries, and advised (not mandated) by NCSA to remove it. So, we removed both the copies of the NCSA httpd we had, and all versions of Apache previous to 0.6.5. The Apache members are strong advocates of the right to digital privacy, so the decision to submit to the NSA and remove the code was not an easy one. Here are some elements in our rationale: * The PEM code in httpd was not widely used. No major site relied upon its use, so its loss is not a blow to encryption and security on the world wide web. There are other efforts designed to give much more flexible security - SSL and SHTTP - so this wasn't a function whose absence would really be missed on a functional level. * We didn't feel like being just a couple more martyrs in a fight being fought very well by many other people. Rather than have the machine that supports the project confiscated or relocated to South Africa, etc., we think there are more efficient methods to address the issue. It kind of sickens us that we had to do it, but so be it. Patches that re-implement the PEM code may be available at a foreign site soon. If it does show up, we'll point to it - that can't be illegal! Finally, here is a compendium of pointers to sites related to encryption and export law. We can't promise this list will be up to date, so send us mail when you see a problem or want a link added. Thanks. * Yahoo - Science: Mathematics: Security and Encryption * EFF Crypto/Privacy/Security Archive * Crypto page at Quadralay * Cryptography Export Control Archives (Cygnus) * ICLU - Your Rights in Cyberspace Brian, brian(a)hyperreal.com

9 8

MED_vac
by John Young 17 Dec '03

17 Dec '03

11-15-95. NYPaper Page One: "When Patients' Records Are Commodities for Sale." Individual medical records, carrying more sensitive personal information than ever before, are increasingly being gathered and stored by the tens of thousands in commercial databanks maintained by institutions like hospital networks, health maintenance organizations and drug companies. And although there is a Federal law that protects the privacy of video rental lists, private medical information is being bought and sold freely. The issue of medical privacy touches virtually everyone. "It is true to say that if you know a person's history of health problems, then you know more about that person than you would with any other data," said Lawrence O. Gostin, a professor at Georgetown University Law Center. And as medical records start including new genetic information that can predict diseases likely to show up in years to come, they will be able to reveal "not just health histories, but health futures," Mr. Gostin said. Yesterday hearings were held on a bill called the Medical Records Confidentiality Act, intended to establish uniform Federal rules for the use and disclosure of health information. Although the bill details procedures for obtaining consent, it also establishes a formidable list of exceptions to this requirement. The police, health oversight agencies, health information services, public health offices and medical researchers are among those allowed to obtain records of an identified patient without that person's consent and, in many cases without notification. MED_vac (15 kb)

1 0