December 2003 - cypherpunks-legacy

Re: NSA, ITAR, NCSA and plug-in hooks.
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995, Raph Levien wrote: > I move we file a CJR on some suitable software with crypto hooks. If you want to get really warped, feel free to file a CJR for Privtool, it's a mail program with crypto hooks but no crypto, and has the added advantage of being written outside the US but still illegal to export, as far as I can tell (certainly it's now on the export-controlled section of c2.org) In fact, maybe I should file one myself, as it's a real pain to have to tell non-US users to get it from a non-US site rather than the 'official' distribution site at c2.org. Can non-US citizens do these things ? Mark

1 0

Re: NSA, ITAR, NCSA and plug-in hooks.
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

Scott Brickner <sjb(a)universe.digex.net> writes: >Jeff Barber writes: >>Does anyone know the ostensible justification for this? What section of >>the ITARs do they point to when they say "this is illegal"? I've perused >>an online copy of ITAR (no, I haven't read all of it -- I have other >>things I want to do this year :-), but I can't find a section that could >>be construed to support this contention. > >I think it's 121.1, Category XIII paragraph (b) item (5): >"Ancillary equipment specifically designed or modified for paragraphs (b) >(1), (2), (3), (4) and (5) of this category;" Question: What makes computers in general NOT describable by such a paragraph?!?

2 1

Cypherpunk FAQ
by cassiel＠alpha.c2.org 17 Dec '03

17 Dec '03

Hi, I'm new to the list, so please don't flame me too badly if this is a dumb question. At least restrict the flames to private email where no one else can hear me scream. :> I downloaded the Cypherpunk FAQ from the Cypherpunk Website. When I decompressed it, all it contained were the words "Yoo hoo, anybody home?" Has the FAQ been corrupted or is this an in-joke? Also, the Privacy FAQ states it was written by L. Detweiler. Is this THE L. Detweiler? If so, why is it in the archives? Thanks for helping me out. Cassiel

1 0

Get your own ITAR
by Rich Salz 17 Dec '03

17 Dec '03

1 703 875 6644. The kindly administrative assistant there will take your name and address and send you a hardcopy of the ITAR regulations. I don't know about overseas mailings. I also imagine you will have to wait until the current US budget stale-mate is resolved. (Thanks to digest-reader walt(a)osf.org for the phone number.) /r$

1 0

Re: credit card conventional wisdom
by Greg Broiles 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Detweiler writes: > the argument goes like this: secure credit card number uploading > schemes (such as in Netscape) are not important on the internet because > credit card numbers are already insecure. you give them to low-wage > workers all the time who might steal the number from you anyway. > there are a lot of fallacies with this. I find this to be a key > cypherpunk issue, and I hope others will agree to the point of > trying to attack this fallacy through letters to the editor, > debates, etc., because it seems to rationalize weak security. You're only reproducing half of the debate, which goes like this: Businesses/customers won't trust the Internet for commerce, because it's not perfectly secure. And then others go on to point out that businesses and consumers do business every day using commerce tools whose security features are weak to nonexistent. So, no, we don't have to "get the Internet ready for business" because it's already at least as secure as ordinary consumer transactions. This doesn't mean that it's not important to work on security, just that it's a useful direction for improvement, not a baseline requirement. Most consumer-level transactions are based on a general sort of trust-in-human-nature sort of policy, backed up by the knowledge that a single failed transaction (or even a constant low level of failed transactions, where failed == "didn't get paid but gave the stuff away") isn't likely to kill off a business or even make it unprofitable. Loss by theft or fraud can be thought of like any other sort of overhead - and it doesn't make sense (financially) to spend more to eliminate it than you'll recover by that elimination. Pursuing criminal or civil charges against a non-performing party is expensive - most people do it out of a sense of moral outrage, or because they want to maintain a public perception of unforgiveness, not because they really think they'll get back what they've expended in time, money, and opportunities lost for other (more profitable) pursuits. (see Axelrod on the Prisoner's Dilemma tournaments for the arguable game-theory C-punks cryptoanarchy relevance.) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMKlcz33YhjZY3fMNAQEAlwP7B+cP/IB1wZ0TeWwwoL5j9z4m5irIO9yV O5599i6fiJ2X3+HbJKGY0/aENs1Zq6kNPHo1I/HcjBhN3fazwelv5BV1dFfmnfUp lPA8DOTraM7qGse6JEpG+tyJa7bL4wadjDAlFVe4uPSxokw1gppBMkZa6pcwd3cX zQ7ammmgeQI= =ZZi9 -----END PGP SIGNATURE-----

1 0

Applied Cryptography MPLS Book Release Party
by Karen E Cooper 17 Dec '03

17 Dec '03

APPLIED CRYPTOGRAPHY 2nd Ed. BOOK RELEASE PARTY Please come out and meet author Bruce Schneier at a drinks and hors d'oeuvre reception to celebrate the publication of Applied Cryptography, 2nd Ed. The reception is in Minneapolis, Minnesota on Wednesday, 29 November, 1995, from 5:00 to 8 pm. RSVP for directions and specifics. Karen Cooper (612) 823-1098 kecooper(a)maroon.tc.umn.edu

1 0

Re: encryption in BeOS kernel
by tcmay＠got.net 17 Dec '03

17 Dec '03

Either John Young or someone imitating his style wrote: >Would chip-fabbers covertly Fortezza chips to get export ok? > I have no idea what "Fortezza" means as a verb, but I'll Moscow a guess: Intel might, according to this guesser, insert NSA-approved back doors in "information appliance" chips. Unlikely in the extreme, for a variety of reasons. First, designers cannot keep secrets. Second, examination of the chips would reveal such meddling. Third, Intel is only one of several likely providers of such chips (e.g., Oracle is said to have plans to use Acorn ARM chips, and DEC may also provide low-end Alpha chips, and of course Motorola-IBM has variants of the PPC to provide). >Motorola, HP, IBM, others long-linked to USG are ever ready >to gobble international market share in the national >interest. > >Intel, sure, world-class fab plants planting chip-secrets. > >Wonder if that key escrow protest to Gore is a cover for >economic actions authorized by National Security D&D? Too much Pynchon? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: credit card conventional wisdom
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On Tue, 14 Nov 1995, Greg Broiles wrote: > Detweiler writes: > > > the argument goes like this: secure credit card number uploading > > schemes (such as in Netscape) are not important on the internet because > > credit card numbers are already insecure. you give them to low-wage > > workers all the time who might steal the number from you anyway. > > > there are a lot of fallacies with this. I find this to be a key > > cypherpunk issue, and I hope others will agree to the point of > > trying to attack this fallacy through letters to the editor, > > debates, etc., because it seems to rationalize weak security. > > You're only reproducing half of the debate, which goes like this: Actually, this is not quite correct. There is a difference if I give a credit card to *one* person, or if I give the message containing that number to a chain of twenty or thirty strangers to get my information to the one person I want to have that information. We're back to handing your card to the neighbour, who gives it to the doorman, who flags the cab and gives it to a cabbie, who then drives cross town and gives it to another doorman, who then etc, etc. Something completely different than the long bomb from the quarterback. Our potential interception points have increased substantially ... and we have absolutely no audit trail to figure out who *might* have scarfed the card. I guess the average customer won't care. His loss is limited to $50. But some of us who try to live in the real world wonder how long that'll last. Can we measure the life of it in a matter of weeks?? Or months? > Businesses/customers won't trust the Internet for commerce, because it's > not perfectly secure. > > And then others go on to point out that businesses and consumers do > business every day using commerce tools whose security features are weak > to nonexistent. Hmmm ... maybe we'll even get a whole whole new industry going ... don't ya think?? Maybe we can create a whole new set of risks which are additive to those we already have. Maybe every petty grifter might trade in his very own credit card number and simply claim that their credit card got stolen over the internet. Just disappeared into the anonymous aethyr ... the one without an audit trail ... but my loss is limited to $50, right?? I guess other people understand systems much, much, more than I do. I guess that the NY Times is right ... it won't change the loss rate for the card companies, at all ... nope ... won't create a new problem ... naahh ... the public wouldn't actually take advantage of holes like this in the system. Nope, no sirreee ... Give your head a shake. Alice de 'nonymous ... ...just another one of those... ...hunters... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

2 1

Re: ecash speed
by James A. Donald 17 Dec '03

17 Dec '03

At 12:21 PM 11/9/95 -0800, jim bell wrote: >I think that one thing that's needed is the concept of probabilistic payments. Problem: If the recipient verifies the coin infrequently, then someone can browse with slugs, accepting a modest probability of random URL failure. If the recipient verifies the coin regularly, then the cost of verification is still the same as ever. Another poster earlier suggested the following solution, which seems to me much better: When you access the home page of the Playboy dirty pictures web site, you automatically buy a bunch of seemingly random numbers from them: Every time you click on a URL, you spend one or more of their numbers. If you have some left over when you are through, you can keep them or cash them. This would mean two expensive transactions (high calculation and communication costs) per provider, instead of one expensive transaction per click. It also means that providers could make their tokens as cheap or expenisive as they wished, down to microcents if they felt so inclined. It also means that every shop around the world would be issuing their own money, making it impossible to trace anything in practice even if everything was traceable in principle. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

Re: the revolution of microcurrency
by blancw＠accessone.com 17 Dec '03

17 Dec '03

>From Thomas Junker (in reply to Vlad): > this same idea works with software. you don't see > software as an end product. you see it as something that > is evolving over time. and whenever you send money to a > company for software, in this new system the idea is that > "I like this software, and I want to see it grow. here > is my contribution to that". People as marketplace players do not think like that. .................................................... This is a very important point to consider: how a person as a customer will _actually_ think. It is easy enough to propose schemes based on one's preferences of how one would like a potential customer to make decisions about services, products, and methods of payment for what is offered. But doing the customer's thinking for them doesn't automatically transform them into that line of reasoning. To better compute whether they will proceed according to how you have imagined, it is more realistic to consider how the other person reasons on the circumstance they are facing - from their perspective. Market researchers actually carry out tests for consumer response and acceptance of products or payment schemes in order to gauge their success. And there are many kinds of potential customers, who will make different decisions in regard of the same thing: some will find it a good idea to think about software in terms of "contributing to its growth" in the longterm, but some will have immediate needs which they are trying to satisfy and may think "I need a solution to my problem *right now*" and will look for the product/service which will solve their problem as it stands in the present. This is another attractive feature of "the free market": in it one can find all sorts of schemes & methods for solving all sorts of problems in different ways. There is no single type of consumer, no single circumstance, no one service or product or scheme which will satisfy everyone, equally, at all times. "May the Best Man Win", and "To the Victor Belong the Spoils". <g> .. Blanc

1 0