December 2003 - cypherpunks-legacy

FWD: Intuit and SSNs
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

What does our man in Intuit have to say about this? > Date: 18 Dec 1995 19:10:07 -0800 > From: michael(a)piglet.amscons.com (Michael Bryan) > Subject: SSN Shown On Payments by Intuit's Banking Service > Organization: none > > Another user (Robert Mayo) discovered, and I confirmed, that Intuit's > online bill payment service sends your payees a printout containing > your social security number. > > This applies to any person who is using Quicken for Windows or > Microsoft Money for Windows to send payment requests electronically, > using Intuit's service. It specifically does -not- apply to using > Quicken with the Checkfree service, as the Checkfree service does not > supply anybody with your SSN. > > The details: > > When the Intuit service sends a payment to a merchant, it will do one > of three things. First, it will try to perform an EFT directly from > your account into the merchant's. Most merchant's are still not setup > for this, however. Second, if your payment is the only payment going > to a given merchant on a given day, then they will print a check, drawn > against your account, and mail it to the merchant. Both of these > methods are ok, and do not result in your merchant receiving your SSN. > > However, if there are multiple payments going to a single merchant on a > given day (i.e., more than one customer has requested a payment to the > given merchang), all of these payments are sent in a single envelope, > and a summary sheet is enclosed. This summary sheet will have a field > called "Control Number", which consists of your SSN, followed by two > other digits. This summary also lists your checking account number, in > addition to your name, account with the merchant, and the amount of > your payment. (In my opinion, only these last three fields are called > for. There is no need for the checking account number to be listed, > even though it -is- printed on your check as part of the MICR > encoding.) > > I have contacted Intuit regarding this matter, and they have been > decidedly less than helpful. I know at least three other people who > have called them, and we have all been told the same thing: > > 1) "Most of your merchants already have your SSN". Perhaps this is > true for some people, but it is not the case with me. > > 2) "The SSN is encrypted on the printout". Absolutely not true. It is > printed under the label "Control Number", and has two extra digits > appended, but this does not "encrypt" the number. Anybody who knows > what the field contains has instant knowledge of your SSN. > > Intuit is currently refusing to address this issue. Furthormore, when > I called in, they tried to tell me I was the only person who was > complaining. I immediately gave them the names of three other people > who had called in, one of whom I knew had talked to this particular > individual. So that little "divide-and-conquer" trick backfired. > > Also, when I said that I would be forced to go to the media if they > didn't address this issue, I was told that by doing so, I would be > responsible for broadcasting this information to those who might then > illegally use the information. I found this two-faced attitude > particularly annoying. On the one hand, they are claiming it's not a > problem, yet on the other they tried to keep me from going to the media > because it might give criminals information they could then exploit. > > Anyway, I've done all I can with talking to Intuit, so I am now > pursuing other avenues. My bank (Union Bank) was particularly > concerned that the SSN was being printed out and mailed with > potentially every payment, and vowed to look into it and work with > Intuit on my behalf to get this behaviour stopped. Also, I and a few > others have contacted various media representatives, in an attempt to > get them to focus a spotlight on Intuit, and let people know that > Intuit is broadcasting their SSN, without their knowledge. And of > course, I'm posting Usenet articles in the privacy newsgroups, as well > as the newsgroup where most Quicken discussion occurs, > comp.os.ms-windows.apps.financial. > > If you are using Intuit's Online Bill Payment service, and are > concerned about this, please call Intuit and express your displeasure. > The number for the Online Bill Payment service is 708-585-8500. Also, > call your bank, and inform them as to what's going on. Finally, write > to your local (or national) newspaper, let them know about this, and > ask them to cover this in their paper. > > It appears that the only way Intuit is going to address this is by > getting some negative publicity, since customer complaints don't seem > to carry enough weight. I wish they were more reasonable, but that > just doesn't seem to be happening here. So be it --- they want a > fight, they've got one.

2 1

Re: The War on Some Money [long]
by tcmay＠got.net 17 Dec '03

17 Dec '03

Amidst all the flames about impure Cypherpunks on the list, about evil capitalist corporations, about conspiracies involving the underground Grey Alien bases in Nevada, and amidst the flames about posts not dealing solely with number theory or ciphers, it's nice to read a post like this one from David Murray. The tension between "private transactions" and "traceable transactions" is indeed at the core of the debate. Kudos to David on this. I just want to end on a positive note before leaving for the holidays (the birthday of my savior, F. Hayek, of course). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: Bit Commitment Query
by Hal 17 Dec '03

17 Dec '03

For Robbie Gates, I agree that the bit commitment he describes seems more complicated than necessary. The simpler one, where you just hash (R,b), is the one I have seen used. I suggest asking on sci.crypt. Bruce Schneier and many other good cryptographers read that group. For Futplex, the idea of using a block encryption algorithm in a similar way, encrypting (R,b) with a secret key K, and later revealing K, is a little questionable because block encryption algorithms are not designed to avoid collisions in the same way hashes are. Futplex suggests that it should be hard to find two keys K_1 and K_2 such that E_K_1(R, b1) = E_K_2(R, b2) where b1<>b2. But this is not necessarily true. A cryptosystem might have the property, say, that complementing the key is equivalent to complementing bit 0 of the plaintext. DES has some simple complementation properties (although not this one). Unless you can show that a cipher with this property is inherently weak then it is not a valid assumption that a cipher won't have this property. There is some literature on creating hash functions out of block ciphers. The two are really not interchangeable. Hal

1 0

Re: Microsoft Flame[tm] [NOISE]
by jim bell 17 Dec '03

17 Dec '03

Forget about the monopoly aspects for a second and look >at MS as an American success story. It has all the classic elements: started >small, with a crew of social misfits and eventually grew up. >RobL >------------------|----------------------------------------------------------- >Rob Lowry | >PO Box 288 | >Rockford Wa 99030 | ral(a)otc.mhs.compuserve.com robl(a)on-ramp.ior.com Well, I disagree. Microsoft succeeded primarily because it was "chosen" by IBM in about 1981 or so, needing an OS for their PC. MS didn't even write it; Seattle Computer did, and that was a port of CP/M. Not much creativity. MSDOS revisions 1.0 and 1.1 were pure crap.

2 1

AWARD: CHRISTMAS NET SCROOGE - AT&T & NETSCAPE??
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

Alice here ... Back on Tue, 19 Dec 1995, I wrote: >>>Can anyone tell me whether Ian Goldberg and David Wagner got their >>>$25,000 from Netscape for finding the HUGE security flaws in Netscape's >>>existing product line?? >>> >> >I can't remember whether they got anything or not ... >> >> That would be no (well, except for the nifty T-shirt from Sameer; Thanks!). > > Not anything?? That's shameful ... where on earth are the values in > America, today? Everyone should ask this question. AT&T can sign-on to a two-page ad, calling on Congress to balance the budget -- to cut off veterans, and cut-off women with dependent children just before Christmas. It can sign on to this, but it can't bother to even offer a scholarship to the students who helped make its fortunes. It would rather leave the impression that it freeloads off of other's efforts. It's shameful. > AT&T and Netscape have jointly made a small fortune distributing this > product, and yet NEITHER company feels that the software engineers who > "voluntarily" made a difference -- a couple of students -- deserve > even a wooden nickel for the ideas which were used. > > It's absolutely shameful. But then, I guess that AT&T and Netscape > have no shame at all. > > They just steal "intellectual property" from students, and don't even > pay a token amount. > > And people wonder what's wrong with America? Luckily for those of us who don't live in the United States, we can perhaps look at that country and truly wonder what is going on over there, and what is wrong with America? Where are the values amongst ALL Americans, not just Netscape and AT&T? What are the role models that all the leaders -- business, sports, and political leaders -- show to the national youth. Here is all I've seen (as a foreigner), over the last while: Enid Greene Waldholtz blubbering in a news conference about how she as a congress person certainly COULDN'T be expected to resign after winning her election with stolen money. Blubbering for five hours straight (except when she had to stop to turn a page, I mean) ... She certainly said that "leadership" is all about playing "victim". Poor little Enid. (And even worse, she was _defended_ by Susan Molinari.) Bob Dole, deciding to go to Bosnia. The former WW II veteran willingly jeopardizing the lives of American boys -- boys who have put their lives on the line in a _volunteer_ armed force -- all for a lousy political photo-op. The chance to say ... "hey look at me, I'm here in Bosnia." Someone who's willing to overrule the Pentagon's own most diplomatic advice on how complex an operation this actually is. And then there is AT&T. A company who's Chairman can publish a letter which calls on Congress to cut off checks to mothers with dependent children and war veterans days before Christmas, all while stealing and freeloading off of the work of some students. Scrooge ... take heart. Here's Holiday wish #1. Enid do the right thing ... resign. Say the "right thing" and say that your child -- the future and the delayed gratification that the future brings -- is much more important than your own personal PRESENT political aspirations. Here's Holiday wish #2. Bob, lots of people worked their asses off to make sure that the American fighter pilot, and the two French fighter pilots could be rescued from Bosnia. If you want to go and get some photo-ops, go to Germany or Italy, and give one hell of a vote of support to the boys that are there -- a support which could just as easily have been given and should be given in Congress. A _real_ strong unfettered commitment. And here's Holiday wish #3. AT&T. Do the right thing. Reward those people who help make you a fortune. Stand tall as an example, rather than as an embarrassment to the nation. You've ignored this for so long now, that you've almost dug your own grave. But you still have a chance to save face. Have the courage to take the chance when it's offered. Simply say that the proposal to reward David Wagner and Ian Goldberg -- some holiday mad money and scholarships -- was lost in committee, and approval processes -- but it WAS in the works, and it was recommended and can now be announced just before Christmas, as a rightful reward. Some holiday cheer. Will people think it's a cynical attempt at manipulation? Yep. But it's a darned site better than the alternatives -- especially when you look at possible future outcomes. Trust me, this is far better than calling for veterans and single mothers with children to be cut-off just before the holidays. Perhaps, Enid, Bob, and AT&T will all learn when to use offense and when to use defense. They might also learn that the best offense is a good defense. They might even begin to look at what "courage" truly is, and of how difficult it can be for anyone to do the "right thing", especially when they think that they're surrounded by minefields. Even when the "right thing" is in your own best interest, you not only have to be shown the right path to take, but you have to have the motivation and courage to make the move and take action. Enid, Bob, and AT&T, take note. Hopefully for the holidays, everyone finds the courage to neutralize some portion of the vulnerability spectrum they've placed themselves in. > > - Ian "There's a reason people talk about `starving grad students'..." > > Alice de 'nonymous ... <an455120(a)anon.penet.fi> ...just another one of those... P.S. This post is in the public domain. C. S. U. M. O. C. L. U. N. E.

1 0

Re: Cypherpunks resumes?
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:55 AM 12/21/95, Anonymous wrote: >Is there any chance of seeing a Cypherpunks 'Rogues Gallery' of sorts >in the archives anytime soon? It would be nice to see a face connected >to the postings here. Some of us don't get the chance of getting out >west for the parties, The only other thing I know about Tim May besides >being one of the Fathers of the Cypherpunks is that he was a naked hippie >in a hot tub at some party that Robert Hettinga was at some weeks ago, > >That doesn't paint a good picture for me. - But, "Anonymous," we don't even know which of the many "Anonymous" ones you are, so why should we go out of our way to provide images, resumes, dossiers, etc., to you? In any case, many of the folks on this list have elected to have Web pages, often with images of themselves, their SOs, their pets, their computers, and so on. Perhaps their images will paint a better picture for you. (I note that the last "Anonymous" person concerned with getting the "real" pictures of people was S. Boxx, or maybe Pablo Escobar, I forget.) (I have not spent time generating a "home page." I see the burgeoning shelves of "HTML Bible" self-help books and see more and more people spending time gussying-up their home pages. People are even putting their personal diaries on the Web, plus all sorts of personal stuff that is finding its way into compiled dossiers. Not for me. I prefer my essays to be what goes into my dossiers.) Or, as our esteemed Gothamite might reJoyce: Erudite, profligate, disputacious -- indistinguishable from many other publicity-saving levitationisms. 'Tis superficially an expurgated part of the Ruby Ridge-slippered Great Oz divulgation. Ostentatiously, the preterite few surf the gilt-edged waves while Jose Sixpacks languish in spider-webbed Quayle-spelt ghettoes populated by home page homeys. For further emendations and emissions, behave normally and reply with a blank message labelled: XMAS_troll --You Know Who

2 1

Re: CFS and Linux
by Alan Olsen 17 Dec '03

17 Dec '03

At 11:40 PM 12/20/95 -0500, Matt Blaze wrote: >I'm told that all version of CFS since 1.0.4 (the latest is 1.3.1) >do work out-of-the-box under *some* releases of Linux and with some >coaxing on the others. I am wondering if he is compiling for ELF. That seems to throw a good size monkey wrench into just about every piece of software out there. (At least the ones that have not been written to take the ELF paculiarities into account.) >I'm not sure exactly what problem you're having, but the most common >CFS-Linux problem that people complain about has to do with the rpcgen >output not being in the format expected by the rest of CFS. There >seem to be two things you can do about this: get a version of rpcgen >that generates the "standard" (original Sun) names for the functions it >generates, or just grab the rpcgen output from the cfs-users mailing list >archive ("echo help | mail cfs-users-request@research att.com" for details). I think you may be right on this one. I have heard of a few other things having problems with Linux's version of rpcgen. (The names of which are not coming to mind... Need more coffee.) [rest of reply deleted because I had nothing to say about it] ObNoise: >NB to "Bill Gates" and friends: To save you the trouble of pointing it out, >I hereby admit that I'm a commie-fascist brainwashed sold out member of the >military-industrial complex who has been programmed by his masters to >infiltrate the cypherpunks in order to sap and impurify their precious >bodily fluids. I think that the mention of Mr. Bill as a "good guy" is the most effective use of agent provoceteur-type behaviour I have seen on this list yet. We know who Mat and Jeff work for. Who do the anon-flamers work for? | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

No Subject
by frantz＠netcom.com 17 Dec '03

17 Dec '03

David Plotnikoff, in his regular (WWW oriented) column in the San Jose Mercury News, writes: DOES YOUR BOSS KNOW WHERE YOU'RE SURFING? The SIMBA Media daily reported recently that a Maryland-based software publisher called Charles River Media has introrduced a $30 electronic fink program called "Internet Watchdog" that keeps an eye on where you've been hanging out on the Net. the program doesn't block or censor sites, but it does maintain a handy record of cyber-footprints that the parent, teacher or employer who controls your Net access can peruse. ----[end]---- Anyone know more about this program? ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: ex encrypted script
by andr0id＠midwest.net 17 Dec '03

17 Dec '03

] > >| Is there a way to encrypt a script yet still allow it to be runnable? I >| know that the simple answer is to write it in C and compile it but I don't >| have the means of doing that at the moment. (i.e. there is not compiler on >| the system) >| >| I thought of a few simple protections but they all involve decrypting before >| running. > > Ever hear of chmod? chown? >Adam The vendor also has superuser access.. chmod chown won't protect it.. :( ( Computer Consulting & Management ) (P.O. Box 421 Cambria, IL 62915-0421) -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQENAzCsIi4AAAEH/1hb5+tO/n99Nbppf0ImLJ6AaVZ3NlZP0ZHwRQor00uA129i d4zWixNXxc8t2auaqN+asV99LpIip3/nQzBnjydiumeBdGLF2PR9+6X8X/RrqKa1 dVIukxM5Agg2eM6ih+0J38hgKJ3qzKXSz6sjYmpaxvbXZoHHOLUk/ZtHUKvvEyPw hnJEYnut8NUnIeK56lqeqRw86yoeRKymbfCdjdpgeY2aRwK2FJts8sbb7Fs10s4y jgxWIxIipBznbGUTh1hb2XrLGPENwk3E/qqXQJEsrySbtwdl6VgTVQjhDDEJMitL DYeiQ3W5EgxfcdbM1j2FwYu3P/dM6Y0I8xLMYT0ABRG0NmFuZHIwaWRAb2ljdTgx Mi5jb20gKG9pY3U4MTIuY29tIHN5c3RlbSBhZG1pbmlzdHJhdG9yKYkBFQMFEDCs LO90C7R/GkJcSQEB01cH/0KC3sd+u4OxMku5378SJktoN6QIQYLJ7uVbuV4S51yK NAotCGf4Wl6wwjynzZvXKU0H87oDuMiq7FybgMNL2n+4bQIZi0iz0lIuzwoMDu63 NrHUW9Kz42pOnhrEhrdkHhHL9O5GgD1yc40fJ3qw5h7LQEjDxgypyw0IFILFc34u LeRLliNibxKp8JwAxXNHWSgxu28TQvmnkHi0AHP6tJ/uZYe+4dqJtrMMsYFjzZaz DPmxD+dzbTwlQKtJaP1ZkDI0Sr072wrZDv+G86GyGBMX2lpSafpRitnxuUttjU9o wsQ9Qo5xiH1nZRCs/bDzJe/gng+GHzevixDIITurtNA= =SgPT -----END PGP PUBLIC KEY BLOCK-----

3 2

GAK boycott, What are legal implications?
by Paul Elliott 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Here is a question for all of you cyber legal types out there. This question presupposes: The NIST will complete its work on the GAK standard. But no law will be passed (yet) regulating the use of encryption in the U. S. (The GAK standard is an attempt to create an environment in which such laws can be passed.) In the U.S., Big Company INC will start marketing a GAKed encryption product domesticly. A bunch of cypherpunkish types will immediately try to organize a boycott against BIG COMPANY. What are the cypherpunks legal risks? I seem to remember that back in the 70s, the NAACP lost a big case with respect to their boycott in a southern city. As I recall there were people in the street begging money for the NAACP because there was a > 10**6 $ judgement against the NAACP and they needed that much just to appeal. - -- Paul Elliott Telephone: 1-713-781-4543 Paul.Elliott(a)hrnowl.lonestar.org Address: 3987 South Gessner #224 Houston Texas 77063 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMNnJ8/BUQYbUhJh5AQGbsgP/T0n31SqeuHt+7AbizymcEhu/78DUuym5 sj+MO3ruA9WcEBQUXfabuf/PgOwlrtUAcC3dISPvXwGbdygc9oHBfxSglLi48g7d dvDS4wziRHF7N8sBsYn0ee9YyKhPd9U7Ci0ovOc5frFGSZ2Bt4hU703d7bR+6cB+ iHHqsPaAa6o= =EPoj -----END PGP SIGNATURE-----

3 2