December 2003 - cypherpunks-legacy

Re: Certificates, Attributes, Web of Trust
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:11 PM 10/5/95, Jeff Weinstein wrote: > How about if the systems allows you to get a certificate that >has any name in it that you want, where the issuer makes no >claims about the identity of the owner of the certificate? >How about if the software lets the user decide which CAs they >will accept certificates from? Given these two features, >would you still consider requiring a certificate to be bad? Let's make sure what we mean by these two points: 1. "...allows you to get a certificate that has any name in it that you want, where the issuer makes no claims about the identity of the owner of the certificate?" I would expect that a certificate for "%63rrW209neU6q!" would be issuable for a miniscule amount of money, and as many of these as are desired. (No, I'm not saying "Verisign" must offer certificates for very low cost, only that there be no built-in costs, or built-in time delays and processing delays, that would prevent "Tim's Really Cheap and No Questions Asked Certificate Service" from issuing such certificates, cheaply and rapidly (in seconds, or less, as some applications will need this, if other services "demand" certificates). 2. "...software lets the user decide which CAs they will accept certificates from?" Fine, provided the following CAs are acceptable: -- an "automatic" certificate granter, essentially meant only to satisfy protocols which require certificates -- a certifier for the Mob, which sells certificates for some fee -- the application itself should be able to generate certificates immediately...call this the "null certification." It is true that some of these example seem to "undermine" the whole purpose of certificates, but this is precisely my point: if I want a key to be certified, I will determine the conditions under which I want it to be certified. Other parties are free to meet my conditions if they wish to do business with me, or not, as the case may be. The "null certification" is thus very important. Naturally, I think this null certification makes the idea of _requiring_ certification moot. Will Netscape allow this? --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

4 3

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

>Look just replace "cancel" with "mark as worthless and sign". Then No. Replace cancel with 1. Legal wants you to destroy this document 2. The site security officer wants you to destroy the document 3. The license has expired and you must destroy the document and so on. I don't think my life has been all that interesting, but I've had all of those things happen. Of course there is no guarnatee that indiviuals don't have private copies, etc., but you have this situation currently and it works. Replacing cancel with setaside makes Usenet architecture useful for many business semantics/requirements. That's not something I'm willing to trade away and I am surprised that others would... /r$

1 0

Re: Rethinking the utility of netnews "cancel" control messages
by Rich Salz 17 Dec '03

17 Dec '03

Sigh. >Replacing cancel with setaside makes Usenet architecture useful for >many business semantics/requirements. That's not something I'm willing to Sigh. useLESS for many ...

1 0

Re: Simple Hardware RNG Idea
by norm＠netcom.com 17 Dec '03

17 Dec '03

Simon Spero writes: .... > What about a beam of high intensity ionising radiation aimed at the > detector? .... You presumably use the oddness of the count for your random bit in some predetermined time interval. External radiation can change, but not bias the parity. If the counter saturates, the counter may be biased towards one parity but the software can easily detect saturation presuming it gets the count. You can use the source in a smoke detector.

2 1

GC Tech GlobeID pilot
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: pays(a)edelweb.fr Mime-Version: 1.0 Date: Fri, 6 Oct 1995 00:46:46 +0100 To: Amir Herzberg <amir(a)watson.ibm.com> From: pays(a)gctech.edelweb.fr (Paul-Andre Pays) Subject: GC Tech GlobeID pilot Cc: e-payment(a)cc.bellcore.com, ietf-payments(a)cc.bellcore.com, www-buyinfo(a)allegra.att.com As it seems everyone is broadcasting URL about electronic payment systems, let me propose http://globeid.gctech.fr/cgi-gid/welcome?Language=English which does no lead to a specification but the Globe Online, Globe ID pilot setup By GC Tech. Sorry only a few pages are available in english by now. English and some other languages wil be available within a few weeks Sorry again, but because real content is and will be available we commited to deliver only a few hundreds Web Wallets for this pilot. You can still use the web form to apply for one... -- PAP _________________________________________________________________________ PAP: paul-andre.pays(a)gctech.edelWeb.fr tel: +33 1 34 52 00 88 fax: +33 1 34 52 25 26 GC Tech "The Globe Online and Globe ID Technology Company" http://www.globeonline.fr/ http://www.gctech.fr/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

(cpx) Mastercard, IBM, Netscape, CyberCash and GTE publish SEPP
by rah＠shipwright.com 17 Dec '03

17 Dec '03

--- begin forwarded text To: e-payment(a)cc.bellcore.com, ietf-payments(a)cc.bellcore.com, www-buyinfo(a)allegra.att.com Subject: Mastercard, IBM, Netscape, CyberCash and GTE publish SEPP Mime-Version: 1.0 Date: Thu, 05 Oct 1995 16:12:23 -0400 From: Amir Herzberg <amir(a)watson.ibm.com> MasterCard's Secure Electronic Payment Protocol is now available on the WWW at http://www.mastercard.com/Sepp/sepptoc.htm (without the `l'). This protocol is based on iKP but includes much more details. You can download it from the page above until we `re-hash' it into Internet Draft form. Comments are very welcome, and I suggest we use the e-payment mailing list for them (until an IETF working group is formed). I believe that the publication of this spec and the STT spec suggests that we should in fact proceed now with establishing a working group. So, I plan to submit an updated charter soon... Comments on it are also welcome. Best, Amir Text version of the page: Secure Electronic Payment Protocol Specification The development of electronic commerce is at a critical juncture. Consumer demand for secure access to electronic shopping and other services is very high; merchants want simple, cost-effective methods for conducting electronic transactions; financial institutions want a level-playing field for software suppliers to ensure quality products at competitive prices. The next step to achieving secure, cost-effective on-line transactions at a rate fast enough to satisfy market demand, is the development of a single, open industry specification. The generally accepted process for developing a technical standard or specification within an industry is comprised of five steps: Collaboration of interested parties Preparation of the document Availability of the document for comment Modification of the document based on the comments Publication of the document for implementation. In a effort to develop a specification for securing bankcard transactions over the Internet and other open networks, IBM, Netscape, GTE, CyberCash and MasterCard have cooperatively developed the following draft document, which is now available for review and comment. Each company brought unique and valuable experience to the effort. The result of this collaboration is Secure Electronic Payment Protocol (SEPP) an open, vendor-neutral, non-proprietary, license-free specification for securing on-line transactions. Currently in draft form, this document is available for review and comment by all interested parties. It also will be sent to Internet standards-setting bodies, including the Internet Engineering Task Force. Once comments are received, modifications will be made and a final document will be published in the public domain. Access to SEPP Specification This specification is structured in five files in order to make downloading easier: Preface: This file provides an overview of the entire SEPP document. Postscript (.Z), Postscript (.zip), Postscript (.hqx), Mac OS (Word 5.1[.hqx]) If you'd like to browse just this part, Click Here. Part 1 - Business Requirements: This file defines the major business requirements for secure electronic payments. Postscript (.Z), Postscript (.zip), Postscript (.hqx), Mac OS (Word 5.1[.hqx]) Part 2 - Functional Specification: This file contains the functional specification for the payment process and the certificate management system. Postscript (.Z), Postscript (.zip), Postscript (.hqx), Mac OS (Word 5.1[.hqx]) Part 3 - Payment System Specification: This file defines the detailed design for the payment system. Postscript (.Z), Postscript (.zip), Postscript (.hqx), Mac OS (Word 5.1[.hqx]) Part 4 - Certificate Management Specification: This file defines the detailed design for the Certificate Management System. Postscript (.Z), Postscript (.zip), Postscript (.hqx), Mac OS (Word 5.1[.hqx]) --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Shipwright Development Corporation, 44 Farquhar Street, Boston, MA 02131 USA (617) 323-7923 "Reality is not optional." --Thomas Sowell >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

1 0

The Intelligence community -- some interesting web pages
by John Gilmore 17 Dec '03

17 Dec '03

I particularly liked the NSA surrogate home page under the second URL. --John From: farber(a)central.cis.upenn.edu (David Farber) Try looking at http://www.awpi.com/IntelWeb/ -- IntelWeb - The WWW Site of Intelligence Watch Report (IWR) and http://www.fas.org/pub/gen/fas/irp/ -- Project on Intellience Reform federation of American Scientists

1 0

Insiders vs. Outsiders...a Nice Metaphor
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 5:03 PM 10/5/95, Carl Ellison wrote: >Crypto is used for making sure that insiders get in while outsiders are >kept out of encrypted files/messages. > >Strong crypto does a better job of keeping outsiders out. > >Things like TIS CKE are mechanisms for making sure that insiders continue >to get in, in spite of mishaps with their keys. > > >Any such system can be evaluated on its technical merits (does it really >separate the insiders from the outsiders as well as it claims to?) (does it >survive various disasters (because if it doesn't survive, it can't keep >insiders in)?) > > >This is a separate topic from GAK -- which boils down to the Government's >claim that it should be listed as an insider for everybody. > > >That's what needs to be brought to everyone's attention. This is a very nice metaphor for what is going on. It also touches on some of the issues about key certification. The issue of who a person is has nothing to do directly with whether they are an "insider" or an "outsider." (In fact, who a person "really is" is almost beside the point.) --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Re: GC Tech GlobeID pilot
by Jay Campbell 17 Dec '03

17 Dec '03

> http://globeid.gctech.fr/cgi-gid/welcome?Language=English >Sorry again, but because real content is and will be available >we commited to deliver only a few hundreds Web Wallets for this >pilot. You can still use the web form to apply for one... Except for this clause... | Caution: Following form is provided for demonstration purpose only. | If you really want to participate to the Globe ID electronic wallet pilot | program, please contact Mr. Pierre Edelman or GID95(a)GCTech.fr. On the surface, this doesn't look much different than First Virtual or any of the myriad other "let me hold your credit card number for you" sites. -- Jay Campbell - Regional Operations Manager -=-=-=-=-=-=- Sense Networking (Santa Cruz Node) edge(a)you.got.net "Shoot the Fruit Loop" 408.469.9400 "On the Information Superhighway, I'm the guy behind you in this morning's traffic jam leaning on his horn."

1 0

Re: The future will be easy to use (fwd)
by Ed Carp 17 Dec '03

17 Dec '03

> To: stevenw(a)best.com (Steven Weller) > Cc: cypherpunks(a)toad.com > Subject: Re: The future will be easy to use (fwd) > Reply-to: perry(a)piermont.com > Date: Tue, 28 Nov 1995 08:29:10 -0500 > From: "Perry E. Metzger" <perry(a)piermont.com> > > Steven Weller writes: > > >Realisticaly, who in their right mind would buy a diskless workstation to > > >connect to Internet? > > > > The same sort of things could be said of the telephone compared with > > written correspondence. Why would anyone have one in their business or > > home? Anyone can overhear a conversation, people will just chat, the only > > thing you can do with it is talk, there is no record of the correspondence, > > why would anyone want to talk to people on the other side of town? etc. > > This is different. In an era of distributed processing, they are > returning you to the mainframe model. I don't see that this can work > very well. Considering how much more powerful a $1000 machine is, why > would you want something half that price that can do one hundredth as > much for you? I beg to differ. Even though Larry Ellison's idea is silly, I don't see it as returning us to the mainframe model. Rather, I see it as just a small step backwards. Right now, I've got a 486/DX2-66 with a paltry 50 MB HD on my desk at work. Most of its processing is done loading stuff off the LAN and running it locally. The fact that I have a local disk nakes not the slightest bit of difference except a boot-time. If the diskless workstation were to have *no* intelligence whatsoever, I'd agree with you. As to diskless workstations being of no value, again, I'd have to disagree. Diskless workstations, expecially X terminals that have a little NVRAM in them, have been rather popular for several years as a way to get graphical objects onto people's desks without having to shell out a ton of money in the process. The only reason that they're getting less popular is that PC prices have fallen dramatically for the past several years, so much so that it's cost-effective to put a DX2-66 with 8 MB of RAM and a little disk (or no disk at all) on someone's desktop as opposed to something from Network General. Me, I'm waiting for the day that someone gets clever and puts Linux into ROM. :) Java is starting to get really hot, so much so that I was telling my spouse that if she wanted to learn Java, she'd have steady contracts in the next year or so, even in the sticks of Dallas ;) The point is, the market for a cheap, fast PC that will run applets *is* there, or will be soon. I only hope that they make it upgradeable, so *I* can put that 5 GB array on it, and beef up the memory without having to take a second mortgage to do it.

1 0