December 2003 - cypherpunks-legacy

Re: "Got a subpoena?"
by jimbell＠pacifier.com 17 Dec '03

17 Dec '03

>> >> Note that I am assuming the willingness of the phoneco to be UNCOOPERATIVE, at least according to "the spirit of the rules." They could still cooperate according to the LETTER of the law. > > It's in the phone company's best interest to be cooperative. >*but* in the case of, say, an internet privacy provider, it is in the >provider's best interest to be uncooperative. I would PREFER that I be able to legally obligate my service provider (and phone co) to provide only that level of cooperation which is actually, literally, legally required. I would like to be able to know that if my service is tapped in some way, I receive a letter de-certifying the previous state of non-tapped-ness that it possessed.

1 0

RE: GAK_hit
by Pete Loshin 17 Dec '03

17 Dec '03

James Donald wrote: >At 09:25 AM 12/4/95 -0500, John Young wrote: >> 12-4-95. W$Jabber: >> >> "Microsoft Probe Spurs Subpoenas Tied to Internet. >> Antitrust Effort Appears Focused on Windows 95 Disabled >> Rival Software." > >> The subpoena issued to Netscape may be of particular >> significance. In the estimate of Netscape and industry >> observers, > >I regularly use netscape on windows 95, and I conclude that >this subpoena is pure, 100% harassment. What does that mean? I interpret it to mean only that Netscape is being asked to testify _against_ MS. I've been using Win95 along with at least half a dozen different browsers (including about the same number of different Netscape versions), and never had any compatibility problems switching. Most recently I was running IBM Explorer 2.0 until the other day when I "upgraded" to the latest beta of Navigator--at which point Explorer stopped being my default browser. Navigator never asked if I wanted to make it the default, but now all my .htm and .html files have that Navigator look. As soon as this project is done, I'm switching back to Explorer, thank you. -Pete Loshin pete(a)loshin.com

1 0

Re: INTERNET SECURITY RISKS FOR CONSUMERS OVERBLOWN
by Andrew Loewenstern 17 Dec '03

17 Dec '03

> "If someone wanted to steal a credit card number, all they would > have to do is go to any gas station and look on the ground around > the pumps," says the CTO at Internet security firm Terisa Systems. Sure, if you wanted to steal a card number or two the ground around a gas-station would probably be a good choice. However, if you wanted to steal a thousand card numbers (or maybe even thirty thousand), just sniff packets off a hub near a large Web site that accepts unencrypted (or weakly encrypted) card transactions or hack your favorite ISP's machines. It really bothers me that officers at companies writing net commerce software are regularly quoted in the trade rags comparing the relatively little risk of a single net card transaction vs. a transaction at a restaraunt or gas station. We aren't talking about a crooked clerk who handles at most a few hundred cards per day or an unlocked dumpster with maybe the same number of carbons in it. We are talking about potentially hundreds of thousands of card numbers whizzing through a single point that could be easily (and undetectably) monitored and recorded with off-the-shelf-equipment for later analysis. Even if the transactions are encrypted, a single exploitable weakness discovered after widespread deployment could compromise massive numbers of cards. The stakes are much higher and this will invite much more sophisticated crooks to attempt to defraud the system. andrew

2 1

DigiCash releases protocol specs!
by Mark Twain Ecash Support 17 Dec '03

17 Dec '03

By popular request, DigiCash is releasing the protocol specs. The specs are available at http://www.digicash.com/ecash/protocol.html Please be aware that the doccument is work in progess. More specifications, including byte level descriptions of the message format will be added throughout the weekend. --Lucky Green at -- Mark Twain Ecash Support <mailto:support@marktwain.com> <http://www.marktwain.com/ecash.html>

4 3

[POINTER:] Crypto Articles in Dr. Jobbs Journal
by turner＠TeleCheck.com 17 Dec '03

17 Dec '03

For non Dr. Jobbs subscribers: Dr. Jobbs Journal has several articles on encryption, including an article by Ian and Dave on the Netscape crack, multiple encryption, and using MD5 for passwords. Also, there is a very interesting article by the author of Applied Cryptography (the Big Mac himself), looking at differential and linear cryptoanalysis of the DES algorithm. There are also some compression articles as well.

2 2

Re: SEN_sor
by Ed Carp 17 Dec '03

17 Dec '03

> From: John Young <jya(a)pipeline.com> > Date: Mon, 4 Dec 1995 07:50:16 -0500 > To: cypherpunks(a)toad.com > Subject: SEN_sor > 12-4-95. NYPeeper: > "Nearing the $500 Computer for Internet Use." > > Acorn is about to introduce a stripped-down machine for > Net surfing that sells for about $900. By stripping it > of its monitor and hard disk drive, and adding a > high-speed modem, Acorn executives say they can hit a > retail price less than $500. They plan to ship the > Netsurfer by early next year, and are discussing > licensing with Oracle and a number of American and Asian > companies. Oh, hell, even I can do *that*. Let's see ... motherboard, $100. Floppy drive and controller, $50. 14.4KB modem, $50. Case and power supply, another $50 or so. $250 profit. What's so tough about that? Not a bad deal for Acorn, if you ask me. Hell, maybe I'll go into business making the damned things for that kind of profit margin...

2 1

Commercial Apachessl
by s1113645＠tesla.cc.uottawa.ca 17 Dec '03

17 Dec '03

Hi Sameer. You mentioned the server won't be commercially free for licensing reasons? (erased that post, darn) The RSA ones? Would it be free for commercial purposes in Canada? (Are the problems restricted to RSA or also RC4?)

1 0

Re: INTERNET SECURITY RISKS FOR CONSUMERS OVERBLOWN
by Andrew Loewenstern 17 Dec '03

17 Dec '03

Scott Brickner writes: > Of course, the card company gets a big bill, and probably will try > to sue the site to recover, and both will pass those costs back to ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > the consumer, assuming they survive. The total cost is still pretty ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ > small to the individual. You just said it right there. The cost doesn't go away. Just because individual credit card holders each only have to pay for a small fraction of the fraud pie doesn't make it right for executives to be saying that it is safe. Any more than it is right for cellular companies to completely ignore security concerns because "the total cost is still pretty small to the individual." The point is that these costs, no matter how small at the individual cardholder level, are avoidable. Why should consumers have to pay for fraud that can be prevented? By ignoring security concerns, encouraging people to use card numbers in an unsafe manner, and then passing the fraud burden onto the individual customers, card issuers will basically be stealing money from the consumers much in the same way that cellular telcos have been doing for years. andrew

1 0

Re: Meeting notes from ANSI X.9 Meeting on Electronic Payment
by Rich Salz 17 Dec '03

17 Dec '03

> It doesn't appear that these people seem to care about > cash-like anonymous token-based payment schemes. Is that a valid > assesment? What is needed to make these people start caring about > that? I didn't go to the meeting. On the other hand, I notice Cybercash people in influential positions on the comittee. I'd also contact > > From: "Debbie O'Dell" <dlo(a)dsunix2.dsrd.ornl.gov> > > To: Electronic Commerce Working Group Reflector <fstc-ecomm(a)monroe.llnl.gov>

2 1

Re: Meeting notes from ANSI X.9 Meeting on Electronic Payment
by rah＠shipwright.com 17 Dec '03

17 Dec '03

> It doesn't appear that these people seem to care about >cash-like anonymous token-based payment schemes. Is that a valid >assesment? What is needed to make these people start caring about >that? My guess is, they won't. Ever. <Elmer Gantry Mode On> We're looking right into the maw of the beast, here, folks. This is how book-entry systems want to rule the world. It seems to me that all this X.BlaBla stuff is about interlocking directories, offsetting book-entries and audit trails back to the flood, so that if you break a trade, much less evade taxes or engage in other horsemanlike behavior, they can sic the Lawfully Deputed Authorities to slam you in the pokey. <Elmer Gantry Mode Off> Code words for this bunch include "non-repudiation", "Certification Authorities", "X.Whatever", and of course "information infrastructure", and is done usually in concert with, well, lawyers. Michael Froomkin has had some experience with these types already this month, and my anonmyous informant, "Erwin Corey" , the world's foremost authority, is in the thick of these things. I just got some mail from someone over at bnn who gave me the following argument, just to show how they think: 1. If we use internet-level (ISP) or link-level (SSL,etc) strong cryptography, governments can't keep an eye on the 4 horsemen, who would then rule the world, and the government needs to save us from that. 2. If we just use encryption for the "little" stuff, like credit card numbers, and signatures, and wire authorization codes, and the like, the Powers that Be will let us play with money on the internet. 3. So, go back to your sandbox boy, and let the adults get on with the Important Stuff, okay? Actually, argument #3 is implicit in all of this, but that's okay. Here's why. As one cursed with hyper-analogizing the universe, I see the X.whatever crowd as centralized surface transport, viz: Railroads and Ships. We're in the car and plane business, point-to-point, autonomously operated by the users of the technology for whatever they want to do. The time is, say, 1910. They look up in the sky at the airplanes rattling around, or they jump out of the way of a Model T clattering down the street, and they mutter, "let the adults get on with the Important Stuff". Cool. What they really don't understand is that the internal combustion engine of internetwork commerce, digital bearer certificate technology, is about to rock their world. The thing I hear over and over from these people is, "We just want to map all this great experience we have with the Law of Commerce onto the Information Superhighway, so we won't have to reinvent the wheel." They can't understand why *anyone* would want to remain anonymous. They can't imagine the benefits of uncontrolled autonomous agents, buying or selling things, (including themselves) in a global ecology of networks and silicon. Just like the transportation magnates of the turn of the century couldn't understand why someone wouldn't use a steam engine, because they're much more efficient thermodynamically than any internal combustion engine could ever be. The technology lends itself to economies of scale, and, well, it's lest wasteful that way. This is why J.Pierpont Morgan made a fortune consolidating railroads and steel companies. These people are just victims of their own success, really. They are the end products of years of meritocratic selection, schooling, and certification. They have been practically bred to inhabit the top of hierarchies. So, when they look at the internet, they can see nothing else but what they know. They see something like digital cash an anomaly, an error in the data, because even with a completely on-line system and Mark Twain Bank walking very gingerly on the thin ice of new economic technology, MTB's cost on a Digicash trade is $.50, while the most efficient book-entry system on the net, First Virtual, has to charge, what? $5.00 to break even? Wait until we can actually trust off-line payment schemes for *really* small stuff, and get profits from issuing nano-money. They don't get it. The network isn't a hierarchy. The network is a geodesic. You don't need offsetting book entries, you can trade digital certificates much cheaper. You don't need to control your software, you need to make it autonomous and set it free. Cheers, Bob Hettinga ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA (617) 958-3971 "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/ >>>>Phree Phil: Email: zldf(a)clark.net http://www.netresponse.com/zldf <<<<<

4 3