December 2003 - cypherpunks-legacy

WTO an even worse possibility as Inet regulator
by attila 17 Dec '03

17 Dec '03

based on an article from the (London) Financial Times [available from John Young at jya(a)pipeline.com with subject line WAY_lad], a very credible white paper is circulating for the WTO to establish an internet CZAR to regualate the Internet and level the playing field world wide. personally, the Feds and the FCC are bad enough --now they want to have a **global** bureaucracy play god -??? are we ready to go back to UUCP?

2 2

Re: Credit card theft Re: The future will be easy to use
by Rev. Mark Grant 17 Dec '03

17 Dec '03

On Thu, 30 Nov 1995 s1113645(a)tesla.cc.uottawa.ca wrote: > What if it's an ecash password getting stolen? Who's liable? (lemme > guess, your money's gone, tough luck!) >From what I remember of the contract, that's true, the bank appear to take no liability for ecash (check the WWW page for the real details). As I'm not likely to have more than about $ 50 of ecash at any time, I'm not *that* concerned about it. Big users could transfer payments back into their dollar account ASAP to avoid most of these problems, just keeping enough in the ecash account to make any payments that may be required. It's not really any worse than physical cash, as long as the software is reliable, which it appears to be (I've lost payments in the past, but cancelling them has always worked to get the money back). > Disclaimer: I don't have a marktwain account at the moment, so I can't > say a thing about the security of the system. I wish them the absolute best > of luck. I do, and yes, from conversations with them it appears that if someone gets your secret key and password they can clear out all the money from your ecash account. This is potentially a real problem for shops, which have to have a secret key file on the machine they run from. Currently this even applies to shops that only *accept* ecash, though there may be an accept-only server out sometime, and I found a way to delete the secret key itself from the file and still have it work (I forget the exact details, you basically zero 256 bytes of the file that contain the key, which appears to be 768-bits according to the debug output, so I don't know what the extra bits are used for). Shops that pay out need to have an *unencrypted* secret key on the server, which is scary, but there's not much you can do about it if you're running on an insecure server... The only way around it that I can see would be to withdraw ecash using a secure machine and upload it to your server, so that the shop could make payments until the ecash supply was depleted and then you'd manually have to withdraw more. Then if someone broke into your account they'd get the ecash, but not the key, and you could limit your exposure to the amount you uploaded at any one time. I'll probably be doing that once the check I mailed over gets into my ecash account. This is strictly my understanding of the system based on what I've been told, so hopefully if I'm wrong then someone from DigiCash will correct me. Mark

1 0

Re: Netscape gives in to key escrow
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 7:26 PM 11/30/95, Ravi Pandya wrote: >If you're looking for an alternative Web browser for Windows, we just made >ours available for free at www.netmanage.com. It's fast and reliable, and >supports HTML 3.0, inline video, software distribution, VRML (NT version), >Real Audio, TrueSpeech, etc. This shows the price Netscape could pay for taking a pro-surveillance, anti-privacy stance. Various alternatives to Netscape exist (even on the Mac), despite attempts to make "Netscape-enhanced-encoding" (or whatever it's called) the standard. I expect alternative browsers will catch up fairly quickly. (As an aside, and based on my past experiences at Intel during its rapid-growth phase, it may be tough for Netscape to keep people motivated and focused on development, what with all the "distractions" of a stock price of $140 when it was expected to go public at $14. CNBC reported yesterday that several _secretaries_ at Netscape have cashed in $600K stock options....I can imagine a lot of folks are eager to leave to enjoy their new wealth, but will stick around for the future stock options. This becomes a real drag on productivity, based on my experiences and those of my friends at various other start up companies.) I also expect that this pro-surveillance, anti-privacy "stumble" by Jim Clark will either be quickly "clarified" (but perhaps nothing really changed), or Netscape will suffer a black eye in public relations, with many "Cypherpunk"-type people adopting a "Just Say No to Netscape!" stance. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

whither NetBill? (micropayments)
by Thomas Grant Edwards 17 Dec '03

17 Dec '03

NetBill (http://www.ini.cmu.edu/netbill/) appears to be a great way for implementing micropayments. Does anyone know what the deal is, or did Visa sign on just to keep it from happening? -Thomas

1 0

Re: Netscape, Corporations, and GAK Support
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:08 PM 11/30/95, hallam(a)w3.org wrote: >Folks, lay of Netscape on this one. _EVERYONE_ is doing Terissa for the feds to >use themselves. There are reporting requirements (FOI) which most people >on this >list seem to enjoy which make the privacy issue moot. There are other >people who do >not want to have non escrowed data flowing over their internal nets, nuclear >installations etc. Ah, but Jim Clark's comments were as follows, and indicate that the issue is the _government_ reading _private Net communications_: ---section of interview or speech with/by Jim Clark of Netscape, emphasis added by me--- To secure Net communications, the government will need to have access to private data exchanges ^^^^^^^^^^ ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ using what is known as a key escrow security system, said Clark. He added that an invincible security system for the Net is possible, but such asystem won't be built unless the government ^^^^^^^^^^ has a stake in it. "That's where key escrow comes in," said Clark. Key escrow is a controversial security system advocated by the Clinton administration that gives the government access to private Net communications. It uses public key cryptography, a system ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ in which messages are coded and decoded using a set of private and public keys. In key escrow, the private key is held by both the individual or group and the government. The government can ^^^^^^^^^^^^^^^^^^ use the key ostensibly to read messages for intelligence and national security reasons. ---end of section--- This is not then just an issue of supporting voluntary key escrow for corporations, nuclear installations, germ warfare labs, and the Church of Scientology, this is GAK, pure and simple. Phill, very few of us are opposed to the voluntary use of escrow schemes. I, myself, would be interested in a robust system wherein my lawyer, for example, could have a "duplicate key" to some of my files. We have discussed this issue many times. Truly voluntary key escrow means that the criteria described above by Jim Clark, that government access to private communications is "where key escrow comes in," would be impossible to achieve. Clearly, the type of key escrow being supported by Jim Clark, Dorothy Denning, David Sternlight, Stuart Baker, and others is hardly voluntary. >Key escrow is not bad in itself. It is the idea that individuals be forced to >use it for private conversations that is the bad idea. Carefully read Jim Clark's direct quotes and the views attributed to him in the article. > >If people want to argue "make the technology avaliable and it will be >abused" then >let them. Just remember that we normally argue the other side of the case. No, the issue is that the proposal is explicitly GAK, not a voluntary system. Details of deployment are of course murky, and this firestorm may help to kill it for now, but the issue is clearly that Jim Clark is saying the government needs to be able to read private communications and that key escrow is needed. Given that he is the Chairman of Netscape, this is worrisome. --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0

Getting a copy of the Jim Clark speech
by Raph Levien 17 Dec '03

17 Dec '03

I called Netscape public relations. Here's what I found out: 1. Netscape PR does not keep transcripts, etc., of Jim Clark's speeches. 2. You can order a tape of the speech from Conference Copy for $12. Their phone number is +1 (717) 775 0580. Be advised, though, that it will take three weeks. If we are lucky, an amateur recording technician (trained by the Grateful Dead, perhaps?) will come out of the woodwork before then. Failing that, maybe a Fair Witness was there and is willing to speak. Raph

2 1

query...
by BlackHeart 17 Dec '03

17 Dec '03

Reply to: DR940788(a)caper1.uccb.ns.ca I am currently putting together an e-zine covering computer security issues, non-mainstream music, and basically anything else people want to write about. This is an open query for submissions on any kind. Here are good examples of what I will consider putting into the zine : --------- Good chance of getting in: a. interviews, quotes, etc. from "net personalities", writers, band members, people with interesting computer-related jobs/hobbies/etc. b. people involved in the field of computer security on either side of the wall, hackers, phreaks, system admins, police, etc. and their tales c. reviews of independant, or non-mainstream software, movies, music, etc. d. any kind of new digital tech. that is interesting and unique, a description and review e. basically anything else that is related to the information age, digital, cyber (even though i hate the word), 'net related, etc. --------- NO chance of getting in: a. political views/essays which are not a concern of the computer and/or net community b. fiction of ANY sort (sci-fi, cyberpunk, etc, etc.) c. anything else not related to alternative or "tech" field (ex - reviews of mainstream albums, movies, etc., also articles on things such as the environment and gay rights will be turned away, simply because this is not what the magazine is aiming for) --------- If you have an album, tape, CD, software, device, etc. you want reviewed, send it along to : Terminal Obsession P.O. Box 831 Sydney, Nova Scotia CANADA B1P 6T7 If you are interested in subscribing to the completed 'zine, wait until you see an announcement, as the zine is not complete as of yet, and may not be for a short while, so i have nothing to send you yet!

1 0

Netscape's Delicate Balancing Act
by tcmay＠got.net 17 Dec '03

17 Dec '03

The market valuation of Netscape Communications is not specifically a Cypherpunks topic, though many of us interested in it, and/or use Netscape. But there are some issues about Netscape's future product plans which may affect market valuation, and which also could hinge on PR issues like Jim Clark's apparent support for mandatory key escrow. To wit, Netscape is currently valued at $5 billion or so, despite having essentially no revenues or profits (sure, it has a little of each, but not much). This is more than the market capitalization of many sizable, respected companies. Companies like General Dynamics, Apple Computer, CBS (which was just sold to Westinghouse for $5B). Granted, Netscape investors are betting on the come. (And contrary to what someone said, investors in companies like Netscape are not mostly interested in profits. Rather, they are interested in selling at a higher price, for whatever reason. This is also known as the "greater fool" theory: that no matter how high the price of a stock, there is some greater fool who will buy it a higher price. Of course, the corrolary to the greater fool theory is that there is usually a greatest fool.) So, can Netscape keep a $5 billion valuation? (And more to the point, can it double from where it is now, say, and sustain a $10 B valuation? I am skeptical, personally, but I've been wrong before.) What Netscape has to offer is based on a *public* standard, the Web and all the various pieces that so many companies are supporting. Netscape's _server_ market--which is said to be where the revenues are mostly coming from--is likely to face heavy competition. As is the browser, of course. (Spyglass Mosaic, Ravi's company, HotJava, CyberDog, MacWeb, and a bunch of others). Scenario #1: Netscape sticks to an open standard. Hard to see what keeps the valuation at $5 B with so many free browsers, free servers, low-cost servers, etc. (From the browsing side, "brand loyalty" is probably minimal: I've used several browsers, and currently use Netscape 1.1N for _some_ of my Web needs. I'll switch "on a dime" to another browser if it offers features I like. Others I have talked to feel the same way. I think "loyalty" to a particular browser is close to nil. Much less than loyalty to a text editor, for example.) Scenario #2: Realizing this, Netscape seeks to "differentiate itself" by proprietary technology. "'Nuff said." I can't see any means of "proprieterizing" the Web that Netscape could hang on to. Any good ideas will be quickly copied or reverse-engineered by other companies and groups. Unlike a chip company, with various and complicated secrets tied up in internal chip design data bases and in billion-dollar fabrication plants, what could a browser or server really keep secret? Unlike a company like Adobe, with various programs whose functionality can mostly be protected from copying by use of copyright laws, a Web browser that operates on public standard files in standard ways will be hard to protect. (Ironically, Netscape's valuation is significantly higher than Adobe's, and Adobe had something like $700 million in yearly sales and $100+ million in profits.) So, it is my thesis that "brand loyalty" to Netscape is ephemeral, that users will flock to the Next Whizzy Thing faster than you can say "price collapse." The connection with crypto and key escrow is that any bad publicity, any hint that Netscape is signing-on to be an agent for Big Brother, could hasten this conversion. While I would never, ever suggest to anyone that the sticker idea I devised a few years ago--"Big Brother Inside"--be applied here, I can imagine others will. Netscape is in a very delicate balancing act. Jim Clark may turn out to be the Karl Wallenda of the Web (with no Net to catch him). --Tim May Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

2 1

Re: Netscape gives in to key escrow
by vinnie＠webstuff.apple.com 17 Dec '03

17 Dec '03

GAK or is it Gack!!! You know, one possible solution lies in the direction of Apple's CyberDog. It is based on OpenDoc and should be portable to windoze, I hate to say Rah told you so but... Even with all the ITAR silliness, even if on the contigincy that Apple can't provide a SSL or whatever in thier HTML part, YOU can always write your own HTML part, (its just not that complicated) in the Cyberdog environment and override the Apple CyberDog HTML part. This looks like a great opertunity for some Cypherpunks to write code, and code that people DO care about.. a CypherPunk CyberDog part to replace the Apple HTML viewer with one that has hooks for an encryption API (GSSAPI?) (lawyer types beware: This is definitely my opinion and you and I both know Apple is old enough to speak for itself.) ------------- Vinnie Moscaritolo Apple DTS Sniper "One Shot..One Kill" http://webstuff.apple.com/~vinnie/ Fingerprint = 4F A3 29 81 50 E4 04 F2 78 25 01 87 6E A2 14 6A --------------

2 1

Re: Netscape, Corporations, and GAK Support
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 10:09 PM 11/30/95, Timothy C. May wrote: >To secure Net communications, the government will need to have access to >private data exchanges > ^^^^^^^^^^ >^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ Sorry about the misaligned text and emphasis marks--it looked OK when I was composing the message, but some hidden characters must've been present when I cut-and-pasted the Clark text. I think you all get the gist, though. --Tim Views here are not the views of my Internet Service Provider or Government. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 | black markets, collapse of governments. "National borders are just speed bumps on the information superhighway."

1 0