December 2003 - cypherpunks-legacy

Security First Network Bank, FSB. The World's 1st Internet Bank
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

Just got something in the post today asking for me to set up an account with them... - Daily reconciled bank statement and checkbook register; All transactions are logged for you. - No min balance - 20 free electronic bill payments per month... - ATM at Honor and Cirus.. - 200 free paper checks... - plenty of pre-stamped deposit envolopes - FDIC insured accounts (in case anyone ever steals my password..) - Wired Funds.. I haven't check out the web sight yet but it is at http://www.sfnb.com If there are no fees, I just might do it anyways and get the free-tshirt they are offering me! <grin> _______________________ Regards, Quarrels would not last long if the fault were only on one side. -Francois de La Rochefoucauld Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu 0C 69 D4 E8 F2 70 24 33 B4 5E 5E EC 35 E6 FB 88

1 0

Re: Random Number Generators
by Censored Girls Anonymous 17 Dec '03

17 Dec '03

Yes PERRYMOOSE (tm), this IS crypto related. The Hypothesis: Now....there oughta be a way to generate random numbers using the signal to noise ratio of just this very list! No, I'm not good at this sort of thing (we all know that) but it is there as a random variable, within a random variable. It's better than a clock for everyone gets messages differently. But you can change the s/n ratio and durations of s/n to generate the numbers on, so that it'd be pretty secure. Something to think about :) Love Always, Carol Anne -- Member Internet Society - Certified BETSI Programmer - Webmistress *********************************************************************** Carol Anne Braddock (cab8) carolann(a)censored.org 206.42.112.96 My Homepage The Cyberdoc *********************************************************************** ------------------ PGP.ZIP Part [017/713] ------------------- M8H,),S$8G>&.WP(8IRA`-M['+`Q%&_C"">5-F%LX@<_Q$;*P'',Q$Z/AA[8M MF=O0H+*%(-S%&>S%+FS&<LS%3(Q&#W1"<]2%`H^;,]^1C$'HBN8PX$4SYAU^ MPGD<Q0ZLA0D+,`MCT!LA**4M[-JPAK9F?40!AJ,CW"'%DR#:'9?Q)3[%<DQ` ------------------------------------------------------------- for next chunk to export --> http://dcs.ex.ac.uk/~aba/export/

2 1

Re: PGP in Eudora and other mail programs
by Joel McNamara 17 Dec '03

17 Dec '03

>I suspect that John-Doe will go through the normal new-product cycle -- >discovery of bugs, slight improvements, and then better integration of user >needs. Ultimately, as the product matures, I think that Steve's John Doe >will be seen as a revolutionary development in privacy equal to (in a far >less technical but more end-user way) PZ's original PGP. I really don't want to blow my own horn, but Private Idaho is much more than a PGP shell. It has supported remailer operations since it first appeared nearly a year ago. It also started supporting the c2 nym server several months ago. With no disrespect meant to tallpaul or Steve, I hardly think John Doe is revolutionary. I certainly don't consider Private Idaho to be anything other than an efficient, free shell for Windows users to enhance their privacy. And, I have yet to see a crypto/privacy "killer app." I am glad though, to see that other people are going beyond PGP shells and starting to write privacy-oriented applications that use the remailers and nym servers. Keeps me on my toes with new Private Idaho features. But more importantly, the more tools that are out there, the more people will be using them. I've always maintained that the interface is the gating factor to the wide-spread adoption of a technology. Joel

1 0

Re: PGP in Eudora and other mail programs
by rah＠shipwright.com 17 Dec '03

17 Dec '03

Will wonders ever cease. PGP-in-Eudora-for-Mac.... Cheers, Bob Hettinga -----BEGIN PGP SIGNED MESSAGE----- Sometimes even the gods are wrong... ;-) >> A few years later, still no PGP-in-Eudora. One would think that this would >> be a powerful way of distinguishing their product from other mail packages. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQgXKPgyLN8bw6ZVAQGvdwQAoiWetK6FRmvMqRnB1mXG+94zqRNOHz7C j8u6huNvp13N29ml2JaDcJtW67SvBKqLrkA2/k26eJM98bMpeDJtm8rAlO/zbgKO zmicy7hQSFbh9U6jxuFgzwSVofxYtvzuVk9I0cqgmp7diNHaUKLaw3x8mK7ItiS9 Hyl1fBWQiX0= =0/PO -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "Reality is not optional." --Thomas Sowell The NEW(!) e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Re: None
by Daniel Miskell 17 Dec '03

17 Dec '03

Mr. Nobody writes: >In article <Pine.LNX.3.91.960123192018.1008D-100000(a)zifi.genetics.utah.edu> >zinc <zinc(a)zifi.genetics.utah.edu> writes: >> i got this in the mail this morning. here's another blatant case >> of illegal export. names and exact addresses removed to protect the >> clueless. > >Why exactly did you post this message? I personally don't mind, but >am just curious. Why exactly did YOU post this message? I personally dont mind, but am just curious. Munster --- _________________________________ *!Cheese Doctrine:!* Though cultured over time, and aged to perfection, one must not yield to produce mold. One must also not belittle themselves by conforming to the "whiz", but melt over the unprocessed ideas of Ghuda. _________________________________

1 0

Re: "This post is G-Rated"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:58 PM 1/25/96, Bill Frantz wrote: >goal. The big problem is how are the labels attached to the programs. I >agree with Tim that it is probably imposible for individual Usenet >postings. However is should be possible for TV programs, and whole >newsgroups. Coincidentally, after writing my post this morning, I saw a report on CNN or CNBC about how broadcasters, networks, and producers are strongly opposed to the mandatory V-chip. Not news, but some of there reasons were: not enough time. The movie business produces about 600 hours of product per year, and the ~weeks it takes for the MPAA to view the final product and rate it (and then negotiate with the director about cutting out scenes to make an R-rated film into a PG, etc.) is marginally tolerable. Such is not the case with television, with many shows in a final version only hours before broadcast (and obviously some with even less or no advance time available). And remember that the MPAA rating is most definitely NOT a "self-rating." I see self-ratings of Usenet and mailing list posts as possible, just nearly worthless. And the reall contoversial stuff, this kind of goddamned fucking shit, will not get screened out. After all, I voluntarily rated this thread "G," and look what got through! (And it's only the tit of the iceberg, so to speak.) A meaningful "parental filter" cannot be done on-the-fly with self-ratings. Some minor steps can be taken, but not all worth the expense and hassle of a mandatory system. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Using the V-chip to Filter Commercial Advertisements
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 11:05 PM 1/25/96, Sten Drescher wrote: >their own. But do you really think that MTV will use a V-Code? (It >could be amusing if they did - 10 minutes of blank screen, then 2 >minutes of commercials when someone cranks all of their settings to >Full Filter.) One way to kill the V-chip dead is to announce hacks to the V-chip box that will do the _reverse_ of this: block commercials (advertisements, for any non-American readers) but pass programs. (Before anyone points out that such boxes have been built, based on volume levels, spectral content, etc., sure. What I'm speculating about is a subversive campaign to get the meme out there that the V-chip can be used as a filter of commercials.) Even if it is not done, fear of the possibility of this will kill the proposal. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Etch-a-sketch
by Jonathan Zamick 17 Dec '03

17 Dec '03

Ok.. I'm still getting mail regarding the etch-a-sketch keychain. Thus I'm going to look at how to get em for everyone. :) Just letting you all know. Don't bury me in 'I want one mail.' As soon as I have the info I'll get it out to the hungry crowd. Heh. At that point you can bury me happily. Jonathan ------------------------------------------------------------------------ ..Jonathan Zamick Consensus Development Corporation.. ..<JonathanZ(a)consensus.com> 1563 Solano Ave, #355.. .. Berkeley, CA 94707-2116.. .. o510/559-1500 f510/559-1505.. ..Mosaic/WWW Home Page: .. .. Consensus Home Page ..

1 0

CAs and Digital Timestamping
by JMKELSEY＠delphi.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- [ To: sci.crypt, sci.crypt.research, cypherpunks ## Date: 01/25/96 10:08 am ## Subject: CAs and Digital Timestamping ] At the RSA conference last week, it occurred to me that there's a really neat application for digital timestamps (as done by Surety). Whenever a CA (Certification Authority) issues a public key certificate, it should also digitally timestamp it. This provides a relatively clean way to recover from top-level CA key compromises. First of all, let's talk about hash trees. A hash tree (I think the idea was originated by Merkle, but I could be wrong) is a binary tree. Each node in the tree eventually winds up with a hash value associated with it. The bottom nodes on the tree are hashes of individual messages. The other nodes are made up of the hash of all their children. This looks like this: (pardon the ASCII art) : H_0 = hash(H_1,H_2) : / \ : H_1 = hash(H_3, H_4) H_2 = hash(H_5,0) : / \ / \ : H_3 = hash(M_0) H_4 = hash(M_1) H_5= hash(M_2) 0 : : The neat thing about this is that, if I know H_0, then when someone wants to verify that M_0 appears in the hash, they only have to tell me H_4 and H_2, and the position of M_0 in the tree. I can then find H_3 = hash(M_0), H_1 = hash(H_3,H_4), and verify that the final H_0 = hash(H_1, H_2) gives the right output value. (Compare this with a hashing chain, and you can see that, for large trees, there's a big advantage here. The number of values needed to authenticate a given message in this tree is log_2(number of messages in the tree), while the number of values to verify a chain is is the whole number of messages in the chain. In the digital timestamping service offered by Surety, they use hash trees of this kind, because this allows efficient verification of a digital timestamp. The idea behind this is that a message is hashed into the hash tree, and that the final value of the hash tree each day or week is widely published, including in the New York Times. So long as it's not feasible to go back and change that value, and it's not possible to find collisions for the hash function, any hash value that appears in that tree must have been presented to the timestamping people at some point before that tree's final hash was calculated. Here's how we use this in having a CA sign certificates. CA Signs a Key: 1. At the beginning of the day, the CA generates a random value, R_0, and has it digitally timestamped. The resulting timestamp is used as one of the entries in today's hash tree. (If the CA is their own digital timestamp service, then they'll have to use the previous day's ending value, which is reasonable enough. They'll also have to work a lot harder to publish this value each day or week.) 2. For each certificate to be generated: a. The CA verifies the information in Certificate_u, then signs it with SK_{CA}. Certificate_u contains some indication of the time and date. b. The CA hashes Certificate_u into its daily hash tree. c. The CA sends Certificate_u to user u. 3. At the end of the day, the CA publishes its own final hash tree value, and gets this value digitally timestamped. (This amounts to having the CA act as its own "node." for the timestamping service.) Now, imagine that the CA's key has been compromised. (We have to assume that the CA's daily operations were OK--if not, there doesn't seem to be a clean way to recover cleanly.) The person who has the CA's key can issue false certificates. After a while, one of these false certificates are noticed. How do we recover? We use the hash trees and the digital timestamps which we've made in the past to verify each certificate presented for recertification. The digital timestamps allow us to immediately verify that this certificate was issued by this CA at this time. And we can be certain that this hash tree is correct because it's been digitally timestamped. What this does, essentially, is to allow us to quickly recover from key compromises. We still have problems if someone can take over the operations of our CA for a few days or weeks, though in that case, we probably know the likely dates. No compromise at the CA can put a different date's timestamp on a certificate. Now, I should note that I think Merkle talks about using hash trees to do public key certificates, in his thesis, and the idea may be patented. (It's been a couple of years since I looked at his thesis, so this is a little hazy.) However, we're not using them here to provide certificates--we're using them to authenticate the certificates in the event of a catastrophic key compromise. I don't think Merkle talked about this, but I could be mistaken. (At any rate, I've never seen any mention of it since then, though it's an obviously useful idea.) If the tree structure is patented, then we could still do this by using chains or some other structure. Does anyone know if this basic idea has been proposed before? I am pretty sure I haven't seen it, but it seems pretty obvious now that I think about it. We could even recover using this method from a break of the hash function supported (so long as the timestamps are done with multiple hash functions, and at least one isn't broken), or the public key algorithm used. --John Kelsey, jmkelsey(a)delphi.com / kelsey(a)counterpane.com PGP 2.6 fingerprint = 4FE2 F421 100F BB0A 03D1 FE06 A435 7E36 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMQfn70Hx57Ag8goBAQETUQQA3S7k8rrYDud5N3uVdUqSVHC3VH+Tpmuu wcRisf8PrYX/I9Q4vBTN7SS0H30Xl1bRTQyS1mQP+CuyBlESi1qn0OMKbgAYPndd 1qYOvrX/29fMbhrO7VQjAcSAHpCZOvoVfsq0fWwv4zzUIhJBZNFnMxdSm4eNrmEv U3/oo5CiM2o= =7TIl -----END PGP SIGNATURE-----

1 0

Re: "This post is G-Rated"
by williams＠va.arca.com 17 Dec '03

17 Dec '03

Tim May writes: > So deal with the hypothetical I gave: someone like me sets out to "nuke" > the labelling system by deliberately mislabelling his posts! If you have > labels but no means of stopping my actions, see what results. What if there was a flag on each message which the author could leave "UNSPECIFIED" or indicate "NOT INTENDED FOR KIDS." You could attack by marking a bunch of bland stuff "NIFK" or you could leave some porn "UNSPECIFIED". Either way, I think the situation is better for kids. I hope that the majority of Internet users are not actively trying to get porn to kids. > A meaningful "parental filter" cannot be done on-the-fly with self-ratings. > Some minor steps can be taken, but not all worth the expense and hassle of > a mandatory system. I see labels as helpful rather than restrictive. A label provides additional information to help people find the information that they want. That information can also be used to help you cut out the information you don't want. If parents want to use this flag because they think it might help their kids, great. Maybe nobody would use the flag, but I don't see how it could hurt. If I had kids, I would appreciate having the option of sorting out all the stuff that is "NIFK" by the author. --Jeff

1 0