December 2003 - cypherpunks-legacy

why no FV defenders
by cman＠communities.com 17 Dec '03

17 Dec '03

[in response to Ted Anderson <ota+(a)transarc.com>, who wondered why cypherpunks are so unanimous in denouncing FV, when we are usually at each other's throats.] Most of the pile-on can be attributed to the fact that FV does _not_ really see encryption as part of the solution. Other than bits of lip service here and there in technical groups, they actively denounce it when they don't think anyone who knows better is watching (I've seen it with my own eyes at banking conferences, etc.) Their extremely supercilious attitude doesn't help either. The fact that their commerce model is skewed towards long-settlement, non-anonymous transactions of extremely soft goods makes them unsympathetic -- although, say, the Digicash people are just as condescending and certainly _more_ difficult to deal with on a business level, they have a product that is more applicable to transactions cypherpunks are generally concerned with, so they get pile-ons that are maybe half this size, and usually have some defenders. Also, clearly, Digicash and other vendors are involved in producing cryptographic products, whereas FV is actively involved in spreading FUD about the abilities of crypto products in general... this is sort of like advocating cat torture on rec.pets.cats and expressing amazement at the negative response. This is not to say that there isn't a problem with the current state of operating systems, especially PC operating systems, or to say that crypto is magic dust you can sprinkle & make things secure but I think there's a general belief here that the ultimate solution to these problems has a substantial role for cryptography, and that cryptography can be used even today to reduce risk to acceptable levels in consumer financial transactions. FV does _not_ believe either of these things, although I'm sure NB will pay some lip-services on the "eventually" score. ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

1 0

Re: Crypto Exports, Europe, and Conspiracy Theories
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 11:06 1/26/96, Adam Shostack wrote: >Timothy C. May wrote: > >| You have to ask yourself this question: "Why are there no cryptographically >| strong products--finished products, not specific ciphers or chunks of >| code--developed in Europe and freely imported into the U.S.?" > > There are. If you buy a Gauntlet Internet firewall from TIS, >you can also buy a German T1 speed DES card for it. I believe the >code was written by TIS's London office. The Israeli Firewall-1 >(version 2) firewall offers VPN (Virtual Private Networks) with some >decent encryption scheme. The German company is CE Infosys -- and they make a PCMCIA DES card also, BTW. The PC card is a decent performer but I haven't tested speed (of the interface) for the PCMCIA card. The code driving the card was written in Glenwood MD. The Gauntlet uses normal SWIPE protocol. It can not be exported at this time. However, there is a plan afoot at TIS to produce a version of Gauntlet with full 56-bit DES SWIPE -- but with TIS CKE added to the communication stream and therefore making the product exportable. For more information, you can check TIS's web page www.tis.com - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

ANNOUNCE: Experts Predict End Of Secure Communications (makes FV's announcement look pretty silly too)
by cjs＠netcom.com 17 Dec '03

17 Dec '03

EXPERTS PREDICT END OF SECURE COMMUNICATIONS (East Bumbleton, Arkansaw) Experts from Really Neat Idea Labs have predicted the end of secure communications on the internet. The firm today announced that anyone watching another person enter a credit card on a computer could possibly get that person's credit card number. A spokesperson for RNI Labs said, "Wow man! This is like an incredible discovery, man. If you can like see someone entering their card number then you can like look at what keys they push and like get their number and like charge stuff to them. There is like no hardware or software on earth that can like prevent it." The spokesperson went on to say that the reprocussions of their discovery could lead to world-wide economic chaos, a rebirth of the third reich, and the 27th coming of Jesus Christ. In a related story, retired talk-show host Johnny Carson is under federal investigation. An anonymous tipster told authorities that Mr. Carson has been using his "Amazing Karmack" hat to guess the credit card numbers of newly mailed cards. Mr. Carson could not be reached for comment.

1 0

Re: PPP link encryption?
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 6:36 AM 1/30/96 -0500, Alexandra Griffin wrote: >Is there any software out there on the net for doing real-time, >transparent encryption of a PPP link? >... >Finally, could someone make a ballpark estimate as to the amount of >additional latency that would be added? Ballpark estimate: If the encryptor receives a complete packet before encrypting and forwarding it then there would be an additional packetSize/byteRate + encryptionTime seconds added to the packet's transit time. If the encryptor encrypts "on the fly", passing the bits of a packet as their are received, then it would add almost no latency. However, the encryption algorithms would be limited to stream cyphers, which have security and error recovery implications. See "Applied Cryptography" for details. ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: New Mailing List (encrypted)
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 1/30/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Sat, 13 Jan 1996 13:42:49 -0600, <perry(a)vishnu.alias.net> wrote: > >> I have installed PGPdomo on vishnu.alias.net. I've also >>created a new mailing list that you can join if you wish. It's a >>closed mailing list, so subscriptions must be approved. What makes > >If we have attempted to subscribe, but received no response, does that >mean that we didn't get approved? If so, how can we "qualify"? I have noticed that the software they are using is VERY picky about he formatting of the request and how it is encoded in PGP. To get it to work, I had to use the EXACT instructions posted to get it to subscribe. The PGPMajordomo software is a great idea, but in practice it has not been that fun to use. The biggest problem has been that the mail client I use does not do PGP that well. Hopefully the state of E-Mail support for PGP will change. Another project to add to the list... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 hua[SMTP:hua@chromatic.com] wrote: >> the credit card companies in detecting fraud and locating criminals is >> quite real. > >Retail clerks are not lone bandits. My point is not that all retail clerks are bandits. Most are trustworthy, but surely any long time CC user has given their card to someone who would rip them off if they thought they could get away with it. My point is that CC #'s are not national security secrets, they are disclosed to potential adversaries regularly. >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. If the credit card companies are willing to take the risk, they >> will (and are). > >Federal law does not require that a company stay in business once it >has entered the banking market. The point is FV's post relies on a frightening and false premise - that the users are exposed to one or more financial risks by FV's keyboard sniffer threat. dvw

1 0

Re: Denning's misleading statements
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 20:49 1/27/96, Timothy C. May wrote: >I've never met Dorothy Denning, so I hesitate to characterize her as a >villainess. But certainly she's the only noted cryptographer I know of >who's gone so far out on a limb to defend a position the vast majority of >computer scientists, civil libertarians, and cryptographers scoff at. I've met some others -- most noteably Silvio Micali [but he has a financial interest in that position]. However, DERD is the only one I've met who is all the way over on Freeh's side. - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

Reply Blocks and Nyms: newbie question
by bruce＠aracnet.com 17 Dec '03

17 Dec '03

I'm almost certainly going to be changing my address in the next few weeks. I'd like to keep the same nym account. Can someone take a stab at explaining how to feed the relevant info to C2?

2 1

RE: Cyphercoding Training Wheels??
by Michael E. Carboy 17 Dec '03

17 Dec '03

Greetings All, I have been lurking as a newbie on the cypherpunks mailing list for 'bout one month. Have ordered Koblitz book on Number Theory and Applied Cryptography. As I slowly (and probably painfully) learn some number theory, I would like to start coding, particularly as it would related to encrypting and decrypting stuff. I ask the community's input as to whether I should use visual basic or visual C++ ??? I am using a windoze95 platform. Any comments would be welcome.. thanks Michael E. Carboy carboy(a)hooked.net finger for key

2 1

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:25 1/29/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >The Notes R4 approach gives the best of two fairly unpleasant worlds. You can >export crypto if you either limit yourself to 40 bits [...] > >Notes R4 didn't give up anything to get this. Of course Lotus gave something up for it. The voluntarily made sure that even the supposedly non-GAK domestic version provides relatively easy access for the authorities. Sixty-four bits are an inconvenience, but nothing more. If Lotus had wanted to make the domestic version GAK free, they would have used 128 bit. In the end Lotus caved in twice: they released a 'super easy' GAK international version and a not 'quite so easy' GAK domestic version. Sixty-four bits is GAK. Period. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0