December 2003 - cypherpunks-legacy

Please help
by Rich Salz 17 Dec '03

17 Dec '03

Please help. Somehow, someone signed up the "cypherpunks" mailing list to your "ZD Net Update" electronic newsletter. Our mailing list, with over a thousand members, is for the discussion of cryptography and technical means of achieving privacy and anonymity in the emergent digital world. There is some overlap between your publication and our mailing list, which is why some well-meaning individual "signed us up." It's pretty slight, however, and interested parties can sign up individually. So, please remove cypherpunks(a)toad.com from your mailing list. As always, if you ahve questions about the propriety of this, you can follow the internet conventions of writing to postmaster(a)toad.com to double-check. Thanks. /r$

1 0

Re: PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT"
by anonymous-remailer＠shell.portal.com 17 Dec '03

17 Dec '03

On 18 Dec 1995, Ian Goldberg wrote: > In article <199512151800.KAA11304(a)jobe.shell.portal.com>, > <anonymous-remailer(a)shell.portal.com> wrote: > >On Mon, 11 Dec 1995, Michael Coates wrote: > > > >> PAY-OFF TIME FOR BUG-BUSTERS, NETSCAPE PLEDGES "DOGFIGHT" > >> Netscape Communications has awarded two software sleuths $1,000 each > >> for finding security gaps in its Netscape Navigator 2.0 software. The > >> company also awarded gifts to 50 other contestants in its "Bugs Bounty" > >> program for identifying non-security problems. (Wall Street Journal > >> 11 Dec 95 B7) > > > >Can anyone tell me whether Ian Goldberg and David Wagner got their $25,000 > >from Netscape for finding the HUGE security flaws in Netscape's existing > >product line?? > > > >I can't remember whether they got anything or not ... > > That would be no (well, except for the nifty T-shirt from Sameer; Thanks!). Not anything?? That's shameful ... where on earth are the values in America, today? AT&T and Netscape have jointly made a small fortune distributing this product, and yet NEITHER company feels that the software engineers who "voluntarily" made a difference -- a couple of students -- deserve even a wooden nickel for the ideas which were used. It's absolutely shameful. But then, I guess that AT&T and Netscape have no shame at all. They just steal "intellectual property" from students, and don't even pay a token amount. And people wonder what's wrong with Aemrica? > - Ian "There's a reason people talk about `starving grad students'..." >

1 0

Correct URL Crypto Law Survey
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

>http://cwis.kub.nl/~frw/CRI/projects/bjk/lawsurvy.html Sorry, the URL should be: http://cwis.kub.nl/~frw/CRI/projects/bjk/lawsurvy.htm Bert-Jaap.

1 0

Re: cyphernomicon FTP site?
by Alan Olsen 17 Dec '03

17 Dec '03

At 12:59 AM 12/20/95 -0800, you wrote: >At 9:18 PM 12/19/95, Vinod Valloppillil wrote: >>Anyone know where I can FTP a full copy of the cyphernomicon? [Much deleted] >Anybody who plans to download the entire linear file and then print it out >must be missing a bits in his shift register. There are reasons to want a non-html version. The best being uploading to your favorite text-oriented BBSes. (Or crypto-oriented BBSes.) Not everyone has access to the web. (Yes, I know it is blasphemy...) | Remember: Life is not always champagne. Sometimes it is REAL pain. | |"The moral PGP Diffie taught Zimmerman unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

Re: King Kong Does e$
by Hal 17 Dec '03

17 Dec '03

Thanks to Bob Hettinga for typing that long message about the Microsoft "ecash" scheme. That is some nimble note-taking. I have a few comments on the scheme as Bob presented it, and as it compares to Digicash. I will follow up with some commentary about the politics involved. > Customer chooses secret s, serial number n, n=h(s) and amount. > Customer pays bank (by any method) the amount of the desired banknote > bank signs serial number and amount > Transaction may be anonymous (physical cash purchase at bank) pick > serial number, bank uses private signature to sign the serial number. >[...] > How is it used for payment > Payer simply gives bank note to payee by handing over the secret > payee immediately exchanges the banknote for new ones anonymously, if > desired > Old banknote is now invalid, since bank has its secret; hence payer > can't respend it > If the bank note is already invalid, bank rejcts exchange and informs > payee. > "In effect, these are disposable banknotes" The withdrawal protocol has some similarities to online Digicash ecash. In that system, you choose a random number s, calculate a one way function h(s), and get that signed by the bank. Unlike in the Microsoft scheme, blinding is used for the signature. I imagine Microsoft avoids blinding because of the patent situation, and possibly due to legal concerns about anonymity (more on this below). With Digicash, the coin is then the pair s, SIGN(h(s)). This is then given to the shop as payment. It can check the bank's signature, but that is not enough; being an online scheme, it must also turn the coin in at the bank to prevent double spending. The bank checks the signature and that the coin is well formed to accept it. The Microsoft scheme is like an unblinded version of this. The bank simply signs h(s) and gives that to the customer. This allows a simplification in the spending. Instead of passing s, SIGN(h(s)), it is enough just to pass s. The payee gives this to the bank (since this is an online system), which given s can calculate h(s) and check this against a list of all valid coins. It knows the valid coin numbers because it saw them when it signed them (unlike with Digicash). So there is a slight space savings in the spending protocol. It is also not necessary for the messages to and from the bank to be encrypted during the withdrawal protocol; neither knowing h(s) nor SIGN(h(s)) will allow an attacker to spend the coin, since he doesn't know s. A similar thing is true of DigiCash, though, where the blinded pre-signed or signed coins are useless to an attacker since he doesn't know the blinding factor. The big problem then with the Microsoft system is that it is not anonymous. As a result, it is technically not electronic cash, at least as the word is used in the literature. However we are seeing so many proposals like this, all of them wanting to capitalize on this magic word "cash", that I suppose the definition has to be considered to be shifting. In the new usage, virtually any payment system can be called cash if there is some way that users can be anonymous in using it. And since by allowing anonymous accounts virtually any payment system can do this, the word is becoming meaningless. The problem I see in practice with using their cash anonymously is how to buy it. If I have an account with the Bank of Microsoft, and I withdraw some "mcash", deducting it from my account balance, that mcash will be linkable to my account when I spend it. In order to be anonymous I have to buy the cash anonymously. I can walk into the local bank with a floppy and some dollar bills, but that is not practical in general. I could use mcash to buy some more mcash, but even if the second transaction is anonymous, the bank knows that I was the one who withdrew the first set of mcash, so it can link me to the second set when it is spent. The only good solution I can see is to use Digicash ecash to anonymously buy Microsoft mcash, but I doubt that that is what they had in mind! Frankly, what I see in this message is another example of something which is starting to become common: marketing to cypherpunks. In a way it is a very positive sign, that our views and concerns are becoming so well known and widespread that companies like Microsoft and Netscape are doing their best to keep on the good side of people like us, who are concerned about strong privacy and security. In some ways our attitudes are becoming dominant on the net, thanks to the many excellent writers here, as well as magazines like Wired, and groups like the EFF and other interest groups. But this influence is making us a target of companies who know that gaining our approval, or at least avoiding our criticism, is important for success on the net. In many cases, such as the recent flap over Netscape's attitudes towards key escrow, I detect a whiff of two sidedness, in which one attitude is presented for the benefit of government and law enforcement interests, while another posture, more acceptable to cypherpunks, is adopted on the net. With Microsoft, they use the magic word "cash" a great deal, in my view hoping that we will line up in favor of the idea. But as I have explained it is not really anonymous, no more so than any other payment system. And it is not at all clear that the kinds of anonymous accounts that would be necessary to really make it anonymous will be allowed. In that case, Microsoft can just shrug and say, "well, we tried." They get the best of both worlds. They make the government happy by providing a traceable payment system, while they look good on the net by pushing "electronic cash". I don't have any proof that this is exactly what is going on. But it is possible, and I think we have to be skeptical and at least open to the possibility that this kind of manipulation is occuring, no matter how many assurances we get from the companies involved that they are really on our side. Finance is a high stakes business and there is a lot of government regulation involved. Where our interests and the government's diverge, we need to watch closely to see whether the companies' actions match their words. This kind of marketing is going to continue to increase, I expect. Hal Finney

2 1

KOD
by John Young 17 Dec '03

17 Dec '03

Congratulations to the cypherpunks named Newsweek's "Big Thinkers of tomorrow -- the list of 50 People Who Matter Most on the Internet." In the December 25 issue. And, sympathy for the Kiss of Death envynescent celebrity.

4 3

CFS and Linux
by Alex de Joode 17 Dec '03

17 Dec '03

Is there anyone out there that has CFS running with Linux ? It installs fine on BSDi 2.0 but I'm unable to install it under Linux, I would appreciate it if some one would help me out. -AJ-

5 6

FTC Privacy Initiative (fwd)
by Jyri Kaljundi 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 20 Dec 1995 09:22:11 -0800 From: Internet Marketing Discussion List <internet-marketing(a)popco.com> To: internet-marketing(a)popco.com Subject: FTC Privacy Initiative From: Lewis Rose <lewrose(a)arentfox.com> The US Federal Trade Commission has launched a "Privacy Initiative" to investigate whether the information collected at websites (either that affirmatively submitted by a visitor via a form or information collected based upon a visitor's selection of pages at a site to reflect personal interests) should be the subject of regulation by the FTC. To get background on this effort, you may want to read a speech by FTC Commissioner Varney on Electronic Commerce and Privacy which is available at the FTC's site under speeches (www.ftc.gov) or the Advertising Law Internet Site (www.webcom.com/~lewrose/home.html) under speeches. This week the staff of the FTC established a mailing list to allow interested parties to discuss the issues surrounding the privacy interests of consumers visiting web sites. To subscribe, send the message "subscribe" (without the quotes) to privacy-request(a)ftc.gov I suspect most of the participants will not represent the internet marketing community and urge interested members of this list to subscribe and participate. So far, there have been only two posts-- one by me yesterday wondering why marketers on the internet should be treated any differently than marketers using more traditional media, followed by one post simply asserting that internet marketing privacy issues are completely different from those raised by traditional media. Lew Lewis Rose 202-857-6012 (voice) Arent Fox Kintner Plotkin & Kahn 202-857-6395 (fax) 1050 Connecticut Avenue, NW lewrose(a)arentfox.com (email) Washington DC 20036 Advertising and Marketing Law Advertising Law Internet Site http://www.webcom.com/~lewrose/home.html Net-Lawyers Mailing List: net-lawyers(a)lawlib.wuacc.edu

2 1

Re: revised time quantization package (Unix & WIN32) available
by Karl A. Siil 17 Dec '03

17 Dec '03

At 09:14 AM 12/20/95 EST, Dr. Dimitri Vulis wrote: ... >> Matt, if you're getting paid to read this list, I want a new contract. > >Karl, are you an unpaid volunteer at AT&T, or do you quit your job every >time you read your e-mail? Actually, AT&T has us record our time down to 15 minute intervals, which I obey religiously*. In this case, I'm writing my CP activity off to "People who can't see a joke without a :-)." * Note there should be a :-) here, too. Not speaking for the company... Karl

1 0

Re: revised time quantization package (Unix & WIN32) available
by Dan Harmon 17 Dec '03

17 Dec '03

Perry, the only crypto code you seem to do is the unintelligble postings that you send to the list. .d On Wed, 20 Dec 1995, Perry E. Metzger wrote: > > Dan Harmon writes: > > If this is what you consider contributing them you seem to have some > > deep problems that cannot be solved here. You may have to seek professional > > help. Your continued and at times seemingly uncontrollable use of vulgar > > language may indicate a neurobiological disorder such as Tourette's > > syndrome. You really should have it checked out before you harm yourself > > and possibily others. > > Thank you for the pseudopsychology, but really, all you've done is > further confirm my diagnosis of "non-contributing asshole". > > When was the last time you did anything to actually help spread > cryptography, eh? > > If you'll pardon me, I have crypto code to get back to. > > .pm >

3 2