December 2003 - cypherpunks-legacy

Re: New Mailing List (encrypted)
by Alan Olsen 17 Dec '03

17 Dec '03

At 10:21 AM 1/30/96 -0800, anonymous-remailer(a)shell.portal.com wrote: >On Sat, 13 Jan 1996 13:42:49 -0600, <perry(a)vishnu.alias.net> wrote: > >> I have installed PGPdomo on vishnu.alias.net. I've also >>created a new mailing list that you can join if you wish. It's a >>closed mailing list, so subscriptions must be approved. What makes > >If we have attempted to subscribe, but received no response, does that >mean that we didn't get approved? If so, how can we "qualify"? I have noticed that the software they are using is VERY picky about he formatting of the request and how it is encoded in PGP. To get it to work, I had to use the EXACT instructions posted to get it to subscribe. The PGPMajordomo software is a great idea, but in practice it has not been that fun to use. The biggest problem has been that the mail client I use does not do PGP that well. Hopefully the state of E-Mail support for PGP will change. Another project to add to the list... Alan Olsen -- alano(a)teleport.com -- Contract Web Design & Instruction `finger -l alano(a)teleport.com` for PGP 2.6.2 key http://www.teleport.com/~alano/ Is the operating system half NT or half full?

1 0

RE: FV Demonstrates Fatal Flaw in Software Encryption of Credi tCards
by David Van Wie 17 Dec '03

17 Dec '03

On January 30, 1996 hua[SMTP:hua@chromatic.com] wrote: >> the credit card companies in detecting fraud and locating criminals is >> quite real. > >Retail clerks are not lone bandits. My point is not that all retail clerks are bandits. Most are trustworthy, but surely any long time CC user has given their card to someone who would rip them off if they thought they could get away with it. My point is that CC #'s are not national security secrets, they are disclosed to potential adversaries regularly. >> Of course, since Federal law requires the credit card companies, not the >> user, to pay the costs of fraud, First Virtual's entire premise is a red >> herring. If the credit card companies are willing to take the risk, they >> will (and are). > >Federal law does not require that a company stay in business once it >has entered the banking market. The point is FV's post relies on a frightening and false premise - that the users are exposed to one or more financial risks by FV's keyboard sniffer threat. dvw

1 0

Re: Denning's misleading statements
by cme＠cybercash.com 17 Dec '03

17 Dec '03

At 20:49 1/27/96, Timothy C. May wrote: >I've never met Dorothy Denning, so I hesitate to characterize her as a >villainess. But certainly she's the only noted cryptographer I know of >who's gone so far out on a limb to defend a position the vast majority of >computer scientists, civil libertarians, and cryptographers scoff at. I've met some others -- most noteably Silvio Micali [but he has a financial interest in that position]. However, DERD is the only one I've met who is all the way over on Freeh's side. - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +----------------------------------------------------------- Jean Ellison -+

1 0

Reply Blocks and Nyms: newbie question
by bruce＠aracnet.com 17 Dec '03

17 Dec '03

I'm almost certainly going to be changing my address in the next few weeks. I'd like to keep the same nym account. Can someone take a stab at explaining how to feed the relevant info to C2?

2 1

RE: Cyphercoding Training Wheels??
by Michael E. Carboy 17 Dec '03

17 Dec '03

Greetings All, I have been lurking as a newbie on the cypherpunks mailing list for 'bout one month. Have ordered Koblitz book on Number Theory and Applied Cryptography. As I slowly (and probably painfully) learn some number theory, I would like to start coding, particularly as it would related to encrypting and decrypting stuff. I ask the community's input as to whether I should use visual basic or visual C++ ??? I am using a windoze95 platform. Any comments would be welcome.. thanks Michael E. Carboy carboy(a)hooked.net finger for key

2 1

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:25 1/29/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >The Notes R4 approach gives the best of two fairly unpleasant worlds. You can >export crypto if you either limit yourself to 40 bits [...] > >Notes R4 didn't give up anything to get this. Of course Lotus gave something up for it. The voluntarily made sure that even the supposedly non-GAK domestic version provides relatively easy access for the authorities. Sixty-four bits are an inconvenience, but nothing more. If Lotus had wanted to make the domestic version GAK free, they would have used 128 bit. In the end Lotus caved in twice: they released a 'super easy' GAK international version and a not 'quite so easy' GAK domestic version. Sixty-four bits is GAK. Period. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tbyfield(a)panix.com (t byfield) on Tue, 30 Jan 3:49 PM > Chomsky took the phrase from a book by Walter >Lippman, published I think in 1922; the book's name >escapes me now. Would that be "Public Opinion?" If so, that's an interesting progression: Bernays to Lippman to Chomsky: PR begets PO begets ... How would the politico-linguist's advocacy be characterized, PR, PO or whatever is evolving parasitically from hegemonic, ever manipulative media? All the variations of MCI-MS-News-Oracles, global combos and recombos burgeoning and emerging. All the promising, braying, dreaming, lying, manipulating markets and investors reminds of Lippman's and Bernay's and Chomsky's warnings about evil-doers causing the sky to fall.

1 0

My mail to Nathaniel (was Re: Re: FV Demonstrates Fatal Flaw inSoftware Encryption of Credit)
by Paul M. Cardon 17 Dec '03

17 Dec '03

My mailer insists that Nathaniel Borenstein wrote: > Hello. I am Nathaniel Borenstein's automatic mail robot. I should have suspected as much. Hello robot. Nice robot. Busy robot. > > Your message is in the highest priority category of mail that was > not sent through the "urgent backdoor". Nathaniel WILL READ YOUR > MAIL SOON, most likely tomorrow morning. Busy Nathaniel. > THE "URGENT BACKDOOR": If your message absolutely cannot wait until > tomorrow morning, or possibly a bit later, please re-send it to the > address "nsb+urgent(a)nsb.fv.com". Please make note of the special > urgent address for future reference. Be warned, however, that > Nathaniel can tell me to override the "urgent" delivery for anyone > who regularly abuses it. You gotta be kidding. I just gotta see the response from this one. > Additionally, if you're someone he doesn't know, Nathaniel will NOT > ANSWER your mail if the answer is contained in the NSB FAQ. I can most assuredly aver that my comments and questions were not covered in the NSB FAQ. ;-) --- Paul M. Cardon -- I speak for myself. 'nuff said. MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e

1 0

Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 04:39 PM 1/29/96 -0500, Nathaniel Borenstein wrote: >Well, the mis-conceptions are flying fast and furious. > >You're twisting our words. We believe it is a truly fatal flaw in those >internet commerce schemes that are based on software encryption of >credit card numbers. There are several schemes for Internet commerce >that are unaffected: > > -- First Virtual (of course) Question: Could you please describe the nature of the First Virtual protocol? Now before you tell me to RTFM, let me explain. I assume, although without absolute certainty, that in order to bill me you must know my credit card number. If you do not know my credit card number, and depend on someone else who does, you are nothing more than a middleman who introduces additional possibility for breach of security. If you do know my credit card number, you must deal with the associated problem of storing this number. Now perhaps I am wrong, and you really do keep all of your clients' card numbers in a printed book hidden within a safe, and for each transaction you remove the book, use your table to match FV_ID to CC#, process the transaction, and replace the book. However, I doubt this. More likely, you store the card numbers on a computer. And no doubt, someone or something enters those numbers into a database. You have just violated your own cardinal rule. Jeremy --- Jeremy Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ j.mineweaser(a)ieee.org | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

2 1

RE: No FV supporters?
by Pete Loshin 17 Dec '03

17 Dec '03

Nathaniel seems to be defending his cause sufficiently well, and graciously answering the abuse. Some of the abusers are showing a fairly comprehensive lack of knowledge of the FV system. I would venture to say that FV has no more profit motivation than, say, Netscape--or how about Open Market? They who gleefully opened a "Here are the secure servers that haven't been hacked" page some time ago. That was pretty self- serving, wasn't it? Nor would I consider the FV brouhaha much more obvious than, say, the front page announcements about "NFS and RPC considered dangerous" that hit the big papers last year. The weaknesses of those protocols for internetworking have long been known to those working with TCP/IP. Now, clearly there are lots of opinions on FV's system, but if people like Sameer and Rich Salz (e.g., who have reputations as knowledgeable and aware) are going to trash FV it would mean a lot more to many readers if they could state more specifically what it is about FV that doesn't work (or that doesn't work as well as, say, SSL or CyberCash or Open Market's approaches). As for the Weld Pond/et al graphical clicking approaches, they may work and they may defend against some attacks, but I won't use it (too much clicking around, too likely to make mistakes) and neither will anyone without a GUI. My $0.02. -Pete Loshin pete(a)loshin.com Ted Anderson wrote: >I am rather shocked that after wading through hundreds of msgs of abuse >of Nathaniel and FV I haven't seen one message of support; but perhaps I >missed it. etc.

6 9