December 2003 - cypherpunks-legacy

Re: France to push for international net legislation
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:27 AM 2/1/96, bofur(a)alpha.c2.org wrote: >According to radio reports here, the French government has just announced >it's intention to pressure the European community to create >international laws to control the Internet. > >This is in the wake of the net publication of a certain book that had >been heavily censored in France. I guess Declan M. won't be visting France or any of the other EU countries any time soon! --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

GTE and Cylink ATM Crypto
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

GTE & Cylink Team On Encryption For ATM Washington, D.C., 31 January 1996 -- During a press conference last night at Comnet, GTE and Cylink unveiled InfoGuard 100, a jointly developed offering billed as the first encryption system able to work with ATM (asynchronous transfer mode). InfoGuard 100 is meant to provide the security needed to induce business and government to use ATM public networks, said Michael M. Guzelian, GTE's marketing director for broadband systems, speaking at the press conference. GTE is the number one provider of encryption to the federal government, while Cylink holds a 70 percent share of the commercial encryption market, according to Kamy Kavianian, senior product marketing manager at Cylink for SecureWAN. GTE and Cylink will also jointly market the new ATM encryption system. "The deal (for InfoGuard 100) is mutually exclusive, but we don't know anyone else who can do it," noted Jeff Callo, Cylink's director of business development. InfoGuard consists of two main components, according to the officials. An ATM adapter from GTE provides ATM interfaces and cell processing and control functions. Cylink's CIDEC-VHS contributes "high-speed data encryption and decryption," in addition to physical security and "full automated key functions." Kavianian told the journalists that InfoGuard 100 is based on DES encryption. Users of InfoGuard will foil "key exhaustion," a method used for breaking encryption codes, if they "change their codes frequently," Guzelian added. Essentially, CIDEC-VHS has turned out to be "the first encryption method fast enough to keep up with ATM," Guzelian maintained. The agreement between Cylink and GTE represents "an excellent example of coopetition," Callo said. --

2 1

CRAX Mix Rax
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

European Commission Moves To Stamp Out Racism On Internet Burssels, 31 Jan 1996 -- The European Commission (EC) has formed a pan-European group to "encourage the mixing of people of different cultures" from both inside and outside Europe. According to EC officials, the first task of the Consultative Commission on Racism and Xenophobia (CRAX), as it is called, will be to investigate and, using legal means, stamp out the current wave of racism on the Internet. In a prepared statement, CRAX said that it hopes that the EC "will take all needed measures to prevent the Internet from becoming a vehicle for the incitement of racist hatred." EC officials are soft-peddling on what legislation they plan to enact to back up the investigations of CRAX. Currently, apart from France and Germany, there is no specific anti-racist legislation. The laws of France and Germany were created in the aftermath of the Second World War in order to prevent the rising of the so-called "Fourth Reich," an extremist group which posts messages on the Internet, as well as running Thule bulletin board systems (BBSs) in Germany. According to EC officials, the Thule BBSs, which first appeared in 1991, started spreading the Neo-Nazi word on the Internet in late 1994, having established themselves as a means of information exchange in Germany and, to a limited extent, in France. As reported previously, the "Thule Network" first came to the public's attention when the January, 1994, issue of Chip magazine (a popular computer monthly in Germany) claimed to have unearthed eight Thule BBSs. According to Chip magazine at the time, "The (Thule) network distributes information on demonstrations and invitations to meetings, addresses for contacting parties and groups, and it reviews and offers books and magazines. One of the mail-boxes contained instructions for producing military explosives and letter bombs. A great deal of space is taken up by 'political discussions' among the users." Thule is Norse or Viking terminology for "top of the world." The Thule Network's name actually derives from the small, elitist 1920s movement which was considered to be the Nazi vanguard. Thule movement leaders included Rudolf Hess. Some BBSs on the Thule network have names such as "Wolf Box" and "Resistance," while many Internet messages are signed by people calling themselves "The Wolf," among other names. --

2 1

Noise and the Nature of Mailing Lists
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:55 AM 1/31/96, Laszlo Vecsey wrote: >FYI the traffic on the PGPdomo list has been very low lately. I haven't >received a message from the list in a few days. But then again there is >even more 'noise' on that list because every message I've seen posted on >it talks about PGPdomo, the mailing list, getting PGP software to work, >etc.. From what I've seen people just sign up to test it out with a test >message, and thats about it. Even with mkpgp for pine its still a bit >inconvenient to use, I think thats the reason for the low-traffic. I've been on a fair number of mailing lists, and they basically divide up into two broad categories: * Category I -- Busy, contentious, lively, high volume, prone to noise bursts, vibrant, interesting lists. Above critical mass. Like a crowded bar, with lively debate and always something happening. * Category II -- Quiet, polite, quiet, low volume, moribun, quiet, dead lists. Below critical mass. Like an empty bar, with only a few drunks staring into their beers. * Category III -- Working mailing lists, for folks working on a specific project or Internet standard. These can be low-volume with good signal, because they are not primarily social discussion groups but are, instead, simple communication-of-information groups. The Cypherpunks list is an obvious Category I list, and has been since it was started in October of 1992. It has noisy periods, times of flaming, but also a "critical mass" of new thought which obviously keeps it going, and even growing. If we are doing everything wrong, it's hard to tell from a "who cypherpunks" query sent to majordomo(a)toad.com. Other lists I have been on have been much quieter, averaging a few messages a day (or even less). On these lists, there is just no life. The occasional pleas for help are like cries from someone stranded on the Greenland icesheets. And I have seen formerly vibrant lists die off, becoming Category II groups, or worse. One list I used to be an extremely active contributor to was the "Extropians" list, which perhaps a dozen or so of you reading this message are now still on. The history of it is a long and involved one, which I won't get into, for various good reasons. But around late 1993 there were many of the same concerns about "noise" as people are now expressing. For most of 1993 the daily posting volume on the Extropians list exceeded the volume here on Cypherpunks. So various things were tried (they had the advantage of not being an anarchy, and the disadvantage of not being an anarchy). Ratings systems for posters and their posts, even attempts to impose "quotas" on the number of posts a person could write. All well-intentioned, but all failures and cures that were worse than the problem. By early 1994, both Perry Metzger and I had left the Extropians list, for our own reasons. No doubt the list got quieter. No doubt the volume went down. However, and current subscribers will no doubt jump in and give their views, I hear that the current volume of messages is less than one per day, with--according to my sources--sometimes days between messages. (I also hear that the Extropians are devoting more of their energy to their magazine, which may also be a factor.) Note that several well-intentioned efforts to create sub-lists of the Cypherpunks list have mostly failed. The DC-Net list, the lib-tech list, etc. I suspect that the "Remailer Operators" list is viable because it's a Category III working group list. Digest like CP-Lite I don't characterize as a separate kind of list. As to the new encrypted list, I wish them well. I doubt that list will do real well, though, because of the critical mass problem. And remember, it's a whole lot easier using filters and reading tools to reduce the volume of messages on an active group than it is to get an inactive group up to critical mass! --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

FV has 91 day lag between sales and payment
by Vincent Cate 17 Dec '03

17 Dec '03

FV seems to be the only Internet payment mechanism that lets buyers quickly open an account and use their credit card to cover purchases. Anyone know of any others? The FV 90 day lag is their main downside in my opinion (though defaulting to not paying if the customer does not answer email is another problem). So FV does not take any risk at all - and a merchant has to have enough extra capital to let 3 months worth of sales sit at FV. Some ideas for ways that they or someone else could improve on this: 1) reduce the 91 days after a merchant had been a merchant for awhile 2) reduce the 91 days when sales were to long time customers 3) verify customers with letters/phone calls when opening the account and then with digital signature on sales - and give very short clearing time -- Vince ---------- Forwarded message ---------- Date: Wed, 31 Jan 1996 15:11:02 -0800 From: morehelp(a)fv.com To: vince(a)offshore.com.ai Subject: <960130/vinc0328078> (Lag between sales and payment?) Your question has been answered by a help operator for FIRST VIRTUAL (TM). The operator assigned to your question is op106 (Christopher Arndt), That operator, or someone consulted by that operator, has provided the following answer to your question: ---------------- Hello, We put an escrow hold on a seller's money for 91 days to protect ourselves from buyer credit card charge backs. We realize this can be inconvenient for some of our sellers, but at this time, that is how the system works. Federal Regulation Z of the Credit Card Regulations entitles credit card holders to a 90 period during which they can charge back any purchase. Though buyers are obligated to return the goods, this does not always happen. The credit card company is obligated by federal law to pay the buyer back, and it is the merchant who is left without payment. In our system, because it is First Virtual that has the merchant credit card account, not you, First Virtual is at risk of losing money when your buyers issue charge backs on your sale items. Because we do not conduct any credit checks on a seller, and because any buyer can charge back any charge, if we didn't protect ourselves with this 91 day hold, we could easily fall victim to charge back fraud. But once 90 days have passed, it becomes significantly harder for a buyer to make a charge back. And it is at this point that we feel that the risk of a charge back is sufficiently low that we can deliver your funds to you. We hold your money for 91 days for our protection, but the flip side is that we allow our sellers the freedom of being allowed to sell without having to go through a credit check. Virtually anyone can sell using First Virtual, and this opens up many possibilities for people who otherwise would not be able to sell products through major credit cards over the Internet. Thank you for your interest in First Virtual -- ************************************************************* ...one flew east, one flew west, one flew over the cuckoo's nest... Christopher Arndt First Virtual Holdings carndt(a)fv.com http://www.fv.com ************************************************************* ---------------- You may communicate further with our operator by replying to this message. If you are unhappy with the service you get from operator op106, you may send mail to "helpescalator(a)fv.com". Your original question is included at the end of this message. Thank you for using FIRST VIRTUAL!

2 1

[NOISE][CONTEST][FACTS] don't help much, do they?
by tcmay＠got.net 17 Dec '03

17 Dec '03

Ontogeny recapitulates phylogeny, as the saying goes. I notice a recent surge in posts that have one or more of the bracketed labels above, presumably in an effort to make the filtering job easier for others. However, this rarely works. For one thing, many of the most noisome posts, in my estimation, lack the [NOISE] label. And many of the posts labelled [NOISE] are actually pretty interesting, to me. Some people go overboard in labelling their own stuff as [NOISE], out of some kind of false modesty. And needless to say, the labels usually propagate into later followups. (And, shockingly, some people even prepend the followups they make with the [NOISE] label, thus screwing up threading. I saw this fad for labelling over on the Extropians list. It failed then, and will fail now. For one thing, the labels take up valuable "namespace." It is far better that the 30 to 50 characters of namespace be taken up with good, descriptive thread titles. Use labels if you must, but give some thought to how they just become more roadside clutter, conveying no meaning. --Tim Boycott espionage-enabled software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

No Subject
by Hroller Anonymous Remailer 17 Dec '03

17 Dec '03

At 07:25 PM 1/30/96 -0800, Lucky Green wrote: >>I take it its completely legal to set up a Virus ftp site then? > >AFIK, in the US it is legal to set up a virus ftp site. I don't know if >someone has actually done it. Don't count on it lasting. Some European >countries have already outlawed virus (read knowledge) distribution. Anyone interested in visiting a good virus site should point their browsers to: http://www.xcitement.com/virus/ Quite a good site, really. It hasn't been "Netscape Enhanced" yet, so there are no frames and tables and inline A/V, but it gets the job done. They offer a *lot* of virus source code (almost all of it in x86 assembler) and many related resources. Some highlights of the home page are included below. I would recommend the use of something like WebWhacker, which automagically downloads the contents of a web site to your local system and edits the html files to work correctly from your local web browser. It will allow you to replicate the site quickly and easily, instead of clicking on each of the more than 2500 links one at a time. Hope this helps. If you're interested, better get there quickly. (Of course, it's been up for six months now, so it's likely already withstood a substantial amount of negative response. It may be there to stay.) ---- 8< ---- Welcome to the VIRUS Source Homepage! This page contains several virus code generators, a few mutation engines, over 500 virus source files and over 2,100 executable virus files. This material is being submitted for educational purposes only. Play at you own risk. But have fun! The purpose of this page is not to inflame, but to educate, stimulate and confront you with alternative information on the sensitive issue of virus creation and propagation. The only way in which to know the whole of a subject, is by gaining knowledge from every variety of opinion on the subject, and studying all modes in which it can be looked at. Inform yourself by analyzing and studying the source code of actual viruses, read the virus writing & assembly language tutorials. Then consider and examine every variety of opinion on the subject; the anti-virus folks, mainstream society, and most importantly ideas and opinions that are considered radical, reactionary, minority or stigmatized by some other uncomplimentary label. No wise person ever acquired wisdom in any other way... A special note to those of you who would like to see an end to this page: If all humankind minus one were of one opinion, and only one person were of the contrary opinion, humankind would be no more justified in silencing that one person than it, if it had the power, would be justified in silencing humankind... What's New? Last updated on 12/26/95. Message Board Code Generators The 2nd Generation in Virus Creation (46k) Virus Creation Lab (164k) Password: Chiba City Mass-Produced Code Generator (45k) Instant Virus Production Kit (39k) Trojan Horse Construction Kit (18k) German Virus Construction Kit (12k) Mutation Engines Mutation Engine (13k) Mutation Engine Tests (18k) Polymorphic Engine (8k) Visible Mutation Engine (20k) Source Code [A-Z] Executable Files [A-Z] Debug Scripts Over 33 debug script files (184k) Miscellanous Debug.com based interrupt stripper (3k) V-86 based interrupt stripper (13k) VSUMX507.ZIP (96k) - database of viruses. Assembly Language (resources) Virus Writing Tutorials ---- 8< ----

2 1

Active processes monitoring?
by jf_avon＠citenet.net 17 Dec '03

17 Dec '03

Hi! I'm running on a first generation 486 ISA 4meg ram Win 3.11 I use realdeal /commercial and wipeswap.exe in an *.bat that launch Win3.11 How can I detect if another process is running on my system? I use MEM /c in a dos window. But is that sufficient? Can a hidden process detect MEM loading and hide itself somehow? Are there others applications like MEM that are not as universal? (here, I guess that such stealth behaviour have to rely on identifying the program being loaded, thus, a less common program has less chance of being fooled) Thanks JFA

2 1

FV, Netscape and security as a product
by Greg Broiles 17 Dec '03

17 Dec '03

NSB's messages have suggested, amongst the fear-mongering, that the real target of the card-shark publicity campaign is not Joe Consumer but bankers, investors, and other "big money" folks; people who care about the large-scale fraud rate of credit card use. (Yes, the rate of fraud affects all consumers, but most people experience it as a relatively small and unavoidable cost lost in the noise of other small costs.) NSB/FV used the Murky News to reach those people the way that some people will rent a freeway-visible billboard to propose marriage to a single commuter. The trouble and expense that the sender was willing to suffer to send the message are intended to cause the reader to take the message more seriously. The rest of us who see the message on C-punks or drive past and wonder "Who is Bonnie, and why is Clyde proposing marriage to her on the freeway?" aren't an important part of the process. But I don't see FV's tactics as being especially different from folks at IBM writing a virus which affects Windows but not OS/2, and quietly shopping it around to scare Microsoft customers, or Ford underwriting an NBC news program which shows Chevy pickups blowing up. (both are hypotheticals.) Sure, it can be done, and perhaps it's not dishonest, and perhaps they can wear the hat of "Consumer Protector Man", but I think it'd come across as less offensive if it weren't presented as a discussion about security. Statements which can be boiled down to "We think our product is superior to our competitor's product" don't mix well with quotes from academics and a "Chief Scientist" signature block. While, as Vin McLellan points out, Simson Garfinkel's articles were technically accurate (modulo the quote from Daguio, where he's quoted as suggesting an "out of hand" transaction, which is likely either a typo or a misunderstanding - dollars to donuts he said "out of band"), they also appeared as part of a marketing process. Netscape and FV have both taken a "security is a product" stance, which is a gross misrepresentation. FV and NSB's materials have done a good job of critiquing Netscape's "security is a product / don't worry, just look for the cute blue key" approach, but would replace it with their own "security is a product / trust the phone but not the net" approach. Both suggestions (and the implication of the Murky News articles, that one can be trusted but not the other) are wrong. Security is never a product. (Not a firewall, not a fancy browser, not PGP, not a gun, not the Club, not an airbag.) FV has tried to productize their approach (out-of-band transfer of credit card number + long clearing time for sellers + negligible per-unit cost for goods sold) but it won't work any better for FV consumers than it does for anyone else who tries to buy something which can't be sold. It's a shame that Garfinkel didn't spend more time/column space on suggestions or observations from the independent people he interviewed and less time on the "hot news - Netscape security broken by a competitor" angle. Are there really any "big money" people left who don't have formal or informal access to someone computer/Internet savvy enough who could have pointed out that the cardshark attack is nothing new? Yes, bad things happen if you run bad software. A two-way link between your computer and the rest of the world means it's possible for bad software to send your data to other people. It's the "Prodigy reads your hard disk/Microsoft Registration Wizard reads your hard disk" scare all over again, with "Prodigy" replaced by "evil untraceable criminals" and "hard disk" replaced by "keystrokes". Duh. We should, however, learn from what FV did right - they wrote software which (apparently) had or can have a real political effect. (It seems to have worked on Garfinkel, anyway). Cypherpunks write code? FV wrote code and got some attention for their otherwise unexciting message. (It seems to be a combination of working code and good user interface - witness the cooing over the icon indicating which type of credit card you're using and the fact that it uninstalls itself.) It's a shame that they won't use their powers for good instead of evil. -- "The anchored mind screwed into me by the psycho- | Greg Broiles lubricious thrust of heaven is the one that thinks | gbroiles(a)netbox.com every temptation, every desire, every inhibition." | -- Antonin Artaud |

3 2

Flaw in FV process (was FV and Netscape slagging each other off :-)
by John Pettitt 17 Dec '03

17 Dec '03

At 05:56 PM 1/31/96 -0500, Nathaniel Borenstein wrote about Jeffs attack: >Your attack would be caught by us relatively quickly because our model >is based not on a single fail-safe piece of security software, but on >*process* security. The overall process is multifaceted, with many >checks and balances. Yes this is all fine and good - but your process does not allow for real time delivery of goods. For example: Somebody wants to buy say micrsoft office from me for electronic delivery (yes they have a lot of bandwidth :-). I can authorize a credit card, fun it by my fraud screen and start shipping in less than 30 seconds. At this point the transaction is done. In the FV model as I understand it I'd have to ship the software and wait for an approve/deny/fraud from the user. If it's anything but approved I'm SOL, I still have to pay Microsoft for the product but I didn't get paid. Solve that process flaw and I'll add FV support to software.net. John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2