December 2003 - cypherpunks-legacy

Re: Dealing with Credit Reporting Agencies...
by btmoore＠iquest.net 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 09:31 AM 2/5/96 -0600, Karl Ike wrote: >Attila: I'm not in the business of running or hiding. I'm just an average, >everyday working guy that doesn't like credit reporting agencies, what they >stand for or what they do for money. I didn't say that I was going to do >this. I just had the idea! I don't have the knowledge or the money to spend. >That doesn't mean that there is someone out there that would jump at the idea. > >I just don't like the idea that these assholes know more about me than my >mother and sell my private and personal information to anyone for big bucks. >My credit is fine, just ask my banker or better yet, my mom. > >I am assumming that you know far more people on the internet since I have >only been on for a month and have done three e-mail. I'm just suggesting to >get the idea out and someone will take the ball and run. Yes, they will be a >hunted man, but not a US citizen. Someone out there with a laptop and a >cellular, living on a cruise ship, just may enjoy the idea. > >Just me, Karl Well Karl, It seems I missed your idea/solution in this post, however, some of us figured this out some years ago... I begin a campaign almost 10 years ago of feeding the computers false information about myself. I never use the Social Insecurity Number assigned to me... I don't even give it to the Bank. This makes for some rather dicey situations. I rarely use my real name or give out my real phone number. At this point in my life... I have *NO* credit history. I currently have *NO* bank account. My goal is to be completely invisible to the system. Yes I have had a few glitches in this plan from time to time... but I continue to work on it. I just have never felt warm and fuzzy knowing that any government agency, business, or whoever can get my personal information off a computer could come knock on my door some dark night. If you're interested in fortifying your privacy, I can give you a few pointers. 1.) Go to your local DMV and inform them you've had a change of address. I selected a high rise apartment building with 15 floors and selected an address on a non-existant 23rd floor. Getting your Driver's License address changed should cost less than $10.00. 2.) Go find a company like "Mail Boxes Etc." and rent a mailbox. The cost is nominal compared to the added privacy and security. The distinction between a mailbox and a Post Office Box is with a mailbox you have an actual street address. You can receive deliveries from UPS and Federal Express at a mailbox. You can't at a P.O. Box. 3.) This part requires some skill... befriending a graphic artist is a good idea for this one. But what you need is a phony work identification. Pick a name! A couple of "Pass Port Photos" and some lamination and you're good to go. 4.) Take your new persona down to your local utility companies and get the serv- ice switched to the name of your new persona. Even get your phone switched and have the number non-published. You'll be pleasantly surprised from now on, everytime your phone rings, it will be someone you really want to talk to. 5.) Go down to your local Post Office and file a change of address form. Use the address of your mailbox. Remember, most companies that provide Mailbox service, will need to see your drivers license... which of course now has a non-existant address on it. You can take this as far as you want... Just doing these 5 things will give you a sense of comfort and security you've probably not had in a long time. How does this fit into cyperpunks and encryption? The philosophy is the same! What good is it encrypting your messages to ensure your privacy when everything else is exposed! It's a lot like an Ostrich burying his head in the sand to hide, but leaving all his good parts exposed! Benjamin T. Moore, Jr. btmoore(a)iquest.net (Jian #AJF IRChat) -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMRlexoSAJOVFNaChAQFBCQf8Drm04x2YT5gZb8cklwep1eBVKxOMyVzn /ZN3Tk+lKT05CAT0TCmHm+8oztqxWhgjMklYT228C5u4zvaF8ZrYvLxMp7RQPHvK D2fSKdMGMs+pPvJxPUC5UXssoIsBS0W+i4dO5jDIj/MkXM4JFHsDHvFqr9Q7FqwE Xr75lHjiNP4Gcv06WkVpJewJMaflP5zcrSam577/fbbCkYM6e4nhQPGdqdi83txM hzvCs8cHalPa9UJGuSbIZObe1fAUkQMsVqEomXe5HuBzukJigwdqj4IK9SJixTVx m0Fxf/W74j4lS1TXpqjCQoSD4EPRAleCYR6SFbqV/p0/cMYqv6kErA== =4HYS -----END PGP SIGNATURE-----

1 0

RE: Web900 - The easiest way to charge users ...
by Pete Loshin 17 Dec '03

17 Dec '03

Bob Hettinga forwarded to the list this: >--- begin forwarded text [deletia] > ------------------------------------------------------------------ > Web900 - The easiest way to charge users to access your web site! > ------------------------------------------------------------------ [more deletia] Rather than rely on the text Bob forwarded, I took a look at the Web page and it appears to not have much more information than provided here. Without knowing any more about this system than what is on their Web page, one (apparently) obvious flaw is that it makes it real easy for me to charge my Web fees to my mother-in-law/friend/whoever's house I can get into and make the 900 # call. Presumably this flaw can be minized by giving the access code a short time to live so you have to enter it in the system real soon after getting it, to discourage running around to all your (soon to be ex-)friends' houses. Of course, this brings up the even more obvious flaw: You have to cut short your browsing session (if you dial in) to make the phone call, and then dial back in. This strikes me as being much more complicated and burdensome than any other method cited. Also, since it seems that you set up an account with the merchant through a single call/code, you could run up quite a tab on someone else--untraceably--before you would get cut off. It would be interesting to hear more about how this system handles these issues. -Pete Loshin pete(a)loshin.com

1 0

Your Point Is ?
by Tim Cook 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- > Because, the are dumb as shit. It's simple really, back to the > origional point, most people are about as bight as a rock, they > don't care about anything other than stuffing there pathetic faces, > waching the idoit box, and passing on their bad genetic structure > and pathetic world view. That is all they have, it's not that they > have anything to contribute to the world. They are pathetic, since > they have no life, and know that their world view hasn't got a > prayer in a free market place of ideas, they choose to maintain it > by force. > I'm sorry. I seem to have missed your point. I thought you made one in the above text. But after that, you seemed to have grouped yourself with those braindead no-lifers. Where did YOU lose ME? <VBG>. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMRwopHZBD5a0GJkxAQGkUAQAwnKZ9E9znTul/abjiH/bYEMoJnlY27mE 2Ylk37HZWp3g9JVNmF0YvZWWsw1l3B+lzu1SC8GgG4V9h7Q483d4o0Nj995qVhhu TQTkimH7XM0KH9Cc6Rw1PgcoZPaQgjjQg+loA1/N9lwCa9GZc2hTQlvDF/qV8d9B wAxEpKGca9o= =I0yG -----END PGP SIGNATURE----- Another "Logical Conclusion" by: Tim Cook <twcook(a)cts.com> Support THE US Constitution... Vote Alexander in '96 and '00!

1 0

USPS Electronic Commerce Services
by bart＠netcom.com 17 Dec '03

17 Dec '03

Because I registered for the upcoming Internet Expo in San Jose, I got, by mail, an announcement of forthcoming Post Office services. These "Postal Electronic Commerce Services" will be demo'd at Booth 626 at this show on February 20-21. The flyer says: "Postal Electronic Commerce Services will provide end-to-end security, confidentiality, integrity, and proof of origin to all your electronic information transfer and storage." Interestingly they suggest that the government is to be a prime beneficiary: "For governments to get full value from the increased use of personal computers and public access terminals (kiosks) the privacy and security of every transaction must be guaranteed." Under the HOW IT WORKS section, after a quick gloss on public key cryptography they state: "Once a person generates a unique key (using their own software), they will take the "public" part of that key to a postal representative along with documents that prove their identity. Postal Electronic Commerce Services will then issue a certificate which guarantees that the identity of the person matches the "public" key that they presented. PECS will also electronically postmark the document using its own set of "keys". This guarantees the validity of the stamp and legally establishes the existence of the document." They offer a FAX number for further info: (202) 268 4399 and a phone too at (202) 268 3435. No mention of GAK or key length limits that I could see. I will surely be at their booth on the 20th.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

I found this article in misc.survivalism, but despite its presence there, it actually has some interesting things to say about developing directions in money laundering enforcement, including mention of electronic purses. And "The Financial Times" is no slouch of a paper. --Tim May In article <4fbg19$nv1(a)ixnews7.ix.netcom.com>, taxhaven(a)ix.netcom.com(Adam Starchild ) wrote: > From The Financial Times (London) for February 3-4, 1996: > > > WORLD'S FINANCIAL POLICE TO CAST MONEY LAUNDERING NET WIDER > > by George Graham, Banking Correspondent > > > The world's leading financial policemen are to consider > targeting money laundering from arms trafficking, extortion and > bribery as well as the drugs trade. > Members of the Financial Action Task Force, grouping senior > government officials from the European Commission, the Gulf Co- > operation Council and 26 other countries, have launched a review > of their guiding principles. > The review is expected to be completed by June, and could > result in the criminalisation of money laundering linked to any > serious crime. > The Task Force's current recommendations, which set out > minimum standards for money laundering laws in member countries, > only require the criminalisation of drug money laundering, > although countries are also urged to consider extending the > offence to other crimes with a narcotics link. > Mr. Ronald Noble, under-secretary for enforcement at the US > Treasury and president of the Task Force, said the group had not > yet decided whether to widen the definition of money laundering. > Including all serious crimes could, however, make it simpler for > law enforcement officials to launch investigations of > transactions that look suspicious but have no obvious drugs link. > "It would make it much easier to collect information," Mr. > Noble said. "People who before were engaged in the illegal > transfer of funds would find it more difficult and more costly." > A broader definition might, however, make it more difficult > to apply the Task Force recommendation that countries should have > the power to confiscate laundered money. > The review is not expected to result in big changes to the > 40 principles currently recommended by the Task Force, which > officials believe have already contributed to substantial > advances in the fight against money laundering. > But the review will also have to consider whether to address > the new issues raised by the development of "cybercash," new > varieties of payments systems such as stored value cards or > electronic purses. > "We have to be concerned as an organisation to come up with > principles which recognize that technologies could pose a threat > but do not define them in such a way that you are dated as soon > as you publish them," Mr. Noble said. > Law enforcement officials are keen that the developers of > new financial technologies should think about their criminal > potential before they launch them, so that governments do not > have to clamp down on them afterwards with rigid rules. > Possible safeguards against the misuse of electronic purses > could include limiting their maximum value or restricting their > use to certain closed systems. > > Posted by Adam Starchild > Asset Protection & Becoming Judgement Proof on the World > Wide Web at http://www.catalog.com/corner/taxhaven

1 0

Re: Applied Cryptography, 2nd Edition -- Errata version 1.2
by Deranged Mutant 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Timothy C. May wrote: > > At 1:49 AM 2/9/96, Bruce Schneier wrote: > > APPLIED CRYPTOGRAPHY, Second Edition > > > > ERRATA > > Version 1.2 - 1 February 1996 > > > ... > > Wow. Does this mean the Third Edition will be coming out soon? > > (Not to sound harsh, but that's a *lot* of errors still in the book...I > thought a lot of reviewers were going to squish out these sorts of > things?) That would depend on hw long you'd want to delay releasing a book. When I finished reading 1st ed., I decided I was going to try coding the MMB cipher, got ahold of the erratta which read "MMB has been cracked. Don't use it" or something like that. Had nothing to do with a typo. Rob. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMRr8GioZzwIn1bdtAQH+XAGAjFImro/S6WQYJpmuGEA8L0eQAWw21ECT AE0+m81jRK9AtXlbFLkg24ou6mU8N357 =noJq -----END PGP SIGNATURE-----

1 0

bullshit (was: Re: Fair Credit Reporting Act and Privacy Act)
by tbyfield＠panix.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 10:18 PM 2/8/96, Bill Stewart wrote: >The parts of the Privacy Act that I remember are all restrictions >on _government_ actions, not private actions. It's an important >distinction; even though TRW may know way too much about you, it's all information that >you voluntarily released to somebody, unlike data that >the government requires you to give them. And, yes, it's out-of-date >and toothless. It's important to distinguish between information that you've voluntarily released as such (e.g., giving someone your SSN) and information derived from analysis of your actions (e.g., repayment patterns, value-added with a proprietary scoring system) and/or consolidated from small releases of info here and there--and most of the material in a typical TRW or Equifax dossier is of the latter kind. ObCrypto? Vaguely. I've been thinking about the possibilities of "bullshit generators"--simple programs that would generate names and various kinds of facts about people who don't exist and "make this info available": email addresses to SSNs, addresses, credit histories, medical records, you name it. If "bullshit bots" became generally available and easy to implement, "information markets"--a phrase that's far too general to capture the complexity of the dynamics it refers to--would stratify pretty fast: groundfeeders like the fine folks who're now grepping newsfeeds for email addresses + interests could be laid waste to pretty fast by a handful of dormant newsgroups systematically flooded with posts from gjhfkj(a)opihk.com or poipoh(a)axsx.org. Who'd pay for a DB that's half bogus? Alternatively: who'd pay to prevent their DB from being corrupted? Companies like Equifax would be harder to penetrate, but by no means beyond reach: there are so many people out there who they don't have files on yet--in ghettoes, in Eastern Europe--that they could be duped. We tend to think of information markets as markets for _true_ information; but as those markets mature, they'll breed parallel "counterweight" markets--markets, in essence, for _false_ information. Equifax and TRW got the goods on you? How much would you pay to vanish into a crowd of newly created people with excellent credit ratings who are all just a few diddled digits away from you, your SSN, your address, your phone number, your mother's maiden name...? The latest issue of RISKS (2/8/96, 17:70) has a kvetch about <http://www.graviton.com/red/>, "The Red Herring Home Page": > A little experimentation revealed that almost ANY obscure search >would match "The information source", often as the only matching >document found. As near as I could figure out, his site recognized >probes by web robots and then threw a dictionary at them! Congress would be hard pressed to illegalize fiction. ;) Ted -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBMRsCX3Shd2boiy7BAQGS1gf+KK/VG9EGHkHBE/zaH2saf2Kb1Qgq4Ez1 wUABgo5JFAwbYFMY4aPZJIOcU2gPlVSDEHZtRMRI/JW2FTqGD8BwMneBjEFI9uHs K9jUhT3sSyzWgwW/9H8rb/mO8gHJig9jcWseyK/z3Cyk8MFbP5h0nLcougTIhRFr f2X/i4y3JNajtUYfkWQVUbDr0yS/5NesiMX79KB560clhPgXqTVgfU15DJOytWGZ aRSfUU7Fu05BypfylcqW2nltgnvkAVrI+4Scf/nolZEqBT3PJ3MmWXNetbULxd4A Jr3IRG/E3CVwBcOAhFLyw48c5Qseu7pSs6OA5VqgmGD/0SEdI1raWA== =8XnL -----END PGP SIGNATURE-----

1 0

Re: Forgery--wasUnknown address
by Gordon Campbell 17 Dec '03

17 Dec '03

At 10:38 AM 09/02/96 -0800, David Sternlight wrote: > >I send this to you for your amusement and delectation. The core message >below, about plonking, is a crude forgery--I did not write it nor did I >send it. > I got one of these, too. My assumption was/is that somebody forgot to sign off the list before their account was closed down. ----- Gordon R. Campbell, Owner - Mowat Woods Graphics P.O. Box 1902, Kingston, Ontario, Canada K7L 5J7 Ph: (613) 542-4087 Fax: (613) 542-1139 2048-bit PGP key available on request.

1 0

V-chips, CC, and Motorcycle Helmets
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

Tim rites: >The viewer sets her preferences: a 5-5-5 would let everything through, etc. >The developer of the chip claimed he could mass produce the chip for a buck, >and this may be where all those estimates of "$1-2 per set" have come from. Am in favor of this since it puts the control in the hands of the property owner. One question would be "how often is the V-rating code transmitted ?" (are the kiddies protected from channel-surfing ?) Do suspect that the $1-$2 cost could be met *at the manufacturing level*. Do also see the need for regulation to put it in. It was required for UHF channels else no one would try to build one. I am also thankful that is was required for closed-captioning even though my TVs are not new enough (have a $99 discount-house box on the TV in the family room. Makes many shows more relaxing. Only annoyance is that we have to be even faster on Jeopardy since the caption appears before the players speak. Motorcycle helmets (required in Florida as is seat belt use) are another matter. Requiring the lights to be on is different - that makes the bike easier for others to see. Helmet and seat belt laws are purely economic in nature: the state wants them to reduce the load on the state supported medical structure, motorcycle manufacturers (and auto manufacturers) support them to keep insurance rates low (high insurance rates affect sales). In this case the laws are "special interest" and have nothing to do with the individual though the rationale is often "for your own good" (have been wearing seat belts and helmets for many years - have a scar on my forehead that took fourteen stitches where the Snell approved Bell Magnum helemet *split* under the impact - sudder to think what the effect would have been without it. Similarly, I do not like air bags since I worry about second and side impacts. Still was an easy way out for the manufacturers to appease the insurance companies (see above). Getting a bit far afield from cyphers though. Bottom line is that the V-chip seems like a good idea to me so long as the 5-5-5 setting is the default and there are no "backdoors". Warmly, Padgett

1 0

"Rights"
by A. Padgett Peterson, P.E. Information Security 17 Dec '03

17 Dec '03

>A day or so ago, I reasoned incorrectly that university students and >employees were free to encrypt mail they sent through their student or work >accounts. This was in response to a statement that the govt could retain >at least some control of internet traffic through the universities and >businesses. I would credit the person who called me on it, by I do not >remember who it was. It seems that, at least for employees, it is totally >up to the employer. Is something I have been saying for years & has nothing to do with "free speech", rather it is "property rights" and in the USA they always *must* win because when you get down to it the US is based on property rights. One of the most basic is that "citizens are not the property of the state". "We hold these truths...all men are created equal" referred to the separation of nobility from the "common man". Is part of the reason Amurricns may not be titled. However computers and networks are not people, they are property. All are owned by someone who exercises control over them. To say "you must let me use yours as I wish" is to deny "all men are created equal" (and coporations enjoy the legal fiction of being an entity. Some time in the future we may have to consider other beings (porposes ?) but not yet just as at one time slaves and "injuns" were conveniently denied. Now if an employer/university choses not to exert any control, that is their decision but does not mean they have given up anything (AFAIK "adverse possesion" has never been applied to a computer or network) so why be surprised when some exercise those rights ? I agree that proper notice should be given but that is only to stay out of court in the first place. *Every court case I know of has been decided in favour of the property owner*. Remedy exists. If you do not like the rules at one site, choose another. In most places you can find a PPP provider for $20/month unmetered who will let you do what you will. True, if you want to use the web properly, the price of a PC has gone up from $25 since Windoze and a 256 colour display is needed, but not much. Sorry for being a bit off topic but once this is understood (and am open to argument on the issue but expect to prevail), I suspect that a lot of the noise level on this list will go down. Warmly, Padgett

2 1