December 2003 - cypherpunks-legacy

RE: Cyphercoding Training Wheels??
by Michael E. Carboy 17 Dec '03

17 Dec '03

Greetings All, I have been lurking as a newbie on the cypherpunks mailing list for 'bout one month. Have ordered Koblitz book on Number Theory and Applied Cryptography. As I slowly (and probably painfully) learn some number theory, I would like to start coding, particularly as it would related to encrypting and decrypting stuff. I ask the community's input as to whether I should use visual basic or visual C++ ??? I am using a windoze95 platform. Any comments would be welcome.. thanks Michael E. Carboy carboy(a)hooked.net finger for key

2 1

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 20:25 1/29/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >The Notes R4 approach gives the best of two fairly unpleasant worlds. You can >export crypto if you either limit yourself to 40 bits [...] > >Notes R4 didn't give up anything to get this. Of course Lotus gave something up for it. The voluntarily made sure that even the supposedly non-GAK domestic version provides relatively easy access for the authorities. Sixty-four bits are an inconvenience, but nothing more. If Lotus had wanted to make the domestic version GAK free, they would have used 128 bit. In the end Lotus caved in twice: they released a 'super easy' GAK international version and a not 'quite so easy' GAK domestic version. Sixty-four bits is GAK. Period. -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

1 0

Re: The FV Problem = A Press Problem
by John Young 17 Dec '03

17 Dec '03

Responding to msg by tbyfield(a)panix.com (t byfield) on Tue, 30 Jan 3:49 PM > Chomsky took the phrase from a book by Walter >Lippman, published I think in 1922; the book's name >escapes me now. Would that be "Public Opinion?" If so, that's an interesting progression: Bernays to Lippman to Chomsky: PR begets PO begets ... How would the politico-linguist's advocacy be characterized, PR, PO or whatever is evolving parasitically from hegemonic, ever manipulative media? All the variations of MCI-MS-News-Oracles, global combos and recombos burgeoning and emerging. All the promising, braying, dreaming, lying, manipulating markets and investors reminds of Lippman's and Bernay's and Chomsky's warnings about evil-doers causing the sky to fall.

1 0

My mail to Nathaniel (was Re: Re: FV Demonstrates Fatal Flaw inSoftware Encryption of Credit)
by Paul M. Cardon 17 Dec '03

17 Dec '03

My mailer insists that Nathaniel Borenstein wrote: > Hello. I am Nathaniel Borenstein's automatic mail robot. I should have suspected as much. Hello robot. Nice robot. Busy robot. > > Your message is in the highest priority category of mail that was > not sent through the "urgent backdoor". Nathaniel WILL READ YOUR > MAIL SOON, most likely tomorrow morning. Busy Nathaniel. > THE "URGENT BACKDOOR": If your message absolutely cannot wait until > tomorrow morning, or possibly a bit later, please re-send it to the > address "nsb+urgent(a)nsb.fv.com". Please make note of the special > urgent address for future reference. Be warned, however, that > Nathaniel can tell me to override the "urgent" delivery for anyone > who regularly abuses it. You gotta be kidding. I just gotta see the response from this one. > Additionally, if you're someone he doesn't know, Nathaniel will NOT > ANSWER your mail if the answer is contained in the NSB FAQ. I can most assuredly aver that my comments and questions were not covered in the NSB FAQ. ;-) --- Paul M. Cardon -- I speak for myself. 'nuff said. MD5 (/dev/null) = d41d8cd98f00b204e9800998ecf8427e

1 0

Re: FV's Borenstein discovers keystroke capture programs! (pictures at 11!)
by Jeremy Mineweaser 17 Dec '03

17 Dec '03

At 04:39 PM 1/29/96 -0500, Nathaniel Borenstein wrote: >Well, the mis-conceptions are flying fast and furious. > >You're twisting our words. We believe it is a truly fatal flaw in those >internet commerce schemes that are based on software encryption of >credit card numbers. There are several schemes for Internet commerce >that are unaffected: > > -- First Virtual (of course) Question: Could you please describe the nature of the First Virtual protocol? Now before you tell me to RTFM, let me explain. I assume, although without absolute certainty, that in order to bill me you must know my credit card number. If you do not know my credit card number, and depend on someone else who does, you are nothing more than a middleman who introduces additional possibility for breach of security. If you do know my credit card number, you must deal with the associated problem of storing this number. Now perhaps I am wrong, and you really do keep all of your clients' card numbers in a printed book hidden within a safe, and for each transaction you remove the book, use your table to match FV_ID to CC#, process the transaction, and replace the book. However, I doubt this. More likely, you store the card numbers on a computer. And no doubt, someone or something enters those numbers into a database. You have just violated your own cardinal rule. Jeremy --- Jeremy Mineweaser | GCS/E d->-- s:- a--- C++(+++)$ ULC++(++++)>$ P+>++$ j.mineweaser(a)ieee.org | L+>++ E-(---) W++ N+ !o-- K+>++ w+(++++) O- M-- | V-(--) PS+(--) PE++ Y++>$ PGP++>+++$ t+() 5 X+ R+() *ai*vr*vx*crypto* | tv(+) b++>+++ DI+(++) D+ G++ e>+++ h-() r-@ !y-

2 1

RE: No FV supporters?
by Pete Loshin 17 Dec '03

17 Dec '03

Nathaniel seems to be defending his cause sufficiently well, and graciously answering the abuse. Some of the abusers are showing a fairly comprehensive lack of knowledge of the FV system. I would venture to say that FV has no more profit motivation than, say, Netscape--or how about Open Market? They who gleefully opened a "Here are the secure servers that haven't been hacked" page some time ago. That was pretty self- serving, wasn't it? Nor would I consider the FV brouhaha much more obvious than, say, the front page announcements about "NFS and RPC considered dangerous" that hit the big papers last year. The weaknesses of those protocols for internetworking have long been known to those working with TCP/IP. Now, clearly there are lots of opinions on FV's system, but if people like Sameer and Rich Salz (e.g., who have reputations as knowledgeable and aware) are going to trash FV it would mean a lot more to many readers if they could state more specifically what it is about FV that doesn't work (or that doesn't work as well as, say, SSL or CyberCash or Open Market's approaches). As for the Weld Pond/et al graphical clicking approaches, they may work and they may defend against some attacks, but I won't use it (too much clicking around, too likely to make mistakes) and neither will anyone without a GUI. My $0.02. -Pete Loshin pete(a)loshin.com Ted Anderson wrote: >I am rather shocked that after wading through hundreds of msgs of abuse >of Nathaniel and FV I haven't seen one message of support; but perhaps I >missed it. etc.

6 9

More FUD from the Luddites at FV [pt. 2]
by cman＠communities.com 17 Dec '03

17 Dec '03

People have been dealing with viruses and malicious programs since the dawn of PCs. (Before that even, really.) This is not news. A virus or trojan horse can do something much worse than the (possible) inconvenience of a "bad guy" getting your credit card number. Whether you're a business or an individual, having, say, your hard drive wiped clean by a virus would be several orders of magnitude worse than the relatively minor inconvenience of having to get unauthorized items deleted from your credit card bill. This is just as possible as the credit card scenario FV is painting, and PC owners have been dealing with this kind of threat for over a decade. Rather than focus on something as tame as credit card numbers, let's look at what else a malicious program could do if it had unlimited power over your PC: o Ransack your tax preparation files o Compress and transmit your financial information to your competitors or to Blacknet. o Capture the passwords and logins that you use while telecommuting o Use your dial-up bank-by-computer software to make unauthorized transfers. o Reformat your hard drive. The fact is, malicious programs are a threat that has been in the background for over a decade, and PC users with any experience to speak of are familiar with at least the rudiments of dealing with this class of problem. If anything, they're more familiar with this kind of threat than more network-specific threats. (Look at the huge sales of popular anti-virus products.) Sure, there are clueless people out there, but the solution is to help make them less clueless, not to stampede them in a panic, which is apparently FV's goal here. --doug Ernest Hua writes: >I'm quite amazed at the level of ... well ... how can I characterize it >without insulting too many people? ... arrogance? ... > >Many of you would be amazed at what motivates the average person to buy >or to use a computer. Most people, when asked about security, do not >even have a concept, let alone how it applies in a computer environment. > >There is far more misinformation and miseducation among the average user >than you might think. Not everyone understands why they need a modem in >order to get onto the Internet. Not everyone understands why you need >to sign up for an account with an ISV in order to get onto the Internet. >(You would be amazed at how many people think that just buying a modem >is good enough to get onto the Internet.) > >The response is typically, "I don't understand all that technobabble!" >"Just give me something that works!" "This is too complicated!" > >If you think that the dumb user should be left to fight for his/her own >survival on the information highway, you are easily condemning 75% to >90% of the current users. > >I am not entirely convinced that Borenstein is totally selfless in his >(or FV's) announcement. However, the basis of his argument, while it >may not apply to the cypherpunk community, has much merit in the real >world. > >Try helping 100 random people with computers. Bet you 90 of them have >trouble getting onto the Internet, period, let alone figuring how to >run Netscape. There is a reason why AOL/CompuServe do very well >caterring to those who are technically-challenged. > >Ern ------ ------ Douglas Barnes "The tighter you close your fist, Governor Tarkin, cman(a)communities.com the more systems will slip through your fingers." cman(a)best.com --Princess Leia

3 2

Re: FL Demonstrates Fatal Flaw in Logins
by frantz＠netcom.com 17 Dec '03

17 Dec '03

At 8:49 AM 1/30/96 -0500, Perry E. Metzger wrote: >Benjamin Renaud writes: >> The only events a Java applet is privy to are those that are typed in >> an applet window (and only those it itself spawned). > >Don't say "is privy". Say "is supposed to be privy". Doubtless bugs >will appear in java security in the future -- they've shown up in the >past. My bigest worry about Java security is the size of its "security kernel". Having a small, well defined, security kernel is a big advantage. All the better if the source is available for public review. Java has a large, and to me somewhat undefined "security kernel". (BTW - I havn't been able to find on the web pages the kind of overview of the libraries which would make the detailed method descriptions make sense. Perhaps I havn't looked in the right place.) ----------------------------------------------------------------- Bill Frantz Periwinkle -- Computer Consulting (408)356-8506 16345 Englewood Ave. frantz(a)netcom.com Los Gatos, CA 95032, USA

1 0

Re: Lotus Notes
by shamrock＠netcom.com 17 Dec '03

17 Dec '03

At 11:09 1/30/96, Charlie_Kaufman/Iris.IRIS(a)iris.com wrote: >p.s. re: the fact that it's 64 bits rather than 128. That was the limit on key >size of the crypto software we licensed from a third party. That crypto >software also limited us to 760 bit RSA keys. I find this very interesting. RSA prohibits its licencees from using RSA software with truly secure keylenghts. What may have incenitvised them to take this bizzare position? <Can't wait until these damm patents expire> -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred.

2 1

Clipper
by rschlafly＠attmail.com 17 Dec '03

17 Dec '03

>> One of the interesting things about the whole crypto debate, going back at >> least to the Clipper announcement (and actually some months before) has >> been that the pro-restrictions, pro-GAK side of the argument has almost no >> defenders! Except for David Sternlight, Dorothy Denning, and Donn Parker >> ("attack of the killer Ds"?), there are almost no public spokesmen for the >> pro-restriction, pro-GAK side. >> There's quite a few folks in the Yale CS department that are pro-Clipper >> or fence sitters. They justify it in class by claiming that law >> enforcement needs these abilities if LE is to remain effective. I don't think "pro-Clipper" properly characters the enemy. Clipper is chip used in a voluntary federal standard. If we had sufficient civil liberties guarantees, I bet even a lot of c'punks wouldn't object to govt agencies using clipper chips. But the Freeh/Denning position, as I understand it, is that: * privacy is not a right * the govt should routinely spy on citizens * strong crypto should be illegal * no public debate on the underlying issues Are there other computer scientists with this position? Roger

1 0