December 2003 - cypherpunks-legacy

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Adam Shostack <adam(a)homeport.org> mentioned: > The big problem with this is that net phones can be subject to > delay & drop out, and I don't want to deal with that when I'm talking > on the phone. Adam, Yes, and that's good news. We can claim, while we are building up our infrastructure, that we have a low-quality service that cannot compete with the current LD carriers. Meanwhile, several companies and committed enthusiasts are solving IPhone's technological problems. Also, ATM and other high-bandwidth technologies that the LD carriers are deploying can bring them profits when IPhone users request the _fast_ Internet. But the real money is in the billing system. And an efficient, decentralized ecash infrastructure will change the world. A cheap telephone-to-telephone long distance and international voice service, which people do want to buy, could provide the cash flow to jump start it. CW

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On the mailing list for the "Electronic Frontier Canada" (similar to, but not a part of EFF), David Jones (djones(a)insight.dcss.McMaster.CA) writes: > > Feds want encryption; Police opposition ignored. > >The federal government wants its employees, and Canadians in general, >to use strong, public-key encryption. Yes, the same encryption methods >that American law enforcement is so uptight about. The same encryption >that Canadian cops want to avoid, so they can continue to eavesdrop. > >It's summarized in a recent Ottawa Citizen article: > > gopher://insight.mcmaster.ca/00/org/efc/media/citizen.13feb96 > >You may recall the Canadian Association of Chiefs of Police (CACP) >have voiced their opposition to any encryption of communications unless >police had access to a "backdoor" last summer. > > gopher://insight.mcmaster.ca/00/org/efc/law/cacp.24aug95 > >In Canada, it looks like the right to privacy of telecommunications >might take precedence over the police interest in snooping to catch >criminals. I won't repost the entire article here, but here are some highlights: - The system is initially intended to secure email between federal government employees. Deployment is expected to begin next year. - Key management is decentralized; each department hands out its own keys. - Top-secret messages will be encoded using "palm-sized computer cards" (presumably some kind of PCMCIA device). - The Communications Security Establishment (~= NSA) helped to design the system, and claims that it's "more sophisticated than existing public versions". (This is the part that still worries me a bit, even though EFC's David Jones is quoted as saying that he has no concerns. Will the algorithms be published? Also, why develop a new, untested system -- why not just buy the thing from RSA, Viacrypt, etc.? Stay tuned...) - There's a great quote from Bob Little, deputy secretary of financial and information management for the Treasury Board: "[The CSE] don't have access to the keys . . . and never will. We did it to avoid the American experience with the Clipper Chip." - The RCMP (~= FBI) is not amused. All in all, it sounds like a positive development for once. -- Martin Janzen janzen(a)idacom.hp.com

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 01:06 PM 3/7/96 -0500, A. Padgett Peterson P.E. Information Security wrote: >Do not agree with you. Do support your right to disagree though. > P.fla That's all this guy said. Here's my more verbose response. >Do not agree with you. You are _entitled_ to not "agree" with me. What you are NOT entitled to, however, is to have a government that violates my rights by attempting to restrict crypto and other freedoms, even if it is with the support of 51% of the Congress or 51% of the voters or 51% of the population. (or even substantially more.) If you actively support such a government, or even encourage such a government, you are doing what is analogous to "inciting a riot": You are guilty of inciting the government to take improper, illegal, unconstitutional, or simply immoral actions against me and others, and in my opinion if such actions are taken you enter into that conspiracy. You may be alarmed that I might consider you a criminal for just exercising your "free speech." (If you're not alarmed, you SHOULD be!) I myself would greatly prefer to live in a society where speech was totally free: There would be no laws against libel and slander, and you could "yell 'fire' in a crowded theatre" without the possibility of prosecution. (All the other potential customers will be home watching on tape rental, which will make what you can do in a theatre less significant.) But until we live in such a world, I consider that yelling "child porn!" or "terrorism!" or "drug smuggling" in "a crowded Congress" or _to_ "a crowded Congress" that's anxious to restrict our rights ever further, is an incitement to violate my rights. > Do support your right to disagree though. No, I don't think you do. You've done NOTHING to actually _support_ my right to disagree, except possibly waste a few bytes of information space on a message that you did not see fit to publicize. (I did, however.) Clearly, your "support" for my "right to disagree" is essentially non-existent. Jim Bell Klaatu Burada Nikto! -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT866/qHVDBboB2dAQHqfAP9F1vYWiHVT67QXNXwuDWpR9n6THRL4S2W vJq256khHXs4pMawUiGitkovVEDSBM8Tc6t6NpgNbwEojZ40dF147gqq7iTLOrf0 TU4RrUvBKiRJbTXnJM6YdHL7gOHQtU5TqHRft3R9JAHR5zEpetUSIo7+uVbklqqd Du1cZlTbu68= =M+dV -----END PGP SIGNATURE-----

1 0

Jump Start ecash With IPhone
by clarissa_wong＠alpha.c2.org 17 Dec '03

17 Dec '03

Proposal: Augment computer-to-computer Internet phone with local telephone-to-Internet-phone gateways to create a new telephone-to-telephone long distance network via the Internet. Result 1: No computer is needed for cheap long distance or international voice phone calls. Result 2: ecash gets its "Killer Ap", a service that (a) people want to buy and (b) requires micropayments for economic feasibility. (Details below.) Result 3: Creates a large, decentralized market that is difficult for anyone to regulate and that provides many opportunities to make money. Obvious Nonresult: Achieving privacy in long distance or international voice requires further development. Hardware and software beyond that in an ordinary telephone is needed at each end. Who Can Do It: ISPs (Internet Service Providers) are in the best position to operate nodes of this decentralized network. They have the Internet connection, the phone banks, the technical expertise, and some business experience. Telephone <---> ISP <---------> ISP <---> Telephone Scenario (Result 1): Granny Smith in Paducah wants to chat with her grandson Adam Smith, who is studying economics in Hong Kong. From her ordinary touch-tone phone she makes a local _voice_ call to Cheap Speech, Inc. and at the prompt enters the phone number for Adam. Cheap Speech finds that TalkToMe Ltd is a network node in Hong Kong within a local phone call of Adam and, through the Internet, establishes a connection. Then it patches in the voice call from Granny as TalkToMe dials out and reaches Adam. Granny Smith <--> Cheap Speech <-----> TalkToMe <--> Adam Smith Payments (Result 2): More than half the cost of running a traditional long distance voice business is for handling the billing. The cost of the technology to provide the service is thus less than the cost of the billing! Cheap Speech and TalkToMe cannot provide cheap voice service, as in the example above, unless they use a much more efficient payment system. That is why the low transaction cost of ecash is so important and that is why this message is being sent to cypherpunks rather than a telecom list or news group. So who uses the ecash? Surely Granny and Adam Smith can't shove it through ordinary telephones. They just want to get ordinary voice connections with ordinary telephones as they have for many years, only cheaper. Here is how I think ecash fits in: Granny Smith --> Cheap Speech Granny pays Cheap Speech through ordinary means, probably by monthly credit card charge, which is common for ISPs. The overhead for this probably is only around 5% (plus staff for account setup and support) because the ISP already is set up for that kind of payment system and Granny Smith is a local person providing repeat business, not a bad apple on a spending spree with a stolen credit card number. Cheap Speech --> TalkToMe Cheap Speech and TalkToMe do not have any previous business arrangement with each other and probably never have done business with each other before. They also are on opposite sides of the world. But Cheap Speech consults a Rating Service that says TalkToMe is reliable, so Cheap Speech sends a small amount of ecash to TalkToMe to open a connection and dial out to Adam. Since ecash clears instantly, TalkToMe does not need to know anything about Cheap Speech. No international billing network is needed. Little overhead is incurred. TalkToMe --> Adam Smith TalkToMe provides this service in exchange for the ecash from Cheap Speech. The main problem I see with this scheme is that Cheap Speech may have a cash flow problem. Payment to TalkToMe must be made immediately whereas payment from Granny Smith may take a couple of months to arrive. If, however, the volume of incoming calls (ecash coming in) matches the volume of outgoing calls (ecash going out), then the cash flow will balance out. Also, Cheap Speech could offer Granny a discount for prepayment. Regulation and Profit Opportunities (Result 3): Big, centralized organizations are big targets for lawsuits and regulation. They are the "deep pockets" lawyers love to pick. They are the leverage points for power-hungry politicians. But the Internet was designed to survive nuclear war. It was designed to route around outages, no matter their cause. A decentralized, Internet-based, international network of small, independent voice service providers could enjoy similar advantages. Many companies are creating _computer-to-computer_ Internet phone software. See the NetWatch Top Ten - Voice / Video On The Net at URL: http://www.pulver.com/netwatch/topten/tt24.htm We can depend on that technology to improve. I do not know of any companies who also are providing interfaces to ordinary telephones and designing a decentralized network with an ecash-powered payment system. That is our advantage. But the network described above has many limitations. These are opportunities to make money by selling your solutions to customers. Examples: It needs a directory and rating service for voice providers such as Cheap Speech and TalkToMe. (Perhaps Raph Levien will expand his rating services to a new domain?) The network will not be useful until it has many nodes. That is partly why this proposal is being sent to a large audience. Cypherpunks who cut their teeth building a remailer network perhaps can build a voice network, too? Think of it as a challenge. People who travel a lot will want cheap long distance telephone service while on the road. How do they arrange that if their only contract is with a service provider near their home? We need a more flexible payment protocol than the one described above. Enhanced services - fax, teleconferencing, time-delay and retry, phone mail, and collect calls. Multiple brands of ecash will require conversion services. Currently Mark Twain Bank's offering looks best, but when ecash succeeds, expect many more. Eventually, the network may work best with ecash denominated in currencies other than government-sponsored fiat currencies. Conclusion: If this idea is so good, then why am I telling you about it? (A) I cannot do it all myself. (B) Feedback on the idea from knowledgeable people is valuable. (C) If it succeeds, it will create a market with opportunity for plenty of people to make money, including me. (D) We have a limited window of opportunity to get this done. My guess is that we have roughly one year before other people embed their solutions into the Internet and financial system so deeply that this network will be locked out from commercial success. According to the theory of increasing returns, whoever gets to market first usually gets the market. (E) Even though the decentralized structure should help reduce exposure of the network-as-a-whole to harmful lawsuits and regulations, individual local providers may face sanctions from regulators of the FCC, state PUCs, national Telekom monopolies, etc. once they realize what's happening. (Operators of cypherpunk remailers endure similar risks.) The faster the system can be developed and deployed, with a large number of satisfied customers, the more widespread support it will have, the harder it will be to stamp out, and the safer life will be for everyone involved. It would be nice to be able to say "The Genie is out of the bottle." CW

1 0

Re: Bidzos on CNBC, discussing Leahy's Bill
by jim bell 17 Dec '03

17 Dec '03

At 01:26 PM 3/5/96 PST, Jim Bidzos wrote: > >I'm in favor of the Bill because it specifically prevents, by law, the >US Govt from mandating key escrow. Justa sec! I thought it was the 1st amendment to the Constitution which was supposed to prevent mandatory key escrow. Why should you be happy about a law: A law which is made by Congress can be UNmade by Congress. >Also because it would, by law, >force export control of crypto out of the Dept. of State and into the >Dept. of Commerce, effectively allowing any crypto used in the US and >"widely available" to be exported. While I agree this segment of the bill may be an excellent result, there is no reason that we should have to tolerate the bad portions of this bill to get the good portions. >(The bill does a few other things. >One, it provides for criminal penalties for key holders who abuse >their role as an escrow agent, assuming anyone *chose* to use key >escrow. Which may, inadvertently, give the average individual the ILLUSION of protection. Remember, prosecutions occur because the GOVERNMENT wants them to occur; there is no such thing as a "private prosecution," unfortunately. I'm not particularly afraid of abuse by key escrow agents, because I have no intent of using one. >Second, it makes the use of encryption -any encryption- a >crime if used in the commission of or support of any criminal >activity. Having not read the bill, I can't know for sure, but I'd imagine that if the term "support" is in the bill, they define that term as broadly as they want to. Sorry, but I'm not satisfied. If an act is criminal, let's prosecute the act itself. Any attempt to prosecute USE of encryption must, essentially by definition, impute an INTENT to the user, an intent that the government will fabricate after-the-fact. The government will also use this law to keep themselves in business, as you probably understand I believe. >I think the bill would be better off without these >provisions, but I suspect this is an attempt to give the >administration something.) Let's give them NOTHING. The government is already hamstrung in their attempt to restrict encryption. I expect that nothing in this bill helps us out in any way. >I anticipate that the Administration, led by the intelligence and law >enforcement interests, will vigorously lobby against this bill... As surprising as this may sound, I hope THEY "win." Because that won't really be a win for them, and it won't really be a loss for "us."

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Thu, 7 Mar 1996, Duncan Frissell wrote: > However, a CA operating outside the licensing structure of current CA's > would have very low costs and hence no investment to lose in litigation. > Costs would be almost entirely marketing related and as long as you stayed > out of jurisdictions with some of the new CA law, no regulatory costs or > barriers. > I don't think this is definitional. If nothing else they can take the equipment. If you don't incorporate, your personal assets are at risk; if you do, you have to keep a real separation between the corporation and yourself, pay the taxes, etc. Ok, make it a non-profit labor of love; low risks, no returns, then maybe you are right. Just hope that there ar no punitive or large consequential damages, and no one pierces the corporate veil (unlikely, I admit, but not impossible). What law applies to a certificate used in a multi-jurisdictional transaction is less obvious to me than I would like. I think I have talked a student in my seminar into writing a paper to educate me. [The above may have been dictated with Dragon Dictate/Win 2.0 voice recognition. Be alert for unintentional strange word substitutions.] A. Michael Froomkin | +1 (305) 284-4285; +1 (305) 284-6506 (fax) Associate Professor of Law | U. Miami School of Law | froomkin(a)law.miami.edu P.O. Box 248087 | http://www.law.miami.edu/~froomkin Coral Gables, FL 33124 USA | It's warm here.

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Well, it turns out that (according to a nice person at SurfWatch who put up with the rant I mailed in and send back a denial rather quickly) io.com isn't actually blocked. At least, so they say. No comment on whether there's anything like the "25 complaints" policy. I don't own SurfWatch, but if anybody does and finds www.io.com blocked, I'll send in another rant. I wonder whether they've actually considered the liability situation in re: blocking sites that shouldn't be blocked? I mean, sure, they seem nice enough about setting things right (like with the Nynex sites whose url's had "xxx" in the paths), but it seems to this non-lawyer that a case could be made for damages inflicted by being known as a purveyor of filthy indecency for even a short while. ______c_____________________________________________________________________ Mike M Nally * Tiv^H^H^H IBM * Austin TX * pain is inevitable m5(a)tivoli.com * m101(a)io.com * <URL:http://www.io.com/~m101> * suffering is optional

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- someone wrote: >[homepage on IO] > >BTW, did you hear that IO got on the SurfWatch "bad list" because there >were more than 25 complaints about objectionable material in the io.com >domain. (Apparently, when SurfWatch hears more than 25 complaints >against a particular domain, the just deny access to the whole domain >rather than particular URLs.) A quick phone call to the Surf Watch people revealed that they rarely block whole domains, and that they are not currently blocking all of io.com. - -- mutant(a)compuville.com "They that can give up essential liberty to mutant(a)cypher.net obtain a little temporary safety deserve (send mail with Subject: neither liberty nor safety." send-pgp-key for PGP key) -Ben Franklin ~1784 -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMT9NaH0ndmRPxibdAQFSJwQAtq/s1c+GZlHvgVOhNgM8Dseq0SQ+6L8U bx8FV0l85anNk+fjRnY5hD8RflHFeVzLis2yDmn8BLjYzVnHBEWBXXncpwg3okoQ FOMJJTZZbOec10ESy3pvRPwgie60IaR3qIcHUmUHRqbv5dOjgDg5GhYWeZ8rhCCN 0pisfaQBsVc= =qgSw -----END PGP SIGNATURE-----

1 0

Re: A brief comparison of email encryption protocols
by cme＠cybercash.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 15:54 2/29/96, Derek Atkins wrote: >So, there needs to be a compromise, some shorthand method to describe >the hint. One solution is to provide a "keyserver" type and then some >string that says which "keyserver" to use. For example, if there is a >DNS-style keyserver deplyed, I could put '1,"mit.edu"' in all my >signatures, if we assume that '1' is the DNS-style keyserver code. > >I'm sure there are other possible solutions as well, and any real >suggestions are welcome. is a URL just too big? My sigs are already several lines long. E.g., Key: ftp://ftp.clark.net/pub/cme/cme.asc -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMTYY/1QXJENzYr45AQFr5QQAkff2u+VvCvpPYTyYCVsj1NFMD/dsN+Ps Dyc7cX4iMDynls+dibG8cTAw6FrqKtvZ6qSDdu15oI49rHiEzTZOWj/VUKjlalmu rp0QZ7iSiYinsHFK4H/ZfWarx/3RfngGFXjNOLQUjpe0Otqz1nnHqaVkCXPbz/VG gmQbMKn5syA= =hKEC -----END PGP SIGNATURE----- +--------------------------------------------------------------------------+ |Carl M. Ellison cme(a)cybercash.com http://www.clark.net/pub/cme | |CyberCash, Inc., Suite 430 http://www.cybercash.com/ | |2100 Reston Parkway PGP 2.6.2: 61E2DE7FCB9D7984E9C8048BA63221A2 | |Reston, VA 22091 Tel: (703) 620-4200 | +--------------------------------------------------------------------------+

9 13

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

> In a statement from Washington, the America's Carriers Telecommunication >Association says it "submits that it is incumbent upon the FCC to exercise >jurisdiction over the use of the Internet for unregulated interstate and >international telecommunications services." > "For example," adds the ACTA statement, "online service providers generally >charge users around $10 for five hours of access and then around $3 for each >additional hour. Five hours equals 300 minutes, divided by $10 is 3.3 >cents per >minute. The average residential long distance telephone call costs about 22 >cents per minute or seven times as much." It seems that once again, big business is trying to get in the way of progress and competition because they are afriad they are going to lose some money. It seems to me that the ACTA is upset because someone found a way to "do it cheaper" and the telco's stand to lose a lot of long distance dollars. So rather then using this technology and perhaps lowering LD rates, instead they seek to block out the technology from the public. I wonder what would happen if someone discovered an drastically cheaper alternative to gasoline, but it never made it main stream because the oil companies would go out of business. Seems like the same type of situation with the telco's. > Says ACTA, "Technology may once again be surpassing government's ability to >control its proper use. However, the misuse of the Internet as a way to >'by-pass' the traditional means of obtaining long distance service could >result in a significant reduction of the Internet's ability to transport >its ever >enlarging amount of data traffic." No, the technology is surpassing the telco's ability to provide low-cost communications. > Specifically, ACTA petitions the FCC to define the type of permissible >communications that may be effected over the Internet. Permissible communications? This sounds like something out of the CDA ... I say, just try and regulate it. I want to see the FCC try and monitor several million computer transmissions every day and see how well regulation works. Thomas J. Sawyer sawyer(a)nextek.com

1 0