December 2003 - cypherpunks-legacy

Re: (Fwd) British Study Claims That Photo Credit Cards Don't Work
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

> > Some thoughts... (er, questions): > > 1. What are the implications for log-on systems that rely on > > recognition of faces (supposedly impossible for hackers to describe > > and exploit)? At 11:19 AM 4/8/96 -0700, David Loysen wrote: > Does anybody know how well these systems work? Yes: They don't work. > If I don't shave over the > weekend will my computer know who I am Monday morning? Shaving probably will not be a problem, but holding your head at a slightly different angle, or having slightly different lighting, or combing your hair differently will screw up the system totally, unless the system has radically improved since the last time I read up on it. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

3 3

WRY_cfp
by John Young 17 Dec '03

17 Dec '03

4-09-96 FT reports on CFP, with wry comments about eavesdropping on cpunkish issues and notables: encryption blanc et noir; sci-fi scenarios; Garfinkel and Chaum on e- money; CDA; cyber-terrorism, -porno, -child abuse, and -crime; suits cold-sweating secrets. For the sweaters, a related sheepswooly vaunts Open Market's "industrial strength" OM-products for secure Net biz. WRY_cfp

1 0

Re: Disclosure of Public Knowledge to Foreigners
by cme＠acm.org 17 Dec '03

17 Dec '03

At 05:33 4/3/96, Timothy C. May wrote: >There is a reasonable chance the Supreme Court would see the overall >absurdity of a situation where the knowledge is freely available to 200 >million adult Americans, with no restrictions whatsover on publication, >discussion, etc., and yet uttering this knowledge in front of a foreigner >is a crime. > >I don't think this would pass Constitutional muster, as the lawyers like >to say. > >(The British at least have an Official Secrets Act. Much as I dislike that >Act, at least they are more consistent in the sense of classifying things >as being secret. How can the U.S. argue that knowledge available in any >large library or bookstore to anyone who wants it, citizen or not, may not >be "disclosed" to foreigners? If it's common knowledge, it's common >knowledge!) This assumes that the purpose of the ITAR restrictions is to keep a secret. To the extent that the gov't argues that, they have no case as you point out. However, the ITAR is there specifically to frustrate US businesses if they should want to sell or give away crypto overseas. The rules, despite their illogic, achieve that goal. I would like to believe that the Supremes would rule that the Gov't has no right to use what amounts to a secrecy provision just for harrassment -- but they might not. I had Mike Nelson say to my face, 1.5 years ago, that he knows good crypto is available to foreigners -- he just wants to make damn sure it doesn't come in shrink-wrapped packages from US companies. I can't judge the constitutionality of that position but it holds together logically. ["don't let American products hurt American interests" the battle cry runs] - Carl +--------------------------------------------------------------------------+ | Carl M. Ellison cme(a)acm.org http://www.clark.net/pub/cme | | PGP: E0414C79B5AF36750217BC1A57386478 & 61E2DE7FCB9D7984E9C8048BA63221A2 | | "Officer, officer, arrest that man! He's whistling a dirty song." | +---------------------------------------------- Jean Ellison (aka Mother) -+

2 1

Bank transactions on Internet
by Jüri Kaljundi 17 Dec '03

17 Dec '03

Suddenly some banks here in Estonia have decided that they must start offering banking services over Internet already during the next months. What worries me is that some of them are talking about using 40-bit SSL as the main security mechanism. What about banks in US and Europe, how many of them are using Internet and WWW to offer their services already? Is it possible to use WWW forms to make real transactions or can you just view your transaction history and account status? In case the banks are using WWW forms and SSL, are the services limited to 128-bit clients? How is the client authentication handled? Does the client just get a plain username and password? I had a look at some banks like Security First National Bank and some others, and it seems that they use just SSL + username/password for they banking services. Does this really work, especially with 40-bit keys? SSL with client certificates would seem a little bit more secure once it is available, but still not secure enough for real banking on Internet. Just curious (and confused), Juri Kaljundi jk(a)digit.ee

6 9

Re: the cost of untracability?
by Duncan Frissell 17 Dec '03

17 Dec '03

At 03:36 PM 4/8/96 -0400, Black Unicorn wrote: >In addition, to prevent funds from being removed to non-resident aliens >or foreign entities where tax enforcement and collection is difficult, >there is a 30% withholding requirement in the event the payee is not a >U.S. citizen or resident (for tax purposes). The withholding tax applies only if the payee is not a resident of a jurisdiction with a tax treaty with the US. Net banking will further muddy the waters on this because of the difficulty of telling the residency of customers particularly in the case of accounts transferred to third parties for profit -- a worthwhile future business activity. DCF

2 1

WWW User authentication
by blane＠aa.net 17 Dec '03

17 Dec '03

I just finished writing a cgi script to allow users to change their login passwords via a webpage. I currently have the webpage being authenticated with the basic option (uuencoded plaintext). MD5 would be nicer, but how many browsers actually support it? When the user changes their password, the form sends their name, old password, and new password with it, in the clear. This is no worse than changing your password across a telnet connection, but I'd like it to be more secure, but useable by a large number of browsers. Any advice? Brian ------- <blane(a)aa.net> -------------------- <http://www.aa.net/~blane> ------- Embedded Systems Programmer, EET Student, Interactive Fiction author (RSN!) ============== 11 99 3D DB 63 4D 0B 22 15 DC 5A 12 71 DE EE 36 ============

4 4

Re: unsubscrive
by Brad Shantz 17 Dec '03

17 Dec '03

Time May Wrote: >Maybe these dweebs are posting from an alternate universe? A universe in >which not even messages explaining that "unsubscrive," "unsuscribe," >"undescribe," "unscribe," and "unimbibe" are not valid alternate spellings >of "unsubscribe." > >I've copied my short explanation of how to subscribe and unsubcribe too >many times to do it again; and it is clear that these folks are either >doing this out of spite, are not reading any of the messages we send them, >or think it funny. I agree with you to a point, Tim. They probably haven't read the messages about how to properly unsubscrive. Not because they are dweebs or because they think it's funny. they probably haven't read the messages because they have 2 or 3 thousand messages in their inbox and they're all from cpunks. Unfortunately, this time, I have to give them the benefit of the doubt for being ignorant. I don't think they're being vindictive. How many of them have posted Unsub messages after being told the proper way to unsub? Brad This may kill off the Cypherpunks list even where Detweiler's massive rants failed. (Now that Detweiler's cabin in Montana has been raided, and one of his tentacles carried off, who will fill his shoes? Vlad the VZNuri is well on his way to matching Detweiler's volume, if not his obsessiveness.) --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^756839 - 1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

4 3

Re: Bulletin: Cypherpunks say no taxes owed by moneychangers!
by Frank O. Trotter, III 17 Dec '03

17 Dec '03

Lets state it simply, if you make a gain by holding a currency then it must be included in your reported income. At least one writer correctly stated that the IRS likely does not care about small amounts taken on a trip, but they are technically reportable. Same goes for a loss, it is a deduction (with string attached of course) from taxable income. Aside from ecash, helping people to exchange currency is my day job so I see this all the time, especially this month each year. Best FOT Disclaimer: Personal not corporate thoughts.... Frank O. Trotter, III - fotiii(a)crl.com www.marktwain.com - Fax: +1 314 569-4906 --------------------------------------------

2 1

NSA Budget
by cpunk＠remail.ecafe.org 17 Dec '03

17 Dec '03

>Is there a public release of the NSA's annual Budget. >If so is there a quarterly release. -Erinn ----- Yes, there are annual and quarterly reports released to the public which describe in meticulous detail expenditures for the agency's program, personnel and equipment: 1. The program of services and information supplied to government and other intelligence organizations, US and foreign, with terms of each client contract. 2. US employees, their organization, skills, duties and longevity of service; their names, ranks, identification codes, secure communication methods and home addresses; the location of workplaces; the continued training each is scheduled to receive; leaves of absence and destinations while absent. 3. Foreign nationals covertly employed worldwide, with information on each as per 2. 4. A comprehensive listing of all types of world-wide equipment operated; its detailed design, function and output; where it is located; its designers, manufacturers and purchase cost; its schedule of amortization; and its schedule for replacement and/or upgrade, with fifteen-year projected procurement. 5. Special short- and long-term contracts with governmental and non-governmental organizations, US and foreign for one-time projects, by goal, personnel and equipment. 6. Special projects with other US and foreign counter- intelligence to issue disinformation about the agency. 7. Special section on world-wide US and foreign cryptology: cryptanalysis, cryptography, steganography, codes, cyphers, glyphs, mimes; each ranked for security and ease of cracking; governmental and non-governmental parties using each; names of cooperative and resistant cryptographers and cooperating pseudo-cryptographers. 8. Sub-section on methods of Internet traffic and language analysis; operation and surveillance of anonymous remailers, bulletin boards and mail lists; lists of cooperative and resistant educational institutions and commercial organizations. 9. Appendices on: black operations; transparent operations; methods for managing cooperative and resistant governmental and non-governmental persons. The public is invited to study and/or download these reports anonymously at: http://nsa.dod.gov/~reports/quarterly.txt

2 1

US crypto laws? Need help!
by Jean.Chouanard＠grenoble.rxrc.xerox.com 17 Dec '03

17 Dec '03

Hi! I was wondering if a foreigner like, with a valid work visa but not a permanet green card, is allowed to use crypto in the state. If yes, is there any restriction? Depending on crypto methods? Thank a lot, Jean --- let's all be different, just like me. --- Jean Chouanard | Jean.Chouanard(a)Grenoble.RXRC.Xerox.com Networks & Systems Eng. | Rank Xerox Research Centre Fax: (33) 76 61 51 99 | 6, Ch de maupertuis Ph: (33) 76 61 50 90 | 38240 Meylan FRANCE

5 4