December 2003 - cypherpunks-legacy

DCSB: The FSTC Electronic Check Project
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Digital Commerce Society of Boston Presents Frank Jaffe, of The Bank of Boston and The Financial Services Technology Consortium (FSTC) "The FSTC Electronic Check Project" Tuesday, June 4, 1996 12 - 2 PM The Downtown Harvard Club of Boston One Federal Street, Boston, MA Frank Jaffe is a Senior Systems Consultant in the Applied Technology Group at the Bank of Boston. Frank is currently the project manager for the FSTC Electronic Check project which involves over 30 companies. Frank has played a leadership role in planning the amalgamation of Bank of Boston's five major retail computer systems into a single, common software system; acting as project leader for a new teller system, and leading the screen phone R&D project in cooperation with Northern Telecom and Bellcore. The FSTC Electronic Check project will develop an enhanced all-electronic replacement to the paper check. Electronic checks will be used like paper checks, by businesses and consumers, and will use existing inter-bank clearing systems. Like its paper counterpart, the Electronic Check represents a self contained "information object," which has all of the information necessary to complete a payment. Likewise, paper checkbooks are replaced by portable Electronic Checkbooks; pens & signatures are replaced by signature card functions and digital signatures using advanced cryptographic techniques; stamps and envelopes by electronic mail or other communications options such as the World Wide Web over the Internet. The fully automated processing capabilities of Electronic Checks opens the possibility of other types of financial instruments, such as electronic cashiers, travelers, and certified checks. Electronic check writing and processing will be integrated into existing applications, from cash registers to personal checkbook managers to large corporate accounting systems, to greatly increase the convenience, and reduce the costs, of writing, accepting, and processing checks. This meeting of the Digital Commerce Society of Boston will be held on Tuesday, June 4, 1996 from 12pm - 2pm at the Downtown Branch of the Harvard Club of Boston, One Federal Street. The price for lunch is $27.50. This price includes lunch, room rental, and the speaker's lunch. ;-). The Harvard Club *does* have dress code: jackets and ties for men, and "appropriate business attire" for women. We need to receive a company check, or money order, (or if we *really* know you, a personal check) payable to "The Harvard Club of Boston", by Saturday, May 4, or you won't be on the list for lunch. Checks payable to anyone else but The Harvard Club of Boston will have to be sent back. Checks should be sent to Robert Hettinga, 44 Farquhar Street, Boston, Massachusetts, 02131. Again, they *must* be made payable to "The Harvard Club of Boston". If anyone has questions, or has a problem with these arrangements (We've had to work with glacial A/P departments more than once, for instance), please let us know via e-mail, and we'll see if we can work something out. Planned speakers for the following few months are: July Pete Loshin Author, "Electronic Commerce" August Duane Hewitt Idea Futures We are actively searching for future speakers. If you are in Boston on the first Tuesday of the month, and you would like to make a presentation to the Society, please send e-mail to the DCSB Program Commmittee, care of Robert Hettinga, rah(a)shipwright.com . For more information about the Digital Commerce Society of Boston, send "info dcsb" in the body of a message to majordomo(a)ai.mit.edu . If you want to subscribe to the DCSB e-mail list, send "subscribe dcsb" in the body of a message to majordomo(a)ai.mit.edu . Looking forward to seeing you there! Cheers, Robert Hettinga Moderator, The Digital Commerce Society of Boston -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMZec9fgyLN8bw6ZVAQHb/wP9FrQXK4sCBRnfqNt2bJTzWX5BpxDC4NXY RZjQfNP6coAvjh1nc1gNVHcFFgCB2Mh8Mmt876gJr48JUfWpMIQ3XW4CKuqjY6NQ Bw/SRarICPNLSCMbsdX2kHYwi1OuMwkVYm9rXotF4byrDItdxursXacxvvdYyW/u mZMx+eXWq1E= =hXUa -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/ ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "If they could 'just pass a few more laws', we would all be criminals." --Vinnie Moscaritolo The e$ Home Page: http://thumper.vmeng.com/pub/rah/

1 0

Senator Burns at HotWired Today
by Jon Lebkowsky 17 Dec '03

17 Dec '03

Monday, 13 May 6 p.m. PDT Senator Conrad Burns in WiredSide Chat Senator Conrad Burns (R-Montana) has recently introduced legislation to make it easier for netizens to get strong, easy-to-use privacy and security tools for the Internet. The Pro-CODE bill (S. 1726) aims a silver bullet straight at the heart of the Clinton administration's unworkable Clipper and Clipper II schemes by rolling back Cold War-era regulations on the export of strong cryptography. Join us Monday, 13 May at 6 p.m. (Tuesday 01:00 GMT) to talk technology with Washington. -- Jon Lebkowsky <jonl(a)wired.com> http://www.well.com/~jonl Electronic Frontiers Forum, 7PM PST Thursdays <http://www.hotwired.com/eff>

1 0

TO ALL MEMBERS
by Mathew Ellman 17 Dec '03

17 Dec '03

TO ALL MEMBERS, IM TIRED OF ALL THIS SHIT I HAVE UNSUBSCRIBED MANY TIMES AND ALL I GET IS SOME STUPID ASS REPLY ABOUT CLOSED LIST OR ADDRESS NOT MATCHING AND I GET NO REPLY SO UNLESS YOU ALL WANT TO GET A BUNCH OF UN WANTED BULLSHIT (LIKE THE SHIT IM GETING FROM YOU ) I SUGEST SOMEONE FIND A WAY TO GET ME THE FUCK OFF THIS LIST . I HAVE GOT IN TOUCH WITH THE PESON THE REPLY TELL ME TO AND NO REPLY. IM TIRED OF ALL THIS SHIT.

3 2

[NOISE] Re: Notes from the SF Physical Cypherpunks meeting
by Peter Trei 17 Dec '03

17 Dec '03

> From: minow(a)apple.com (Martin Minow) > Subject: Re: Notes from the SF Physical Cypherpunks meeting [...] > The Swedish government has a rather strong tradition of protection > of individual privacy (encrypting COM e-mail is one example). [...] > Martin Minow > minow(a)apple.com Huh? 'a rather strong tradition of protection of individual privacy'? In Sweden, for many years you could (and for all I know, still) go to a public records office and look up all kinds of personal data on anyone, without restriction - you could, for example, find out your co-workers exact salaries if you were curious. My understanding is that Sweden's postion vis-a-vis the Internet has been particularly clueless, with international email technically a crime, and government officials who regard modems as criminal tools. I hope things have improved. Peter Trei (former resident alien in Sweden) ptrei(a)acm.org

2 1

Interest to punks in latest CACM
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

A Meeks article I think that would benefit some cypherpunks... - politics/effectiveness "Comparing Information Without Leaking It" - Fagin, Naor, Winkler - crypto/protocol "A Reengineerings Framework for Evaluating a Financial Imaging System" - certificate processing workflow redesign. _______________________ Regards, Men govern nothing with more difficulty than their tongues, and can moderate their desires more than their words. -Spinoza Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: Notes from the SF Physical Cypherpunks meeting
by minow＠apple.com 17 Dec '03

17 Dec '03

Thanks to everyone who took the trouble to correct errors in my notes from Saturday's Cypherpunks meeting. They were written for my own benefit -- and for the benefit of some friends who couldn't be there. Since I can give away information without losing it (to misquote Thomas Jefferson), I'm happy to share it with the cypherpunks. A comment from Matts Kallioniemi might be worth some further discussion: >>COM e-mail/bbs system (Sweden) -- operator could backup >>e-mail, but not read it. > >Sure. The database was encrypted by using XOR with the string >"KOM". That was the sorry state of encryption in the early eighties. > Encrypting the database with a fixed string offers a good example of how "locks keep honest people honest." This would prevent an operator from unintentionally reading a message in case it was revealed by, perhaps, a disk sector editor or crash dump. I suspect that the state of encryption in Sweden in the early eighties was somewhat stronger than XOR (wasn't Hagelin a Swede who moved to Switzerland to start Crypto AG?), but not necessarily visible to the general public. The Swedish government has a rather strong tradition of protection of individual privacy (encrypting COM e-mail is one example). For example, the initial Swedish implementation of a national criminal database in the mid 1970's (equivalent to the US NCIC) used dialback telexes to prevent unauthorized (and untracked) access. A recent newspaper article noted that some police officers were being investigated for unauthorized access to the personal information of a collegue who had complained of sexual harassment. Martin Minow minow(a)apple.com

3 2

CDA Dispatch #10: Last Day in Court
by Declan B. McCullagh 17 Dec '03

17 Dec '03

----------------------------------------------------------------------------- Fight-Censorship Dispatch #10 ----------------------------------------------------------------------------- The CDA Challenge: Last Day in Court ----------------------------------------------------------------------------- By Declan McCullagh / declan(a)well.com / Redistribute freely ----------------------------------------------------------------------------- In this dispatch: The DoJ's flimsy, cheesy, flawed defense Judges question DoJ investigation of CompuServe "The Newspaper Decency Act" http://pathfinder.com/Netly/daily/960513.html The Netly News May 13, 1996 PHILADELPHIA -- Anyone want to bet on the outcome of the Communications Decency Act? I attended the whole thing, which ended Friday in a Philadelphia federal court, and here's the McCullagh Morning Line: 3:1 that the CDA gets struck down as unconstitutional. It can't possibly be upheld -- not from what I understand about the First Amendment, not from what I heard of the flimsy, cheesy Justice Department case (and I heard the whole flimsy, cheesy defense) and certainly not from how the judges were acting on the last day of the hearing. Members of the three-judge panel practically laughed in exasperation at Justice Department wafflings. As you probably recall, The American Civil Liberties Union and American Library Association coalition challenged the so-called Decency Act on the grounds that it would unconstitutionally chill free speech online. The CDA would criminalize "indecent" speech on the Net, invoking a standard -- indecency -- that's yet to be defined. Not for lack of trying, of course. DoJ attorney Tony Coppolino danced a nimble flamenco around the legal meaning of "indecency" and what may or may not be prosecuted under the CDA, arguing on Friday that indecency is a "medium-dependent standard." That is, he said, it can be read to apply mostly to hardcore porn, not literature, and would leave most Web-based jottings alone. But he admitted: "We can't provide assurance that a prosecutor won't take on an absurd case." Dolores Sloviter, chief judge of the Third Circuit Court of Appeals, jumped down his throat: "I've been taking the position for 17 years that people should know what they can be prosecuted for. Doesn't that present a problem?" she asked. "I still don't understand" what indecency means under the CDA, she said. "We've been trying to get at this for 40 minutes," grumbled Judge Stewart Dalzell. Later Dalzell grilled DoJ attorney Jason Baron over the Justice Department's decision to "review" a complaint lodged by the American Family Association against CompuServe's new adults-only service. (The AFA is the most virulent "family values" group involved in the fight over the CDA. Only a week after the law was passed, the AFA said it didn't go far enough.) Dalzell stressed that CompuServe had employed every blocking and parental control mechanism possible under current technology -- but that didn't stop the FBI from investigating the Columbus, Ohio-based corporation. "What more could CompuServe have done?" Dalzell asked. Baron cavilled. "The Justice Department was concerned this may be obscenity," he claims. The distinction between obscenity, which is illegal, and indecency, which is still undefined, is important, and that was a nice try by Baron. Unfortunately for him, the CompuServe forum in question has only Playboy-style centerfolds -- softcore stuff that the DoJ's own attorney Coppolino admitted earlier is not obscene. Clearly, the Government had no business looking into the CompuServe matter. Indeed, outside the courtroom at the end of the day, the ALA's Bruce Ennis charged that the government violated a restraining order barring them from investigating alleged CDA violations. "We were very upset. We think this violated the court order," said Ennis. "We went to court yesterday and asked for a clarification. That's now pending." The only defense against prosecution and conviction that the government offered was requiring credit cards before providing access to "indecent" speech on web sites -- a solution that Baron admitted isn't exactly practical for individual speakers. When Baron trotted out Dan Olsen's -L18 self-tagging scheme as an alternative, even the normally quiescent Judge Ronald Buckwalter noticed: "It's not available now. It's a hypothetical." Judge Sloviter added it was "the product of Mr. Olsen's creative imagination." In final arguments, Chris Hansen from the ACLU said not only would a requirement for -L18-style self-labelling "violate the prohibition against compelled speech," there is no tagging technology "that applies to Usenet newsgroups and mailing lists." The most unusual sideshows of the last day of the hearing was when government attorneys were forced to defend free speech in print. Would a "Newspaper Decency Act" banning violence on the top of the front page be constitutional? asked Judge Dalzell, waving a copy of the Philadelphia Inquirer with a photograph of a Liberian prisoner being executed. "My ten-year old son is a rabid Phillies fan" and came across this image, he said. (We must confess to missing the logic here: Are Phillies fans particularly sensitive to violence?) "The print medium enjoys the greatest protections -- the Internet is becoming more television-like," replied Coppolino, trying to dodge the question. The Philadelphia court is expected to issue a decision by mid-June. Both the plaintiffs and the Department of Justice have said they will appeal to the Supreme Court, which may decide to hear the case after it reconvenes in early October. Assuming the Justice Department loses, will they really appeal to the Supreme Court? If so, I object to my tax money being wasted on this crap. --By Declan McCullagh ----------------------------------------------------------------------------- Mentioned in this article: DoJ refers American Family Association's CDA complaint to the FBI: <http://pathfinder.com/Netly/daily/960507.html> AFA "charges" CompuServe with violating the CDA: <http://fight-censorship.dementia.org/dl?num=2252> FBI finally rebuffs the AFA, when pressed: <http://fight-censorship.dementia.org/dl?num=2445> Excerpts from DoJ and anti-porn groups' CDA briefs: <http://fight-censorship.dementia.org/dl?num=2387> Transcript of Olsen's "-L18" description and other testimony: <http://www.cdt.org/ciec/transcripts/April_15_Olsen.html> Mike Godwin on indecency vs. obscenity: <http://www.cs.cmu.edu/~declan/articles/godwin.indecency.txt> This and previous Fight-Censorship Dispatches are available at: <http://fight-censorship.dementia.org/top/> <http://www.eff.org/pub/Legal/Cases/EFF_ACLU_v_DoJ/> <http://www.epic.org/free_speech/censorship/lawsuit/> To subscribe to the fight-censorship announcement mailing list for future Fight-Censorship Dispatches and related discussions, send "subscribe fight-censorship-announce" in the body of a message addressed to: majordomo(a)vorlon.mit.edu Other relevant web sites: <http://www.eff.org/> <http://www.aclu.org/> <http://www.cdt.org/> <http://www.ala.org/> -----------------------------------------------------------------------------

1 0

Re: Fingerprinting annoyance
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 6:26 PM 5/13/96, Mark O. Aldrich wrote: >On Mon, 13 May 1996, Senator Exon wrote: > ><snip> >> i can fill out and manipulate the card myself i just need a >> working method. >> is there no privacy advocate who can help me? >> > >I think most privacy advocates would advise, "Refuse to submit." It >sounds like you're looking for more of a hack on the fingerprinting process. And if you are working for me, and I ask for a fingerprint, and you refuse or "smear" the results (repeatedly, as the first smearing I may just take as your token protest and have you printed again), you'll be out the door by the end of the day. (Personally, I've never worked for a company which demands fingerprints, but I've worked for companies which demanded ID badges and signatures, and these are effectively as intrusive. And I suspect that my former employers are now using thumbprints, and maybe full prints.) What one "doesn't like" and considers an "invasion of privacy" varies from person to person. Some people think having their picture taken is a stealing of their soul. Others fear nefarious things will be done with the DNA from their blood samples. Trying to convince a company that photo ID badges and fingerprints are Bad Things is perhaps admirable, just realize that in a free society that employer is under no obligation to hire someone who refuses to go along with the company's security policies. (This relates to the "civil rights" thread.) >of like a key certificate. If you really can dork the card, have ten >different people volunteer one print each. There's no way that they'll >ever be able to use that as evidence in a court or for any other purpose, >either. A stupid idea. As the employer, I wouldn't have to prove it a court of law...suspicion alone that some of my employees were fucking up a security system might be enough for me to either a. promote them to the Tiger Team, or b. fire their asses. (I just can't understand where this pervasive meme is coming from here on this list, the notion that employers are severely limited in what they can do to employees unless they can "prove it in court. Like it or not, most employees in the United States are still employed "at will," and are not covered by employment contracts such as some executives and the like get.) >If you're forced to do this in person with a tech, you can continuously >"fight" the grip they have on your hand and smudge the card. However, Sure. It makes it easy for the employer to simply say "Next candidate." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

3 2

Re: Civil liberties of employees (Re: FYB_oss)
by tcmay＠got.net 17 Dec '03

17 Dec '03

Professor Froomkin and I have many disagreements about the nature and direction of laws in the U.S. I think I was careful to couch my points in terms of what the law should be, not what it currently is. For example, I think it fully Constitutional to choose not to serve blacks in one's home, business, church, or whatever. Until fairly recently, the courts saw it this way as well. (I'm not referring to state-sponsored discrimination, such as keeping blacks and women from voting, or visiting government-paid-for facilities, etc) [This is a provocative statement to many. I can elaborate if there is real interest. Suffice it to say that if I operated a bookstore, or gym, or restaurant, or whatever, I would not personally choose to discriminate thusly. Though I might with regard to other (unspecified here) so-called minority groups. And it would be my free right to choose whom to hire, whom to do business with, whom to serve, and so on. It's pretty clear in the Constitution, as I see it, that the government is not empowered to tell people whom they may associate with and whom they _must_ associate with. Again, the so-called Civil Rights Movement, which had good origins in overturning clearly unconstitutional laws about voting (Jim Crow laws), state-enforced segregation, etc., has been carried to the point of interfering with the right of free association.] The current interpretation of the law makes it a crime for a restaurant to allow smoking (at least in many--and increasing--locales). The current interpretation (henceforth shortened to "CI" for brevity) says that a church may not discriminate on the basis of religious affiliation, and hence must not discriminate against Satanists. The CI says that a health club may not discriminate against women (but, interestingly, many health clubs here in my state of California are "women-only"). The CI says that if a white person uses the term "nigger" he may be convicted, in some jurisdictions, of a "hate crime," but if the coloreds use the term, it's OK. [Here in Santa Cruz, the term "black" has fallen into disfavor, and is dubbed a label of the whitemale patriarchy. Thus, we have "lesbians of color," "students of color," "queers of color," etc. As one leading thinker puts it, "all wymyn are people of color." Therefore, colored people, or coloreds, for short. We have come full circle.] >The issue here isn't a constitutional issue. It's a *statutory* right. >And a real one. Sex discrimination in employment is prohibited by law. >We can call this a "civil right" or something else, but the if the facts >alleged in the case to which TCM refers are as claimed, they seem to have >a fairly good case under the law as it stands. And there's a lot more >than skimpy outfits at issue, including a refusal to hire men for what are >allegedly food service jobs (gender may only be a determination of >employment if it is a bona fide occupational qualfiication, e.g. policing >the showers in the gym; gender is not a BFOQ for food service jobs.) It is not the business of any regulatory agency to _second-guess_ why I want my girls at my Hooters to wear skimpy outfits. In fact, there is no real doubt why the girls are dressed as they are. (Hint: the name.) The girls can choose to work for me, or not. No slavery is involved. (Of course, I also favor legalization of indentured servitude. The military is allowed to buy X years of labor by paying for a student's education, so why not IBM? It might actually help the unemployment crisis we are now in.) In any case, I choose to focus on politico-jurisprudential issues, of what the law _should_ be, not what the current mess says is the law. As Roseanne Barr--not one of my favorites--recently so cogently observed: "Heidi Fleiss is going to prison, OJ Simpson is playing golf in Brentwood...we're living in Dante's Inferno." --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: Transitive trust and MLM
by E. ALLEN SMITH 17 Dec '03

17 Dec '03

From: IN%"eli+(a)GS160.SP.CS.CMU.EDU" 13-MAY-1996 19:59:41.90 >EALLENSMITH(a)ocelot.Rutgers.EDU writes: >> The different paths going through those different signatures will be >>correlated/non-independent, yes.... but that isn't the problem unless you're >>considering multiple paths (in a more complicated version). >To determine key validity, you do have to consider all paths. If a >single trusted path to the bad key exists, the attacker wins. Hmm.... a useful distinction in this is between multiple paths with no common elements except the beginning and end and ones with common elements. The sections of the ones with common elements that have no common elements can probably be treated as a subset of the larger path - a virtual link, if you will - with its values (trustworthiness et al) determined by the paths contained within it. >> IIRC, there have been some sociological studies showing that _everyone_ >>is linked through 6 or so people. >Milgram's "small world" experiments used a much looser sort of "link" >than we want here. It would be certainly interesting to know how >large a difference this makes. Milgram? Thanks, I'll check for that name. >It's true that you don't need to talk to everybody. The problem is >that I might want to talk to people whom I don't know personally, but >know by reputation, or by function ("DEA Rat Hotline" -- well, maybe >not). I'm not disputing that... just that you don't need to be able to go through the web to reach everyone who's got a key. Admittedly, the subsection of people who have keys are more likely (through being more technologically sophisticated et al, on average) to be useful to contact than those who don't. -Allen

1 0