December 2003 - cypherpunks-legacy

Re: FOR WHOM THE BELL TOLLS
by Duncan Frissell 17 Dec '03

17 Dec '03

At 10:41 PM 6/4/96 -0700, Bruce Baugh wrote: >I think there's a non-trivial chance that this list could be shut down and >anyone who's made interested sounds in the idea brought in to assist the >police in their inquiries. Yeah and they busted Jack London for publishing "The Assassination Bureau, Ltd". (http://www.amazon.com/exec/obidos/ISBN=0140186778/1663-9102790-622063) Advocating the general practice of killing one's opponents is as legal as church on a Sunday. The War College (or is it the NDU these days) does it all the time. DCF

1 0

Re: How can you protect a remailer's keys?
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Lance Cottrell writes: > At 11:55 PM 6/1/96, Bill Stewart wrote: > >Encryption is critical for protecting against traffic analysis, > >but it's tough to protect a remailer's keys. Unlike regular email, > >where you can type the key in as you read it, remailers need to > >run automatically once you set them up. Some of the choices are: > >- leave it around in plaintext with only Unix file protections > >- type it in to a long-running remailer process > >- SSL-based remailers, where the web server handles crypto on > > a per-machine basis instead of per-remailer > >- use unauthenticated Diffie-Hellman > >- off-line or off-site remailer such as a POP3 winsock remailer > >- human intervention on every message > > > >Anybody have any other approaches? These are mostly weak, > >annoying, or both. > > The best solution I could come up with (and was willing to write and use) > is to specify the passphrase on the command line argument to the compiler This is little better than leaving it around in a plaintext file, a pass or two with gdb on your binary and I have your private key. The "difficult, expensive, and pain in the ass code to write" solution that I favor is to use secure multiparty computation to create the remailer. It does not exist on a single host, but is rather the sum of a collection of hosts running on widely seperated machines. It has the same type of drawback as a per-execution password entered into a long-lived process (anyone with root access to the host can yank it out of memory with little difficulty,) but this is spread out across a larger collection of hosts, making the task of actually getting the complete password somewhat difficult. Getting a subset of the individual host passwords does not provide any partial information about the collective password (similar to secret sharing.) The other drawback is that certain operations can be very slow, you end up emulating a circuit with a _very_ slow clock (8-10 Hz. Not MHz, not KHz, but 8-10 ticks/second); as compensation you get a word-size that if effectively infinite. I have to continue work on a subset of these methods for a secure digital poker/card-playing system over the next couple of months and if I have some spare time I might see just how difficult creating a toolkit for building such virtual circuits really is... OTOH, a secure PCMCIA or smart-card will probably end up being a better practical solution. jim

2 1

Re: USA on Feds Cyberteam
by Deranged Mutant 17 Dec '03

17 Dec '03

On 5 Jun 96 at 13:18, John Young wrote: > USA Today, June 5, 1996, p. 1. [..] > To see adjoining UT article (9 kb), > > "Post-Cold War hysteria or a national threat?" > > http://pwp.usa.pipeline.com/~jya/hysteria.txt There's so many fnords my eyes hurt to read it. --- No-frills sig. Befriend my mail filter by sending a message with the subject "send help" Key-ID: 5D3F2E99 1996/04/22 wlkngowl(a)unix.asb.com (root@magneto) AB1F4831 1993/05/10 Deranged Mutant <wlkngowl(a)unix.asb.com> Send a message with the subject "send pgp-key" for a copy of my key.

1 0

Re: Markoff in NYT on NTT/RSA chip
by rodger＠interramp.com 17 Dec '03

17 Dec '03

>David Lesher writes: > > > So Motorboatarola puts chips in the domestic MTSO's. > > For the international ones, they leave the chips out. > and Russ Nelson responded: >Crypto hooks, or more properly, crypto pads. Lends new meaning to the >term "one time pads". > For what it's worth, Motorola can do neither. US companies can't produce anything prohibited for export unless its in the US, for the US market. And "crypto with a hole," or hooks for crypto generally, can't be exported, either, unless for 40-bit stuff only. Thus, Microsoft's proposals to produce "crypto with a hole" depend on "holes" tailored to the requirements of specific countries. Will Rodger Washington Bureau Chief Interactive Week

1 0

FTC_spy
by jya＠pipeline.com 17 Dec '03

17 Dec '03

6-5-96. WaPo and NYP: "Curbs on Cyberspace Ads Proposed." (WaPo) Should spam be jammed and cookies be crumbled on the Internet? Technologies with these gustatory short-hand names are at the heart of industry, consumer and government debate over privacy in cyberspace. The Federal Trade Commission brought together major Internet players for a two-day workshop examining the handling of personal consumer information on the Internet, including the practice of using "cookies." "Privacy is somewhat of a snake ... but a snake can be an opportunity," said Peter Harter, public policy counsel for Netscape. "Voluntary Rules Are Proposed For the Privacy of Internet Users." (NYP) But the proposal, made at a Federal Trade Commission hearing on personal privacy in the information age, drew fire from civil liberties groups and others concerned over privacy issues. They argued that self-policing by the industry would not restrain on-line abuses that they said already range from surreptitious monitoring of activities on the Internet to the illegal sale of personal credit histories over the Internet. FTC_pry

1 0

Micropayments: myth?
by szabo＠netcom.com 17 Dec '03

17 Dec '03

Some electronic commerce projects promise dramatically lower transaction costs, so that we can achieve "micropayments", "microintermediation", and so forth. Is this achievable? Consider a feature fairly independent of the particular payment system: the statement of charges. Here lies a tradeoff here between completeness and complexity. On the one hand, merely summarizing charges creates the opportunity for salami frauds, allowing widely distributed false or exaggerated microcharges to go undetected. Furthermore, parties reading only the summaries get no feedback by which they can adjust their behavior to minimize costs. On the other hand, a statement too complex to be easily read also allows fraud, error, and inefficient usage to go unrecognized, because one or both parties cannot understand the rationale for the charges in relation to the presumed agreement on terms of service and payment. There seems to lie here a fundamental cognitive bottleneck, creating a limit to the granularity of billable transaction size whether electronic or physical. One proposed solution to this has been "intelligent agents". But since these agents are programmed remotely, not by the consumer, it is difficult for the consumer to determine whether the agent is acting the consumers' best interests, or in the best interests of the counterparty -- perhaps, necessarily, at least as difficult as reading the corresponding full statement of charges. By sleight of hand we may have merely transformed the language of the transaction as it needs to be understood by the party, without reducing the complexity to be understood. Furthermore, the user interface to enable consumers to simply express their sophisticated preferences to an agent is lacking, and may represent another fundamental cognitive bottleneck. Telephone companies have found billing to be a major bottleneck. By some estimates, up to 50% of the costs of a long distance call are for billing, and this is on the order of a $100 billion per year market worldwide. Internet providers have been moving to a flat fee in order to minimize these costs, even though this creates the incentive for network resource overusage. A micropayments system assumes a solution to the billing problem. If somebody could actually solve the this problem, rather than merely claiming to have solved it via some mysterious means ("intelligent agents", et. al.), the savings would be enormous even in existing businesses such as long distance and Internet service -- never mind all the new opportunities made possible by micropayments. Nick Szabo szabo(a)netcom.com http://www.best.com/~szabo/

14 23

National Bank Brings Internet CyberCash To Canada 06/05/96
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

>Date: Wed, 5 Jun 1996 17:18:39 -0400 >From: reagle(a)rpcp.mit.edu (Joseph M. Reagle Jr.) >To: reagle(a)rpcp.mit.edu >Subject: National Bank Brings Internet CyberCash To Canada 06/05/96 > > > >MONTREAL, QUEBEC, CANADA, 1996 JUN 5 (NB) -- The National Bank of >Canada, one of Canada's smaller chartered banks, has signed an >agreement with CyberCash Inc. (NASDAQ:CYCH) to bring the Reston, >Virginia-based company's Internet payment service to Canada. > >CyberCash touts its payment service -- also called CyberCash -- as a >secure method of making payments over the Internet using a credit >card. > >To use the system, a consumer first downloads software called the >CyberCash wallet from CyberCash's site on the World Wide Web >(http://www.cybercash.com ) or from a participating merchant's >site, said Melissa Walia, a spokeswoman for CyberCash. The free >software, installed on the user's PC, allows the customer to make >purchases via the Internet and have them charged to a credit card. > >CyberCash supports major credit cards such as Visa, MasterCard, >American Express, and Discover, company officials said. Walia told >Newsbytes that Canadians who wish to use the service will not have >to be customers of the National Bank. The bank will work with >participating Canadian merchants to provide the CyberCash service. > >The CyberCash Cash Register is the merchant piece of the >CyberCash system. It works on a merchant's server and receives >information necessary to process a credit card transaction. The >system is designed to work with an existing financial institution >infrastructure, officials said. > >CyberCash said it is committed to supporting the Secure Electronic >Transaction (SET) standard for Internet credit-card transactions, >announced recently by Visa and MasterCard. The company claimed it >plans to be one of the first SET-compliant Internet payment services >available. > >Neither Walia nor Bridget Limoges, a spokeswoman for the National >Bank, would say how many Canadian merchants have signed up to >use CyberCash at this point. However, Limoges told Newsbytes that >interest in the technology has been strong. > >The CyberCash credit-card payment service, launched in the United >States in April, 1995, is expected to be available to Canadians >this summer, Limoges said. CyberCash also said it is working on >electronic check and coin services, expected to be released in >the second half of this year. > >(Grant Buckler/19960605/Press Contact: Melissa Walia, Niehaus >Ryan Group for CyberCash, tel 415-615-7911, fax 415-615-7901, >Internet e-mail melissa(a)nrgpr.com; Bridget Limoges, National Bank >of Canada, 514-394-6494; Public Contact: CyberCash, Internet >e-mail info(a)cybercash.com) > > > _______________________ Regards, Real generosity toward the future lies in giving all to the present. - Albert Camus Joseph Reagle http://farnsworth.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: whitehouse web incident, viva la web revolution
by Perry E. Metzger 17 Dec '03

17 Dec '03

hallam(a)Etna.ai.mit.edu writes: > As you know very well it's Dr. My apologies. From now on I will refer to you solely as Dr. Phill Hallam-Baker, PhD. > and as you also know, signing a futures, options or any other type > of contract is an open ended risk. One doesn't "sign a futures" contract. The risk is also not always open ended by any means. If I purchase 50 unleaded gasoline contracts, my risk is strictly limited -- I cannot lose more than the value of the gasoline, and that would only be if it became totally worthless (an unlikely event). If I sell an uncovered contract, things are different, of course. With options, if I buy puts or calls, again, my risk is totally limited -- I cannot lose more than the cost of the contracts. > That is how the person purchasing the contract has the theoretcial > possibility of unlimited reward. Er, no. You have potentially unlimited reward in ANY purchase, and limited risk. If I buy a box of cornflakes and next week cornflakes suddenly become worth $1,000,000 a box, well, I've experienced reward, but my risk was at most the cost of the cornflakes. > >Of course they know. There just isn't anything that can be done. There > >is no proof. Its more or less as though one finds a man with gunpowder > >stains on his hands, and a bullet embedded in the wall of his office > >and human blood soaking the carpet. You can't prove that he killed > >anyone. You can never get a conviction. But you can know. > > Its called circumstantial evidence and it leads to a conviction provided the > name of the defendant isn't O.J. Simpson. No, it isn't. If there is no body and no one knows who you have shot, the rules of Corpus Delecti pretty much dictate that you aren't going to jail. You cannot be charged with the murder of unknown persons when there isn't even any evidence of what happened (it could very well have been someone being accidently injured while you were showing off your gun collection and they might have done just fine). You don't even have to say what happened -- you are under no obligation to testify, you know. Now, your neighbors will probably talk badly of you forever, but you won't be convicted of anything. > It would certainly be enough to arrange congressional hearings, subpoena half > the Whitehouse staff and demand every document in sight. What documents can they subpoena? All of Hillary Clintons documents are available. It is known what she traded and when. Without a witness who will say who did the bribing, or broker records showing the counterparty who was doing the bribing, nothing can be done. You seem to assume that every crime in existance can be prosecuted. They can't. Hillary Clinton can claim to be the victim of a very odd set of circumstances, which is effectively what she has done, and we have no way to put her in jail. That doesn't mean, however, that we have to believe her. > Speculating in derivatives is not something I am particularly > interested in, having seen the losses of some people in this > building who got caught in the Netscape short squeeze I'm not > particularly inclined to rush into that market. Netscape options were not available at the time that the shorts got hurt. Selling short is not a derivatives investment. You don't seem to have much of a deep knowledge of these markets -- at the very least you speak of them in a manner guaranteed to produce derision from professionals. > >Switching the tickets was the fraud. Taking bribes was also a crime. > > Perry, Perry, you are off at it again. You are making allegations you cannot > back up. You are right. The human blood might have been from the blood bank, and the bullet might have been an accident. Its fucking unlikely, though. > You have hypothesised that there were multiple tickets but have no > proof, Correct. That is why Hillary Clinton and Bill Clinton aren't in jail. However, court proof and proof good enough for me aren't the same thing. > All you can point to > is that a person with a net worth of several million They had a considerably smaller net worth at the time. Most of the Clinton's net worth appears to have come from dirty political dealings over the years -- things like the Cattle Futures bribe laundry, Rose Law Firm overbillings or dealings with the Arkansas state government, etc. Not a shred of it can be proven in court, of course. > made a tidy profit speculating in cattle futures with the aid of > some astute financial advice. No one out there that I know of who does this for a living has ever seen anyone make that much money in short term speculation that way. George Soros, Paul Jones and all the rest would be envious of the performance she had in the markets. I don't know anyone who can articulate a theory of why the trades were made when they were that comes from "astute thinking". They are seemingly random. Thats probably because they WERE random. > If you are to make such serious allegations against anyone you should be > prepared to back them up with something more than heresay and name > calling. As I've said, the evidence is compelling. It just isn't proof. Its just like the bullet, the blood, and the powder burns on your hands. No body and no missing person means no jail, but it doesn't mean that one has to go about thinking what one is looking at is perfectly innocent. > Just because it might have been possible to conceal a bribe does not > mean that you have evidence that a bribe was given. If this was Richard Nixon no one would be questioning what the money was. I see no other explanation for what the money would have been. The fact that her supposed advisor on these trades was the attorney for Arkansas's most important company, Tyson Chicken, is a bit on the suggestive side. Again, it is not proof, but proof isn't needed. > It is not unusual for lawyers to dabble in speculation. It is also > not unusual for clever lawyers to have friends who can give good > advice. If you can find anyone on earth who can give that good a bunch of advice, please let me know. Several hedge fund managers I work with would probably pay me for their name. I don't know anyone who has EVER performed that well in the markets. Its nearly impossible. > Consider that anyone on cypherpunks might have made a tidy profit by > realising that certain network ventures were likely to realize > substantial profits for those dealing in the market. It dosen't take > a genius to look at the rise Sun's stock price Could you have made 100 to one on that in a couple of months, though? Sure, its easy to make 20% or 30% on your money a year. Its hard, but many people do it. Making 10,000% in a few weeks is impossible. > Oh come off it Perry, the Washington media do not need proof or even > evidence to have a feeding fest. They did for a while, but when it became obvious that the evidence was not going to lead to the court room, it ended. Besides, most of the media in Washington are registered Democrats. 89% of the Washington press corps voted for Clinton from what I've read. Your attitude seems to be "you can't prove anything so you must assume that they are innocent." My attitude is "I can't prove anything so they can't go to jail, but that doesn't mean I have to believe that they are innocent -- in fact, I'm an idiot if I believe that." > I think that given Perry's ad-hominem attacks and the fact that this > has nothing to do with cryptography that its about time someone sent > Perry a Perry-gram. Cypherpunks no longer is a cryptography mailing list. Its a sewer. Perry

1 0

Re: Markoff in NYT on NTT/RSA chip
by jim bell 17 Dec '03

17 Dec '03

At 09:33 PM 6/5/96 -0000, nelson(a)crynwr.com wrote: >David Lesher writes: > > > So Motorboatarola puts chips in the domestic MTSO's. > > For the international ones, they leave the chips out. > >Crypto hooks, or more properly, crypto pads. This raises a question: If you provide a place for a crypto chip but don't install it, shouldn't you be able to export it? But the software analogy, crypto hooks, the government is trying to restrict them. This is why I think the latter interpretation is flawed: Historically, the mere fact that a system can interface to another one that can do crypto can't be used to restrict it. Jim Bell jimbell(a)pacifier.com

1 0

Re: whitehouse web incident, viva la web revolution
by Perry E. Metzger 17 Dec '03

17 Dec '03

hallam(a)Etna.ai.mit.edu writes: > Well why don't you do that and come back with the results eh? You have to > actually _talk_ to them for the knowledge to transfer Perry y' know. I know the results. 99% of them laughed about the whole thing for weeks. The poster caricature of Hillary Clinton with a crystal ball and a thought ballon filled with cattle that I saw on one floor was particularly amusing. The thing was a universal joke. I never heard anyone who would be nicer than to say the whole thing was extremely suspicious. > You still don't understand, the $1000 is not the stake, it is merely > the deposit. The stake is Hillary's entire net worth, that is what > she is betting with. Gee, Mr. Hallam-Baker, it seems your ignorance about what she was trading (I believe you thought it was "options" before) also extends to an ignorance about how the futures markets work or how securities accounts work. > Rubbish, thats only 25 contracts sold without a loss. Depending on > the market one usually takes a profit when selling a contract. Making that kind of return in day trades in the cattle markets? You out of your ever living mind? Its not like there was even any basis for her trades that she could articulate. Thats because the trades were made without any basis, in matched pairs. (By the way, learn what a contract is. A contract is not the same as a trade. You are sounding thoroughly ridiculous.) > These are not "one in a million trades" Perry, they are the sort of > trade that one would expect to make in an underwritting capacity for > a commodity market. You ARE out of your ever living mind. The average individual account holder at Refco "blows out" (that is, loses their entire stake) within six months of opening their account. Refco is one of the more reputable places to trade futures. You are simply an ignoramous, talking totally outside your league. Have you ever so much as bought a futures contract or an options contract? Have you even ever opened a securities account? > >I will state this for the record: Having examined the evidence, I > >would say that even a non-expert who was reasonably informed about how > >the futures markets work would have no choice but to conclude that > >Hillary Clinton's trading pattern was impossible without some sort of > >fraud being committed. > > So you think that the Republican's in Washington haven't figured out > what Perry Metzger has? Of course they know. There just isn't anything that can be done. There is no proof. Its more or less as though one finds a man with gunpowder stains on his hands, and a bullet embedded in the wall of his office and human blood soaking the carpet. You can't prove that he killed anyone. You can never get a conviction. But you can know. Well, it was announced, and the media discussed it, and Hillary gave her teary eyed press conference cynically wearing a matronly outfit, and she gave her usual raft of "I cannot recalls" and "I don't remembers" and given no additional evidence, the whole thing ended. > Perry, its the crux of your case, you are claiming that Hilary > committed fraud but you do not know whether the responsibility for > covering the trades is on the broker or on the client. The fraud was in the ticket switching, so it makes no difference that the margin requirements were not made. The other crime was, of course, bribery. However, without records or information, there is no way to prove any of it. The mere fact that all the records from the brokerage were mysteriously destroyed should make you wonder. > You are mouthing off that Hillary was illegally trading without > putting up margin when you don't know whether or not that is a > crime. Switching the tickets was the fraud. Taking bribes was also a crime. I have no concern as to whether the margin requirements issue was criminal -- it was probably only a civil violation. In any case it makes no difference -- there is more than enough crime here to go around. Perry

1 0