December 2003 - cypherpunks-legacy

Re: "address verification databases"? (was: Netscape download...)
by Duncan Frissell 17 Dec '03

17 Dec '03

At 12:47 AM 7/18/96 -0700, Jeff Weinstein wrote: > Our database was obtained from American Business Information. >They make those CDROMs with 11 million business names and addresses, >and other such products. There is a link to their web page from our >US download page. > Our verification software does not check that the person whose name >is entered in the form lives at the address entered in the form. >We do verify some parts of the information entered. Things like >is the state code one of the 50 states, does the zip code match >the state, etc. (NOTE - these may not be the exact checks implemented >currently. I have not examined the code myself, but these are the >types of checks being done.) I got my copy after entering my accomodation address in New York City so the address part of the control mechanism is not a problem. DCF

1 0

(fwd) Re: US versions of Netscape now available---NOT
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Sternlight writes: : >>Yes. We've had a few thousand people download it. Unfortunately, we : >>only have one machine serving downloads right now, and it tends to melt : >>down a couple times a day. : > : >I've tried four times, and each time has timed out. (That is, I've filled : >out the Web form four times and tried n times each iteration...at least I : >get to experiment with variations on my name and address each time :-}) : > : >I guess I'll have to connect to the Italian and/or Swedish sites again. Has : >the software arrived there yet? : : Very droll. I had no trouble downloading it first try. Perhaps you should : switch to Netcom. :-) : Tim you may use this as entry data: Whatever YaKnow cybernut(a)nutcom.com 10401 Wilshire Blvd, Suite 805 Los Angeles, CA 90024-4628 (310) 475-3799 Your friend.

3 2

Mail-order Ph.D.'s
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've received an obnoxious e-mail signed by *Dr.* David Sternlight. :-) David, did you buy your sheepskin in a pizzeria? How much did you pay? --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

3 3

Re: Cypherpunks and Toad.com copyrights ..
by Mike McNally 17 Dec '03

17 Dec '03

Damien Lucifer wrote: > > I'd like to put the words > > Cypherpunks(a)toad.com > > On a tee-shirt. Why? Is there not enough noise on the list already? Why not advertise the "Squish the Tentacle" game while you're at it? ______c_____________________________________________________________________ Mike M Nally * Tiv^H^H^H IBM * Austin TX * For the time being, m5(a)tivoli.com * m101(a)io.com * <URL:http://www.io.com/~m101> * three heads and eight arms.

1 0

Systemics Announces First Internet Trading System
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Thu, 18 Jul 1996 12:48:03 +0200 From: Ian Grigg <iang(a)systemics.com> To: rah(a)shipwright.com Subject: Systemics Announces First Internet Trading System Systemics Announces First Internet Trading System 17 July 1996. Copyright (c) 1996 Systemics Ltd. 1996 could well be the year that marks the start of the Internet Financial System. Consider these developments: * Intense competition between rival payment systems has erupted as the large payment institutions have woken up - the new territory is on the Internet. * Earlier this year The Spring Street Brewery surprised Wall Street by conducting its own IPO - by the simple expedient of using the Web as a communication medium. After several weeks of hectic phone answering, CEO Andrew D. Klein realised he was in the wrong business and announced plans to start a new industry: Internet investment banking. * Across the pond in that other giant of international finance, the paperless trading system Crest starts up this week at the London Stock Exchange, signalling massive job losses. The exchange's troubles began late last year when exchange-member ShareLink was discovered delivering trading information on the Internet. The exchange severed ShareLink's "feed". Claim led to counter-claim, with litigation close behind, in a slanging match that ruptured images of the calm, polite English way of trading. Before saner heads could move in to force closed-doors negotiations, the palace revolution was underway. Suing one of ourselves? It's just not cricket. And now, Systemics Ltd has added in the last remaining ingredient, the Internet Stock Exchange. After a year of hectic, but secret, development by a small team of cyberventurers, the Exchange went live in June with Systemics own debt. A cohort of private investors were placed with Systemics bonds, which now trade on a nightly basis. Trades have been mostly small and experimental, as the investors, all computer professionals, get to grips with the new-found power of instant access to the 'market'. The Genesis of a new Financial System Ian Grigg, co-founder of the team, concentrates on the business aspects during the daytime, and in his spare time, helps with coding the market. "It seemed like a simple thing back then, take the basics of digital cash, add in securities, and build a market to trade the securities for cash." In the summer of last year, co-founder Gary Howland was working on digital cash protocols for DigiCash. Meanwhile the Internet was exploding into the public eye, as conventional media started to realise the potential of the new medium. Howland conducted long email discussions with his future co-founder. "There was this awesome potential energy, just sitting around in the digital cash concept waiting for chance to go kinetic." Grigg was attending lectures on Finance as part of an MBA from London Business School. "In the day time, I was learning the basics of what a bond was, and at night we would have these unlimited discussions on where the net was heading. With each lecture, each discussion, the feeling was getting stronger - we had the tools in front of us. We could build an Internet Financial System." The Systemics team aren't the only ones to have seen the potential. Bob Hettinga, a prolific net writer, had described the basic concepts as much as a year before. Grigg thinks that it took the combination of diverse skill sets and motives for ideas to turn into reality. "We're continually surprised that nobody else saw it and jumped in. But if you analyse the work that went in to the software and the building of knowledge in the core disciplines, it really is a major project that is too risky for any conventional company. I would guess it can only be done by a small, tightly focused team with key individuals. Or, by one of those great, wide ranging alliances that bring in diverse stake holders." The Internet Financial System will consist of Issuers, Payment Systems, Markets and Investors, just like in the physical world. An Issuer runs a special service suite on the Internet to manage the financial instruments. Those instruments are placed by the Issuer with a private group of Investors. Then, when the Exchange accepts the issue and runs a Market in that instrument, Investors can trade the instruments using Systemics Trader, a specialised browser. Instruments are bought and sold for digital cash, provided by an Internet Payment System. The Systemics team are proud of what they have achieved. Grigg explains: "The small investor gets direct access to the markets. Settlement is immediate - when the trade is done, the money or instruments are waiting for collection. And with the security of modern forms of cryptography, there's a lot of peace of mind. This Exchange carries no risk, which results in a cost to the Investor that is so small that it creates a new segment." Internet Trading Takes Off In the first instance, it was necessary to prove the system under real trading conditions. Systemics issued its own debt as one year zero coupon bonds with a face value of USD 10. Each of the investors was given a tranche at an issue price of $9, allowing investors to earn a dollar for every nine dollars invested over the full year. To manage the portfolio of cash and bonds, each investor downloaded Systemics Trader. On the 25th of June, the first live market was opened by the Exchange for the first investor trades. "Since then, we have gradually settled into a routine. The market opens at 1915 GMT, for a six hour trading session. This time slot seemed to give the best access for our investors, who are located in diverse time slots and daily patterns." Trades are not frequent as people who have never traded before get to grips with the concept. "Our investors are all long term associates who understand the future of the Internet. They were keen to invest in what we think is the most advanced project on the Internet today. For all that, trading got off to a slow start as investors proved initially timid at risking their own cash and bonds." However, within a week, the backers are showing all the signs of an aggressive investor community. "If they're not happy, they don't trade." Demands for additional instruments caught Systemics by surprise, as investors pointed out that without a comparison between instruments, there is no decision on value. "It's obvious in hindsight, there's a limit to what people can do in a one-bond exchange." The challenge now is to decide on alternative instruments. Secure Payments are based on Cryptography At another level, the Exchange is just a complicated shop on the Internet. It buys and sells financial instruments for cash, and relies on a secure value transfer system to make the trade. "When we laid down the strategic components a year ago, there was no sure availability of any payment system, let alone one up to the rigors of finance. So we had to do our own," said Howland. In a forthcoming paper, he describes a design for a digital payments mechanism built upon the cryptographic key format in Phil Zimmermann's Pretty Good Privacy, the Internet standard for email encryption and digital signatures. "PGP is the only system that is widely available and provides good security. The challenge was to turn it from a message passing system into a value passing system." The Systemics payment system works on the notion of a value-containing box that is controlled by a PGP key. A server holds the public key, anyone who has the private key can control the box. A box can be used as an account, allowing the conventional management schemes of accountancy to be used. In this case, the server ascribes value to the box, and the users write instructions to transfer value from one box to another. Or, it can be used as a coin, allowing cash emulation. In this case, users transmit secret keys, and coins are cashed in by issuing instructions to transfer the value in a received coin to a box account. Howland states that this design allows for immediate settlement in both financial instruments and cash, a critical issue in financial markets. Also, the use of PGP keys makes independant verification of the protocols a relatively low cost task by leveraging off of the enourmous amount of trust placed in PGP. Systemics believes in open cryptography. "We intend to publish all our protocols with example software, and our goal is to publish a complete and working payment system. Cryptography and digital payment mechanisms are socially beneficial and should be widely disseminated." Systemics have already published their Cryptix library, providing strong cryptographic solutions for Java and Perl developers. The Investor Takes Control Systemics Trader, the specialised trading browser, is written in Java. "As far as we know, this is the first serious application written in Java outside Sun itself," commented Mike Wynn, author of Systemics Trader. Working as an HTML browser, Systemics Trader can pass through firewalls set up to allow WWW browsing. This has doubled the potential user base; about half of Systemics' investors work on secure systems. Systemics Trader manages a portfolio of financial instruments and cash using a 'box' as a digital account. 'Limit' and 'Market' orders can be submitted, tracked and cancelled. The 'board' for market instruments can be monitored on an investor-demand basis, so as to present the latest prices to the investor. A secure registered mail protocol is used to ensure messages containing value get delivered from the Exchange to the investor. Given the vagueries of the Internet, Systemics Trader has to sign for each payment that is sent to it before the payment is considered to be delivered. Then, both parties to the trade know that the deal is done. Future versions will manipulate both digital cash and digital accounts, as well as multiple currencies. Real-time feeds are also a possibility. For now, however, Systemics is concentrating on building in the basic features and reliability that risking an individual's money will demand. Wynn's plans are oriented towards the developing a trading library that can be used as the basis for a whole class of browsers. "In the short term, our investors and testers are still proving the system for us. In coming weeks, we intend to release a new version of Systemics Trader for widespread demonstration purposes on our test markets." An Internet Team Systemics Ltd, an Irish company, holds the brand and fronts for the team in any formal discussions. But the real capital is in the heads of the many individuals who have contributed. Outside the tiny core is a small group of "insiders" who contribute ideas, software development and testing. And outside this group is the Internet software community. Enourmous amounts of freely available software have gone into the system, making the efforts of the group just the tip of the iceberg, and the core team just the bunch of penguins sitting on the tip. "We are an Internet team, not a company in some office. What some are calling the virtual company is really a series of concentric circles flowing out over the Internet. The pebble dropped in the centre of the well is the idea, the development waves move out and reflect back in to form the product. Think about Internet development as that big node where all the waves rush in to one point." Acknowledgements This information release from Systemics Ltd. Copyright 1996 Systemics Ltd. Free and widespread distribution is permitted, as long as attribution is maintained. Please point your readers at our home page: http://www.systemics.com/. This release will be located in docs/releases/1996-07-17.html Systemics, Systemics Trader and Cryptix are trade marks of Systemics, Ltd. The Spring Street Brewery can be found at http://plaza.interport.net/witbeer/ and Wit Capital at http://www.witcap.com/ ShareLink is at http://www.esi.co.uk/sharelink/. Also see InfoTrade http://www.infotrade.co.uk/. Bob Hettinga, prolific net poster, is at http://www.vmeng.com/rah/ or rather, his e$ homepage is. Subscribe to the e$ mailing lists for the latest digital cash gossip. Pretty Good Privacy and PGP are trademarks of PGP, Inc. Phil Zimmermann and PGP are thse days better found at their new corporate home: http://www.pgp.com/ Java is a trademark of JavaSoft, found at http://www.javasoft.com/ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Cybank breaks new ground; rejects public-key encryption
by Seth I. Rich 17 Dec '03

17 Dec '03

C Matthew Curtin (cmcurtin(a)megasoft.com) wrote: >People need to learn that the sort of snake oil that is being sold as >"secure" just won't cut it. Your concern for the customers of Cybank >is valid, however, so I propose something along these lines: > >Announce, very publicly, such that every Cybanlk customer would hear >about it in time, that you have cracked their hokey little non-crypto >scheme, and that you intend to publish your work in a full-disclosure >paper to be published on Month Day, Year. [...] I chuckled when this whole Cybank thing started. Only a month or so ago, they had some funky bug in their mail system such that all their internal email was being cc'd to the First Virtual users' mailing list (and also to one poor individual). They were helpless and completely unable to figure it out, as we watched their (not very happy) internal messages float unrequested into our mailboxes. Seth --------------------------------------------------------------------------- Seth I. Rich - seth(a)hygnet.com "Info-Puritan elitist crapola!!" Systems Administrator / Webmaster, HYGNet (pbeilard(a)direct.ca) Rabbits on walls, no problem.

7 6

Re: Symantec's Your Eyes Only
by Clay Olbon II 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> wrote: >At 11:57 AM 7/16/96 -0400, Clay Olbon II wrote: > >>Now my $.02. I am concerned about the lack of a distinction between >>transient communications and stored data. This is apparent in the GAK >>proposals, but is also increasingly apparent in mainstream corporate >>products such as this one and ViaCrypt BE. It is apparent (to me anyway) >>that corporate access to stored data (data owned by the company, on >>machines owned by the company) is probably necessary. I do not see this >>same need for access to transient communications. Am I way off base on >>this one? > > >This has been mentioned a number of times by various people. It should be >obvious that it is pointless to escrow the key of a data stream that you are >not recording, such as a telephone conversation. Also, if you have no >permanent need for that data (also, the telephone conversation) it is >unnecessary. As might be expected, however, the proponents of GAK don't >distinguish between keys for storage and keys for communication. > >Such an oversight is predictable. It's likely that governments will be >more >interested in keys for communication, because the data is far more easily >(and secretly) accessible. Were they to admit that nobody has a need for >his own communication data key, they'd lose a substantial fraction of their >target data. > My point was not that govts want to escrow communication keys, it was that this is appearing more and more in commercial products marketed to businesses. I run the computer system for a small office and I would rather not see employee email - maybe I am just naive. However, there obviously is a demand for this type of product. It must come from either a lack of understanding of crypto, or a freeh-style authoritarianism on the part of corporate executives. I wouldn't rule either one out. If it is the latter, I'm not sure there is anything we can do. Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

1 0

ABC News on internet telephony
by Clay Olbon II 17 Dec '03

17 Dec '03

There was a pretty long piece on the evening news on using the internet for long distance and how much money can be saved. Even had several demos of intercontinental phone calls. The disappointing aspect was they didn't mention PGPfone (although if they had, I'm sure child pornographers and terrorists would have been mentioned as well :-) Clay *************************************************************************** Clay Olbon II * Clay.Olbon(a)dynetics.com Systems Engineer * PGP262 public key on web page Dynetics, Inc. * http://www.msen.com/~olbon/olbon.html ***************************************************************** TANSTAAFL

3 2

Re:Seek And Destroy
by rednax 17 Dec '03

17 Dec '03

Hmm, this page however, does something if you are using netscape www.angelfire.com/pages0/cbp3/index.html -- r 3 |) |\| @ >< rednax(a)asiapac.net "violent! you mean it's alive??"

1 0

Re: SecureDrive(IDEA), Realdeal and plaintext attack
by Jean-Francois Avon 17 Dec '03

17 Dec '03

Cc: cypherpunks(a)toad.com galactus(a)stack.urc.tue.nl Iolo Davidson<iolo(a)mist.demon.co.uk> On 18 Jul 96 at 4:19, Edgar Swank wrote: > JFA wrote: > > Question: > > > > Since realdeal overwrite everything with 0s, and that theses > > zeroed sectors are encrypted later with IDEA, will that give an > > attacker an edge? The attacker will likely know that there are > > large disk areas that contains 0s. > > > > Any comments? > Yes. Each sector encrypted by SecureDrive also incorporates a "salt" > value derived from the sector address and (usually random) volume > serial. So encrypted zeroed sectors will be different from each other > and (without the IDEA key) cannot be distinguished from sectors > containing data. IDEA is reputed to be resistant against known plaintext attacks. But I did not read about wether or not it is resistant to several-plaintexts (?choosen plaintext) attack. If the sectors were not salted, each zeroed sectors would translate in an identical way on the encrypted disk. So, there would be only one cyphertext-plaintext pair repeated over many empty sectors. If you salt the encryptor, there are many different cyphertexts corresponding to one single plaintext. Can the salt be figured out by an attacker? If yes, would the many-cyphertext to single-ultimate-plaintext could give an edge to an attacker? In that case, it would be effectively better to not wipe a drive with zeroes. The problem is, realdeal cannot be turned selectively for only one drive while not wiping the other one. Thanks for your reply. JFA DePompadour, Societe d'Importation Ltee; Limoges porcelain, silverware and crystal JFA Technologies, R&D consultants: physicists, technologists and engineers. PGP keys at: http://w3.citenet.net/users/jf_avon ID# C58ADD0D : 529645E8205A8A5E F87CC86FAEFEF891

2 1