December 2003 - cypherpunks-legacy

Telecoms Bill
by Mark Grant, M.A. (Oxon) 17 Dec '03

17 Dec '03

Well, if "cypherpunks write code", is there any code we should be writing in response to this? Mark

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

<<"In other words it was stvation/devastation city">> It was lot worse than that on the Japanese-imperialits occupied islands of the Pacific when the Nisei troops choosenot to surrender and instead, mad last-ditch charges against AMerican lines - which killed not a small number of Americans. And of course, there were the suicide bombers. Submarine operations don't cost zero lives, either. In fact, just plain old regular military logistics - keeping the boys mobilized and in place ina theatre of operations - don't cost zero lives, even if there are _no_ hostilities. And while all the starvation and devastation was going on in Japanese cities, the Japanese troops were torturing and murdering Allied POWs, and Asian civilains in all the Japanese-occupied teritories. Those people deserved liberation, too. I think you give your game away when you complain about how we were being unfair to Comrade Stalin. As far as Pax Americana goes, the Japanese just _volunteered_ to_increase_ the payments they make to support the American garrison in Japan. The non-Okinawans want us in their country. I guess they know that the alternative is a Red Chinese garrison. And lots of other Asians are afraid of the same alternative - or of Japanese garrisons in their homeland. THey've "been there, done that". Alan Horowitz alanh(a)norfolk.infi.net

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

On Sun, 4 Feb 1996 Pot(a)networking.stanford.edu wrote: > This is not FLAMEpunks. > WHAT??? --and miss all the fun? __________________________________________________________________________ go not unto usenet for advice, for the inhabitants thereof will say: yes, and no, and maybe, and I don't know, and fuck-off. _________________________________________________________________ attila__ To be a ruler of men, you need at least 12 inches.... There is no safety this side of the grave. Never was; never will be.

1 0

fcpunx subscribe
by Wendy Fu 17 Dec '03

17 Dec '03

Wendy Fu, Network Manager St. John's University School of Law 8000 Utopia Parkway, Jamaica, NY 11439 E-Mail Address: wfu(a)sjulaw.stjohns.edu Phone: (718)990-1666

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

>> INFORMATION IS INSECURE THE MOMENT YOU TOUCH A KEY. > >> This does not mean that Internet commerce is dead. Any scheme that is >> not based on self-identifying one-way financial instruments such as >> credit cards will be essentially unaffected by this problem. Moreover, >> even credit cards may be made safe on the Internet using one of two >> approaches: secure hardware add-ons and the First Virtual approach. etc. My name for this kind of software: Terminate and Stay Clueless ------------------------------------------------------------------------- Steven Weller | "The Internet, of course, is more | than just a place to find pictures | of people having sex with dogs." stevenw(a)best.com | -- Time Magazine, 3 July 1995

1 0

No Subject
by owner-cypherpunks＠toad.com 17 Dec '03

17 Dec '03

Although this particular request was sent to the cypherpunks mailing list, others continue to send requests to my mailbox. >>>>> "Wendy" == "Wendy Fu" <WFU(a)sjulaw.stjohns.edu> writes: Wendy> endWendy Fu, Network Manager Wendy> St. John's University School of Law Wendy> 8000 Utopia Parkway, Jamaica, NY 11439 Wendy> E-Mail Address: wfu(a)sjulaw.stjohns.edu Wendy> Phone: (718)990-1666 I don't know how my address got associated with this list, but please, *do not* send requests about FCPUNX to steve(a)miranova.com. Requests about how to set up Gnus scoring for performing your own filtering of the cypherpunks list are welcome. -- steve(a)miranova.com baur Unsolicited commercial e-mail will be proofread for $250/hour.

1 0

Re: Fair Credit Reporting Act and Privacy Act
by Duncan Frissell 17 Dec '03

17 Dec '03

At 08:25 AM 2/5/96 -0500, Frank Willoughby wrote: >If the Privacy Act were rewritten to be as strict as the BDSG, businesses >would have a (mandatory) legal requirement to: > >o Ensure that personal data is stored properly (by encrypting it, etc) >o Ensure that personal data is not distributed >o Ensure that databases are *not* being maintained which describe the > characteristics of individuals (buying habits, income, property > ownership, etc) wantonly propagated by marketing (direct mail, > telemarketing, etc) companies. > Unfortunately, it would also: * Require government registration of computers and databases containing information about people (whether these computers are used by business or individuals). This eases regulation of computers and future confiscation. * Reduce market efficiency by making it harder to match buyers and sellers (because neither could easily find out about he other) thus causing higher prices and poorer people. * Do nothing to protect personal information from the government which would get to collect more of it than ever in the course of enforcing data protection laws. If you don't want people to know things about you, don't tell them. DCF

2 1

IMC Resolving Email Security Complexity Workshop
by abarrett＠ee.net 17 Dec '03

17 Dec '03

Found this in the box the other day - thought it might be of interest, esp regarding secure email standards. Warmest regards, AJ <---- Begin Forwarded Message ----> Return-Path: dcrocker(a)brandenburg.com Date: Tue, 23 Jan 1996 10:20:50 -0800 To: (potential attendees) From: Dave Crocker <dcrocker(a)brandenburg.com> Subject: IMC Resolving Email Security Complexity Workshop This is a query of your interest in participating in a working meeting. As an initial activity of the newly-formed Internet Mail Consortium, we are hoping to use the coincident timing of EMail World in San Jose and the ISOC Security Conference in San Diego to call for an all-day meeting on the matter of email security. (If you aren't familiar with the IMC, please check out info(a)imc.org or <http://www.imc.org/>.) This note is intended as a pre-announcement and a solicitation for feedback concerning your interest. We'd like to get a sense of the number and range of folks who might/can/will attend. We do not yet have logistics or finances fully worked out, but the timing pressure is tight enough to warrant this letter before the official announcement. Comments about the activity and, especially, an indication of availability, willingness, and (best of all) intention to attend would be highly welcome. Please pass this note on to others who you think are (or should be) interested in email security. Specifics As its first activity, the Internet Mail Consortium proposes to organize a one-day workshop to consider the problem of multiple MIME-based security mechanisms. This is a complicated topic with a long and painful history, but the previous pain is insignificant when compared to what is emerging for vendors and, worse still, for users. Our proposal is to conduct an open meeting with attendance by principals and others involved in this area of work. We will invite the key contributors and solicit additional attendance by vendors, providers, users, and technologists who are concerned with email security. The attendance goal is to have a critical mass of those with the technical expertise and industry involvement to review and debate the requirements, capabilities, and possibilities. The work goal is to seek common ground for a common solution. While we are not overly hopeful that the end of the day will see peace and resolve among the masses, we do hope for a large amount of improved understanding and some amount of convergence. With luck, there will even be improvement in the clarity of constituency for the different technical choices -- that is, a strengthening of the political base for some of the alternatives. We would like to hold the event: Wednesday, 21 February 8:30 am - 5:30 pm (all day) (Near) EMail World event, San Jose Convention Center, CA. This is the last day of EMail World and the day before a two-day ISOC Security conference in San Diego. We propose to structure the meeting with a tight agenda, having a very focused sequence of work on the problem; this is definitely not for general education. Some amount of review is appropriate, but not much. Attendees will be expected to be knowledgeable in the basic technologies, so that only general systems design and specific algorithm choices need to be cited. To help everyone prepare, the Internet Mail Consortium will organize a set of mail-response and Web pages with references and summaries of the current technologies, and will establish a mailing list for exchanges leading up to the meeting. Proposed Agenda Morning Brief descriptions of the candidate solutions Review of the functional and technical requirements Review the extent to which each alternative satisfies the requirements Seek consensus about the requirements Afternoon Haggle about the strengths and weaknesses of the technical alternatives Explore the choices and/or negotiate a preferred solution Those who have worked on this topic in the IETF are quite tired of the whole situation, but the unfortunate reality is that the current product and user choices are quite problematic. We need to continue seeking a viable service. We expect to charge $50 per person, to cover basic costs. I should have more details about this next week. Please do let us know your comments. Thanks! d/ -------------------- Dave Crocker +1 408 246 8253 Brandenburg Consulting fax: +1 408 249 6205 675 Spruce Dr. dcrocker(a)brandenburg.com Sunnyvale, CA 94086 USA http://www.brandenburg.com <---- End Forwarded Message ----> __________________________________________________________________ Out the buffer, | PGP encrypted e-mail preferred. Through the com port, | Finger for Public Key. Over the POTS line, | Also available on a key server near you. Into the NT Box, | Up the fractional T1, | Key ID: 0X457AA6BD Onto the backbone, | Keyprint: 99 C7 17 3B 32 08 3F 17 Nothin' but 'Net. | F4 A9 42 A9 2F BC 39 B1 ------------------------------------------------------------------

1 0

attila sez
by paralax＠alpha.c2.org 17 Dec '03

17 Dec '03

On Date: Mon, 5 Feb 1996 06:49:57 +0000 (GMT) a> attila sez: a> It is not whether paralax does not know shit from beans, but that a> he proves to all that he would prefer to censor TCMay and James A. a> Donald than listen to their opinions, despite the fact he posted his a> own rather trivial and absurd point. a> political correctness and the liberal news intrepretations of "all I seek to censor no one. I prefer to confront racisim whenever and wherever I see (read) it. Mr. May embarassed himself with his denigrating application of the word "Jap" to describe the Japanese people after demonstrating a gross lack of knowledge and sensitivity about Jews. It is NOT a matter of "political correctness" unless YOU and Mr. May believe refraining from addressing an African-American as a nigger the moral equivalent of sucumbing to "politcal correctness". a> with this, I suppose I have been entered upon your "list" of a> enemies of the 'statist' nation along with TCMay and James A. Donald, All three of you would be flattering yourselves if any of you thought you made anybody's list. A. Paralax View

1 0

Re: FV's blatant double standards
by John Pettitt 17 Dec '03

17 Dec '03

At 09:26 AM 2/4/96 -0500, Simson L. Garfinkel wrote: >At 8:18 AM 1/31/96, Rishab Aiyer Ghosh wrote: >>FV demonstrated, through it's "card sharp" or whatever, that >>real-time transactions are vulnerable to sniffers on the recipient's >>own machine. Of course. We all knew that. But the mistake is to >>assume that FV isn't _equally_ vulnerable to that threat. If you >>can write a trojan that will somehow get privileged access to my >>machine, trap my keystrokes, and identify my credit card number, >>you can certainly write one that will, sitting on my machine: >> "intercept the user's electronic mail, read the confirmation >> message from First Virtual's computers, and send out a fraudulent >> reply" >>(to quote from Simson's article). Simson further quotes FV's Lee >>Stein: "A single user can be targeted, Stein said, but ''it is very >>difficult. . . . There are too many packets moving . . . to too many >>different machines.''" - which is of course equally true for real-time >>Netscape transactions. > >Oh, I think that such a program can be written. However, it would be much >harder to get right, considering all of the different ways that people read >e-mail. > > The code looks something like this: 1) hook into the winsock and look for an FV message in the web data stream, save the ID. 2) now look for an approve/deny/fraud, when you see one you know that the user uses an IP connection for mail and web. 3) Forward the ID to an anon box. 4) Look for outbound FV messages with 'fraud' or 'deny' and change to 'approve'. Clearly this will miss AOL, CI$ etc al but thats not important. The issue is not FV noticing the error, they will, it's how long it takes and how much you can steal in the interim. There is a Helen Keller quote I'm rather fond of which starts: "Security is mostly a superstition ..." *If the machine is not secure all bets are off* The most likly failure vector for this attack is that so few people use FV :-) John Pettitt, jpp(a)software.net VP Engineering, CyberSource Corporation, 415 473 3065 "Technology is a way of organizing the universe so that man doesn't have to experience it." - Max Frisch

3 2