December 2003 - cypherpunks-legacy

List owner named in law suit (fwd)
by Damien Lucifer 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Wed, 28 Aug 1996 16:52:36 -0400 (EDT) From: Clay Irving <clay(a)panix.com> Subject: List owner named in law suit I can't believe this one! Peter Laws, a recent graduate of the University of Arkansas, maintains an electronic mailing list called "SCAN-L". The list is provided for radio scanning enthusiasts. There are a few hundred subscribers to the list. Recently, in a thread about scanning publications, an employee of publication "A" apparently wrote something to offend someone at publication "B". Lo and behold, next thing you know, Peter is named in a lawsuit because he is the maintainer of the list. Something seems very, very wrong with this. I've never heard of anything like this before. Can a Email list maintainer be held liable for something someone else writes? Peter *just* graduated, and he needs all the help he can get. Thanks, in advance. -- Clay Irving N2VKG clay(a)panix.com http://www.panix.com/~clay/

1 0

Re: MSIE cryptography
by Peter Trei 17 Dec '03

17 Dec '03

John Hemming - CEO MarketNet" <johnhemming(a)mkn.co.uk> writes: > Just downloaded the most recent English Version 2.1 for Windows 3.1. > This does appear to do the same in terms of no encryption at all after > the server hello. > > To be fair to Microsoft the number of cycles performed for the private key > echange is quite high. Therefore, not having any key and not doing the > RSA calculations makes the access quite a bit faster. > > The older versions (and some Win95 versions) that we have found around > seem to just crash our server. I am not really feeling like debugging that. I understand that some versions of MSIE support SSL level 3. SSL3 includes a capability to switch 'cipher suites' in mid-session, or pick one at the start of the session. One of the standard cipher suites performs authentication, but not encryption. This is consistant with your description. Please ensure that the server you are connecting to is not configured for authenticate-only. It would be a pity to raise a big ruckus over what may be just a mis-configured server. Peter Trei trei(a)process.com

2 1

Small German bank claims first with online service
by Joseph M. Reagle Jr. 17 Dec '03

17 Dec '03

> FRANKFURT, Aug 28 (Reuter) - German private bank Gries & >Heissel Bankiers on Wednesday launched an Internet banking >service -- the first comprehensive service of its kind in a >country where online bank options are gradually taking off. > The small Berlin-based bank linked up with U.S. computer >firm Hewlett Packard Co to develop the system, which Internet >users can access using a high-security personal code. > Clients will be able to view detailed balances on their >deposit, current and securities accounts and transact all normal >banking business on the World Wide Web. > Although online banking is a developing trend on the German >financial services market, larger banks with far broader >customer bases are working on more selective Internet packages. > Thomas Gries, one of Gries & Heissel's personally-liable >directors, said he regarded Internet banking as a logical >supplement to the bank's existing services. > ``We have had an Internet home page since October 1995. This >move from a pure information medium to an interactive one was a >logical one,'' Gries said. > Banking officials attending the CEBIT electronics conference >in Hanover this week said German online banking business was >poised to grow dramatically. > ``In the next six months, five to ten German banks will be on >the Internet,'' said Stefan Schoeller, board member at Bayerische >Vereinsbank AG unit Vereins- und West Bank. > Vereinsbank plans to launch Internet services within about >six months via its Advance Bank direct unit, pending a review of >security options. > Rival discount broker Direkt Anlage Bank, a unit of >Bayerische Hypotheken- und Wechsel Bank AG, on Tuesday launched >an Internet service for its securities account holders at half >the cost of its telephone banking service. > Meanwhile market leader Deutsche Bank AG is to test >electronic cash on the Internet this autumn in a joint >initiative with Dutch electronic payments group Digicash NV. > Vereinsbank officials at CEBIT said they planned a steady >expansion of the bank's online options over the coming years, >predicting 10 to 15 percent of its current account clients would >be online by the year 2000. Around 12 million Germans would rely >on home banking by that date, the bank predicted. > At the moment, around 3.7 percent of the bank's clients, or >45,000 individuals, handle their banking via PC alone, Stefan >Schoeller said. > Hewlett-Packard's German sales manager Michael Lindner said >his company, which last year helped set up the world's first >Internet bank, Security First Network Bank, had spoken to >several other German banks about some kind of Internet venture. > ``We certainly do not plan to limit our involvement to a >small exclusive bank,'' he said. > Lindner said there were about two million Internet users in >Germany and 35 million worldwide. He admitted that the amount of >bank business transacted on the Net -- about $200 million -- was >``very limited'' but predicted a dramatic rise in volume. > Vereinsbank's Schoeller said the cost advantage alone made >it worthwhile for customers to go online. A normal current >account incurred charges of 8.40 marks a month, while the same >account online would cost just 5.40 marks, he said. > All banks are stressing the security of the Internet. > > > _______________________ Regards, Boredom is the feeling that everything is a waste of time; serenity, that nothing is. -Thomas Szasz Joseph Reagle http://rpcp.mit.edu/~reagle/home.html reagle(a)mit.edu E0 D5 B2 05 B6 12 DA 65 BE 4D E3 C1 6A 66 25 4E

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

>> Just downloaded the most recent English Version 2.1 for Windows 3.1. >> This does appear to do the same in terms of no encryption at all after >> the server hello. >I understand that some versions of MSIE support SSL level 3. SSL3 includes a >capability to switch 'cipher suites' in mid-session, or pick one at the start of the >session. One of the standard cipher suites performs authentication, but not >encryption. This is consistant with your description. >Please ensure that the server you are connecting to is not configured for >authenticate-only. It would be a pity to raise a big ruckus over what may be >just a mis-configured server. The server is one which interoperates correctly with Netscape and my own routines. It does strike me that this change is potentially the source of the bug. However, to have a "locked" symbol on the bottom right hand of the display would indicate to me as a user that a secure session has occurred. For SSL devotees the records sent are: 1. Client hello (from the client) 2. Server hello (from the server). 3. Plaintext data packaged up in SSL records from the client. 4. The client then accepts plaintext data packaged up in SSL records. SERVER_VERSION_MSB and SERVER_VERSION_LSB indicate version 2 of SSL. I have not changed the code in any way to deal with version 3 of SSL making I think the valid presumption that browsers using 3 and 2 should be able to cope with a server using 2. I shall reboot my system, trace a bit of a session and post that.

1 0

Re: MSIE cryptography
by John Hemming - CEO MarketNet 17 Dec '03

17 Dec '03

For the real SSL devotees here are the first three transmissions. Client Hello 16.8 1025->443 seq 00000001 ack 00000001 PSH ACK wind 4096 data 30 80 1C 01 00 02 00 03 00 00 00 10 02 00 80 69 AE 0E F0 FA 2E 01 63 BC 59 AF 0F 1C C1 B1 7B 16.8 443->1025 seq 00000001 ack 0000001F PSH ACK wind 5640 data 590 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 2A 30 82 01 93 02 05 26 FB 85 54 3F 30 0D 06 09 big snip of server hello (of the certificate) CC 1F BC A8 9C D7 47 41 D2 33 27 (cert has ended) 02 00 80 4A E7 13 36 E4 4B F9 BF 79 D2 75 2E 23 48 18 A5 16.9 1025->443 seq 0000001F ack 0000024F PSH ACK wind 4096 data 333 Client Master Key should be here, but instead we get 81 4B 47 45 54 20 2F 20 48 54 54 50 2F 31 2E 30 G E T sp / sp H T T P / 1 . 0 0D 0A 41 63 63 65 70 74 3A 20 2A 2F 2A 2C 20 71 Server Hello 82 4C 04 00 01 00 02 02 2E 00 03 00 10 (cert starts) 30 82 02 82 4C - SSL RECORD 04 - Server Hello 00 - Session ID Hit (no prior session) 01 - Certificate Type 00 - Server Version MSB 02 - Server Verson LSB (ie server version of SSL is 2) 02 2E - Certificate length (mainly snipped) 00 03 - Cipher specs length 00 10 - Connection ID length I think the probability is that the unusual circumstance that causes what seems clear to me as an error is that the cert is signed by a CA other than Verisign. Essentially, however, I do not think it is right for a program to display a locked key regardless of any other issues if the data being transferred is not encrypted.

1 0

Re: Stego Virus
by Robb＠SpeakOut.org 17 Dec '03

17 Dec '03

For a virus (a program) embedded in a .gif file to affect you, it would have to unsteg and then run. Just dont run it it you unsteg it. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

1 0

see you guys later
by robbhill＠southwestpaper.com 17 Dec '03

17 Dec '03

This list used to focus on privacy issues, crypto protocols, algorithms, national crypto policy, etc. I saw the Netscape cracks announced here, I saw squeamish ossifrage here, now I see nothing of the sort. Now I see that people are discussing heckling the pres., black helicopters???. I have heard Phil Zimmerman frequently call Paul Zimmerman. See you guys later. Robb Hill National Association for Home Care 228 7th Street SE Washington DC 20003 202-547-7424 202-547-9312 fax robb(a)speakout.org

2 1

Anti-Racist Laws Stifle Political Liberty
by qut＠netcom.com 17 Dec '03

17 Dec '03

llurch(a)stanford.edu (Rich Graves) writes: > Incidentally, [don't college speech codes] belong in the past > tense? Stanford hardly lifted a finger to defend the Grey > Amendment, which was designed and widely regarded to be the most > carefully tailored speech code around. I don't know of any > universities that have tried to enact a speech code since. The > attempt would be futile. (Background: Grey applied only to > "fighting words" directed at individuals. It was fine, under the > [overturned] Stanford policy [which I voted against], to create a > "hostile environment" by screaming hostile verbiage at nobody in > particular; but you couldn't say the same thing to someone's face.) The mere lack of enforcement of an unjust law does not justify the continued extancy of that law. That very "dead letter" law can be fired up at any time to harass critics of the university's anti-racist administration. Some examples of dangerous dead letter laws: * Abortion Most people presume that abortion is legal in the USA, wrong. Most states make abortion very illegal, our whole abortion freedom as currently exists rests entirely on a few federal court decisions. If the previous Supreme Court decisions are overturned, most states will suddenly start enforcing their fascist anti-abortion laws. * Hate Crime Denmark used to be presumed by racists to be the only country in Europe where racism was legal. Denmark's anti-racist laws were not enforced in ages. Yet, the anti-racist laws sprung into action to persecute Gerhard Lauck, an American Nazi who desired to move to Denmark on the account of a provocateur that his organization would not be harrassed in Denmark. Mr. Lauck was deported to Germany where he was sentenced to four years in prison to the outrage of professional anti-racists of the "moderation" of his punishment for merely speaking in pro-Nazi terms in Germany, where politics that challenge the ruling order is strictly illegal. * Racism In Other Countries Racist politics are explicitly illegal in every "white country" in the world except, so far, the USA. The mere lack of enforcement in many of the countries such as South Africa, Canada, Denmark, Russian Federation, Malaysia, Australia, etc., does not exonerate that country from the charge of censorship as political intrigue. * "We Will Take Power" A lot of fake anti-censorship activists insist they are for free speech in the sense of allowing such political purposes as "we don't like your policies and we want you to change," but desiring to make illegal such political goals as "we don't like your power and we're going to try to take it away from you." Yet there is no purpose, no purpose whatsoever in political speech, if there is no threat allowed to the ruling order expressed in idealogical terms and organizational forms. Thomas Jefferson, Thomas Paine and all the nationalist founders of the American nation would approve of radicals organizing and expressing their goals of seizing power legally, or if denied the means of a republic for succession, illegally. * Unfree Nations Germany is an example of a nation that prohibits any type of Nazi political party. Therefore, Germany is not a free country, not an honest republic, in fact, less free even than Wilhelmian Germany in allowing radical parties to challenge the power structure. -- I marvel at the resilience of the white people. Their best characteristic is their desire to learn. No other people has such an obsession with the intellect.

1 0

Re: MUD anyone?
by tcmay＠got.net 17 Dec '03

17 Dec '03

I second many of the comments about the difficulties in coding a reasonably plausible game or MUD for exploring list ideas. Just about four years ago exactly, at the first meeting of what was to become the Cypherpunks group, we "played" the "Crypto Anarchy Game." Based solely on paper tokens, like Monopoly, the idea was to introduce people to concepts like digital money, anonymous remailers, information markets, and so on. Sealed envelopes represented remailed messages, with "mixing" done by hand. Lots of imperfections, lots of stalls and dead ends, lots of confusion. Protocols were imperfectly enforced, messages got lost (literally "dropped on the floor"), and the game eventually ended in laughter, confusion, and silliness. But it was deemed useful by most present, as it made more real the abstractions talked about in the morning session. Coding nearly any of the core cryptographic concepts for use in an online game, even without a real crypto core (e.g., using other trust mechanisms) is likely to be almost as big a job as actually coding the concepts for real-world use. Could be very educational, and a useful dry run for later real-world reification of concepts, but by no means easy. I'm not trying to discourage anyone. Go for it! But it's a _big_ project. And as Jim Bell noted, there are all sorts of costs which are not properly accounted for. I would not, for example, expect anything interesting to emerge out of the simulation of "assassination politics" in such a game, as the costs, dangers, moral issues, and whatnot are not properly accounted-for in such a MUD-type simulation. (No more so than in a fantasy role-playing game, where characters die routinely...) And as a last note, we had a couple of "hits" bought anonymously back then, during the game, in '92. (Hint: One doesn't need a Bell-style infrastructure for bidding on the death of politicians to raise the money for a hit....many interested parties would surely pay the $5000 (or less, say some) to buy a hit if the risks were lowered. And to paraphrase Bell, "I know a way to lower the risks.") --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

2 1

Re: A _REALLY_ Interesting Bet [2]
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

Jim Gillogly <jim(a)ACM.ORG> wrote: <snip> >Idea Futures is dead, and the torch has passed to Foresight Exchange (FX), >which is at http://www.ideosphere.com/ideosphere/ . You can bet on a number >of political issues (US and other), though not (yet) for real money. IMO, a good cypherpunk goal would be to get that "yet" in, with Chaum's Digicash, before the election. Perhaps Mr. Cate has some ideas in this regard...;) When talking to lawyers one finds the justification for the prohibition to be something like, "it would demean the process." IMNSHO, the nest has already been soiled, and the only effect would be to kill the unwanted phonecalls around suppertime, as I said before. The media would eventually flock to the more-accurate poll, even if it involved the dreaded crass freemarket capitalism of people willingly gambling. <snip> >This doesn't track the polls, which typically ask who the potential voter >would vote for rather than who they think will win the election. Indeed. Also, a prominent candidate (this time) told devotees (last time) to give wrong answers to pollsters when called. While it's still possible, this behavior is much less likely with real money (though with his kinda dough, distortions would be possible for him -- & profitable for others). >Other issues: > >Percentage of popular vote to Dem candidate: 47 >" " Rep " : 44 >" " Other " : 12 > >Note that there may be an opportunity for arbitrage when numbers don't add >up to 100; Last time there was supposedly an arbitrage opportunity between odds in Moscow and those in London [Now THAT'S my kind of bet;) -- I can't lose] according to a W$J article on the subject from years ago. 20 minutes on Alta Vista this morning reveals nothing like this available, Ladbroke's links are hardly there, and I don't know the names of any other bookies in London, or any at all in Moscow. The closest thing was a (braindead) "George" magazine article and a few sites lamenting the lack of possible Presidential gambling. AV didn't even reveal the confusing US university site where some gambling is (or was) going on. Perhaps English c-punks can help us on the odds for all candidates, including the longshots. I think publicity from freeing up this information might be more favorable than publicity about things like porn or Assasination Politics, and the process of setting up a site that reveals the odds in semi-realtime from London/Moscow should not be too difficult, especially if actual gambling is not conducted on the site.

2 1