December 2003 - cypherpunks-legacy

No Subject
by Alan Horowitz 17 Dec '03

17 Dec '03

On Aug 18, 96 11:12:16 am, Joel M Snyder, Now Overwhelmed Again wrote: > Back to the original topic: email-to-snail-mail. That's not hard, > technologically. The problem as I see it is billing. If I were to offer > such a service, I'd want to keep my cost to the consumer low, on the order > of $0.75 to $1.00 per message, with marginal charges for additional pages. > I might possibly barely be able to find some slave labor to make a profit > at doing it, IF I HAD THE VOLUME (which I probably wouldn't), but the > overhead of setting up a billing arrangement with every TDH who wants to do > it would eat the profits up instantly. > > It's difficult to conceive of a setup which a technomad would use in > sufficient volumes to be cost-effective. How about the sender provides a Digicash e-cash payment for the appropriate amount with each message, kind of like a electronic postage stamp? A script on the receiving side could automatically check the payment amount, bouncing the message back to sender with an "insufficient payment" message if necessary. Or you could use a web page to submit messages and payments. Either way no one needs to worry about billing, account tracking, etc. Payment/billing is taken care of immediately. Of course, there is some overhead with the fees on e-cash, but it probably would be more cost effective than other methods. P.S. I have an alpha version of a program which may be of interest to technomads: it automatically executes scripts received by email from a remote machine and then mails back the results. The scripts (shell scripts, perl scripts, or whatever) are encrypted and signed with PGP before being sent to provide security and prevent unauthorized users from executing scripts on your machine. The program runs on unix systems, and submissions can be from anything that runs PGP and is able to send email. See: http://www.bmen.tulane.edu/~carpente/emscrypt/emscrypt.html for more info. --Matt -- mcarpent(a)mailhost.tcs.tulane.edu PGP mail preferred, finger for public key.

3 3

CypherPunk Insolence
by attila 17 Dec '03

17 Dec '03

#include <stdio.h> #include <signal.h> void insolence() { Discus unrelated central "Bellism" of your own (); if ( gun_control_issue ) respond to every message with the observation genetically superior tomatoes seem to play an important role (); else change_subject_again(); process_threatening_messages(); while (1) { if ( PerryGram ) break; else { respond_to_all(); argue_with_TCMay(); continue; } } } -- Now, with a black jack mule you wish to harness, you walk up, look him in the eye, and hit him with a 2X4 over the left eye. If he blinks, hit him over the right eye! He'll cooperate --so will politicians.

1 0

"Utilization Review"
by Black Unicorn 17 Dec '03

17 Dec '03

I listened with horror this evening to a radio program which discussed the state of medical record privacy today. In one segment a doctor (psychologist) described an experience she had after a session which was covered by the patient's insurance plan. The doctor in question received a phone message with a 1-800 number and the request to return the call. On returning it she was connected with a very polite representative of the insurance company (who apparently had some experience in mental health, but not a M.D.) who proceeded to ask the most sensitive questions about the patient's session in order to conduct a "utilization review to determine medical necessity." Most alarmingly, the representative could be heard typing on a computer during the entire review. The program went on to indicate that among the provisions in the most recent health insurance reform bill there was a provision for information sharing among insurance companies to facilitate the transfer of insurance policies when the insured switches jobs. Among the more alarming suggestions in the legislation is the use of a "unique medical identifier." Many of you will see this coming. One of the currently proposed "identifiers" is the Social Security Number. Members of the list might also wish to consider that companies which self insure their employees for health benefits are entitled to all their medical records directly. The prospect of cradle to grave medical files as an everyday reality in the United States is but around the corner. In my view it is time for the foundation of an offshore insurance company which recognizes the basic tenant that client medical records are the property of the client, used in a license capacity at the pleasure of the insured, and not an entitlement to which the company is automatically privy. -- I hate lightning - finger for public key - Vote Monarchist unicorn(a)schloss.li

1 0

Re: Why BlackNet *IS* a Data Haven
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:29 AM 8/19/96, Rich Graves wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >True, for controversial political and artistic materials whose >authors/distributors have an interest in disseminating. And artistic, political, cultural, etc. materials are of course one of the main markets, as the large number of bookstores shows. (And the success of "Primary Colors," by "Anonymous," shows that one need not the True Name of an author, obvious to all persons on this list.) >However, with neither a government to enforce contracts nor an identifiable >location/identity that can be used for the private enforcement of, ahem, >contracts, the barrier to entry for anonymous markets in real commercial >products seems rather high. How are buyers and sellers to trust each other? >How do you build reputation capital from zero? Once you have reputation, >transaction costs should be pretty low, but building it? Yes, a topic we've discussed many times over the years. I don't have the time to compose a new essay on this, so I'll refer folks to either the archives or my Cyphernomicon FAQ, which discusses reputations, third party escrow services, etc. (Imagine an equally anonymous "Ace Escrow Service," which holds the cash until a product is transferred. Essentially, this is what a _store_ does. For example, a Barnes and Noble or a Home Depot chooses which products to stock based on their own evaluations, tests, and reputation assessments...and they make good on defective products, etc. This lessens the risks to the consumer that he will be screwed by a vendor he has little recourse against. "Middlemen.") >If what you're selling is a physical product, you're ultimately going to >have a location. If what you're selling is information, how do you >demonstrate the worth and trustworthiness of your data without distributing >it? And once you have distributed it, what's to stop a "counterfeiter" from >redistributing it, stealing your profits before you have had a chance to >establish your reputation capital as the preferred source? Sure, these are all issues. (As the Assyrian merchant said in 1300 B.C. "This idea of a "store" you have...I can think of many problems. How will they all be solved?") >I don't see anonymous digital cash as the tightest bottleneck. Distributed >trust in an anonymous marketplace seems more difficult. I disagree, but this was obvious from the focus of my post. I believe we see "distributed trust" (though this is not the choice of words I would use) all around us. Too many issues to debate here. My point was that the BlackNet approach *is* like a physical data haven, except with some advantages. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re: CS First Boston lawsuit
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:29 AM 8/19/96, Alan Horowitz wrote: >I suspect they are trying to get a judgement against "John Doe", in the >hopes of tracking him down later. > >Actually, if I had a sizeable judgement against such a John Doe, I could >probably find a private detective who would find the dude for a >contingent fee. Wow, a whole new class of factoring (commerce definition) >opens up. Get me a lawyer.... Lawyers out there can and should correct me if I'm wrong, but I don't believe either the criminal or civil justice system has the concept of a "John Doe" trial! The ability to have the advice of an attorney, to confront one's accusers, cross-examine witnesses, and mount a defense, and all that constitutional stuff. Rather hard to do if the trial is in the past tense. Can you cite an example of such a "John Doe" trial in the U.S.? (There may be trials "in absentia," more so in other countries than in the U.S., but not when no persons have been identified at all!) --Tim May, who hopes he is never identified as the "John Doe" indicted, tried, convicted, and sentenced in 1979 in Washington County, Oregon, for the crime of unlawful foddering in a public place. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

5 4

Re: Orbiting Datahavens
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Tue, 2 Jul 1996 17:06:47 -0700 (PDT), Brian Lane wrote: >> I'm not sure who would launch it - a Japanese launcher? (ESA is >> strapped for cash, which was one reason for the phenomenaly stupid move of >> putting space probes onto the maiden flight of the Ariane 5.) > > We'd want someone more reliable than ESA! I doubt that we could afford >to have a backup satellite in case of a disaster. Once the Delta Clipper >is functional the payload costs to orbit is supposed to drop tremendously. Or, who knows. NASA could finally wake up, really that the shuttle sucks as a cargo hauler, start using something like the Phoenix (They stonewalled it - would have made them look bad) to build orbital industry and then setup giant solar-powered launch lasers and have surface to orbit at pennies per pound. Oh well... Who'd have thought we'd go to the moon and stop. | Chris Adams <adamsc(a)io-online.com> - Webpages for sale! Se habla JavaScript! | http://www.io-online.com/adamsc/adamsc.htp | Autoresponder: send email w/subject of "send resume" or "send PGPKEY"

1 0

Re: "Utilization Review"
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 4:22 AM 8/19/96, Black Unicorn wrote: >I listened with horror this evening to a radio program which >discussed the state of medical record privacy today. > >In one segment a doctor (psychologist) described an experience >she had after a session which was covered by the patient's >insurance plan. A friend of mine is a psychotherapist very concerned with such issues. There are many pressures on him to reveal information about patients, most of which are "unsurprising" in a world of what can only be called "socialized medicine." (I say "socialized" in that very few persons pay cash or their own money for medical care, psychiatric treatment, sports injury therapy, etc. Most are paying only a per-visit deductible, if even that, and the rest of the charges are picked up by their employers, their insurance plans through employers, the various social welfare institutions, etc.) Insurance companies want proof that the treatments are needed, or are working, and cannot merely take the word of a shrink, for example, that his services are needed. (I can think of some solutions, such as "second opinions" and "independent review panels," but, I can tell you, such things are not common with psychotherapy regimens.) >The doctor in question received a phone message with a 1-800 .... >about the patient's session in order to conduct a "utilization >review to determine medical necessity." Most alarmingly, the >representative could be heard typing on a computer during the >entire review. Let's hope the resulting entries did not show up on a Web page! (This has actually happened, accidentally. Only discovered when the search spiders found the data and others then found the records.) >The program went on to indicate that among the provisions in the >most recent health insurance reform bill there was a provision >for information sharing among insurance companies to facilitate >the transfer of insurance policies when the insured switches >jobs. Among the more alarming suggestions in the legislation is >the use of a "unique medical identifier." Many of you will see >this coming. One of the currently proposed "identifiers" is the >Social Security Number. First, Clinton's dormant Health Plan (her husband is not pushing it) would've _required_ such cross-linking of records. My friend the psychotherapist is a liberal, but was aghast at this and lobbied with his fellow mental health care professionals against this. He also got PGP as a result of this scare. Second, the "Social Security Number" worry is misplaced. They _already_ have enough identifiers to cross-link records til the cows come home. Thinking one is safe if the SSN is not used is "ostrich security." The real issue is having confidential medical or psychiatric or legal records out of the containment of a trusted holder. >Members of the list might also wish to consider that companies >which self insure their employees for health benefits are >entitled to all their medical records directly. Indeed, when I was at Intel an engineer was outraged almost to the point of quitting and filing a lawsuit when he learned that his "Human Relations" bimbo in a cubicle down the hall had the details of his vasectomy. I'm sure by now the news of his vasectomy is a hundred different file system in a dozen different institutions. An Alta Vista search should turn it up. --Tim May ObCrypto Relevance: One of the ways safes (the steel kind, not the alternative to vasectomies kind) got stronger was not through imploring and lecturing, as we in the crypto community do, but through _insurance_. Why? A way to discount future costs/risks to the present. A merchant who has never been robbed probably doesn't think about the security of his safe. But his insurer does. And he says to the merchant: "The charge is $2000 a year if you continue with your current safe, and $1000 a year if you get a Mosler Titan-2 safe. Your call." The same motivation is, I think, what will eventually get security and crypto more widely used. A hospital sued for multiple millions because its records got intercepted and placed on the Web will have its insurance company rethinking policies and rates, and setting procedures for protection of information. This will drive security in a way that lectures, rules, and even scare stories will not. Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

No Subject
by winsock＠c2.org 17 Dec '03

17 Dec '03

DISCORDIAN SOCIETY SUPER SECRET CRYPTOGRAPHIC CYPHER CODE Of possible interest to all Discordians, this information is herewith release from the vaults of A.I.S.B., under the auspices of Episkopos Dr. Mordecai Malignatius, KNS. SAMPLE MESSAGE: ("HAIL ERIS") CONVERSATION: A B C D E F G H I J K L M N O P Q R S T U V W X Y Z 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 STEP 1. Write out the message (HAIL ERIS) and put all the vowels at the end (HLRSAIEI) STEP 2. Reverse order (IEIASRLH) STEP 3. Convert to numbers (9-5-9-1-19-18-12-8) STEP 4. Put into numerical order (1-5-8-9-9-12-18-19) STEP 5. Convert back to letters (AEHIILRS) This cryptographic cypher code is GUARANTEED TO BE 100% UNBREAKABLE.

3 2

Re:Why BlackNet *IS* a Data Haven
by mccoy＠communities.com 17 Dec '03

17 Dec '03

Tim May writes: > Without splitting too many semantic hairs about the precise definition of > "data haven," let me examine some ways in which BlackNet behaves > identically to a conventional data haven. I would be willing to concede the point if you would take a few seconds to examine the issue of complete lack of persistence in BlackNet. Your descriptions of BlackNet as a data haven seem to be completely based upon the presumption that an anonymous contact service and contract exchange is the functional equivalent to a data haven. Here are a few reasons why I would disagree: As a publisher of "naughty bits" I do not have the ability to just toss data up and assume that it will be there when someone wants it. I am forced to continuously monitor the appropriate newsgroups to find messages from people asking me to post the blueprints to the orbital mind control lasers or kiddie porn. I cannot put my data onto "the Net" with an expectation that any arbitrary user will be able to get the bits one month later. To maintain persistence I need to constantly repost my data, making it easier for authorities to trace me through simple taffic analysis if nothing else. > The classical data haven is closely identified with "place." To many > people, they naturally assume "data haven" = a haven for data, a "harbor" > (same IE root as haven) = a physical place. > > But is "place" important? No one has really claimed place is important, in fact the ideal data haven has no physical existence whatsoever. This is a given. As a practical matter it is a lot easier if you start off in a "place" because there are fewer complications but this has never been a necessity. > A person in the U.S. seeking the Necronomicon posts a message to BlackNet > (or any similar forum, using the same methods) asking for a copy of it, or > offering to pay for it. (Whether the information is free or for a fee is > not central to the idea.) This request is, of course, untraceable. > > Anyone, anywhere in the world, with a copy of this banned material on his > or her private machines may see this request and respond, either giving the > material away, or negotiating a fee. (As I said before, the absence of a > robust digital cash system, bidirectionally untraceable, is a known > limitation of all such systems.) Now you reveal the objection I had to BlackNet being a data haven. What if only one person has a copy of this banned material? It may not be in this publishers interest to have the data available to anyone for posting in response to the query ("Information does not want to be free, it wants to be expensive and liberated...") and some data is not widespread enough or of interest to enough people to assume that multiple copies exist to those who read BlackNet postings. Therefore the only way for a publisher to maintain availability of their data is to constantly monitor the appropriate newsgroups and republish for each request, persistence is maintained only through eternal vigilence (much like liberty, only requiring a lot more effort :) > It's a data haven. No, it is an anonymous contact service. To claim this is a data haven is like claiming that the classified ads in a newspaper are the equivalent to a mall; you could probably find the same goods if you looked long enough, but there is a reason that manufacturers sell goods through stores rather than just posting classified ads across the country. When one does not have the time to check the classified ads, wants to goods from a reputable source, and wants the goods in a timely fashion they will go to a shopping center. jim

2 1

ETS Call
by Theodor Schlickmann 17 Dec '03

17 Dec '03

The European Commission DGXIII/7 Security of Telecommunications and Information Systems has anounced an open call for tenders in the Official Journal as part of our preparatory work for ETS (the Europe-wide network of Trusted Third Party Services). The work proposed tackles the area of ETS infrastructure specification, design and implementation in the form of field trials or "pilots" as well as performing studies on communication and legal aspects. >From the above data, further details of the Call can be found on our Web site: http://www.cordis.lu/infosec/ For those who are unable to access the Web site, please send an e-mail request to Fiona Allan at the following address: fiona.allan(a)bxl.dg13.cec.be The identical information will then be mailed to you using the normal postal services. After reading the documentation, please direct any queries that you may have to Theodor Schlickmann at the following address: 73064.1247(a)compuserve.com Kind regards Theodor W. Schlickmann

1 0