December 2003 - cypherpunks-legacy

Re: Email Bombing
by kickboxer 17 Dec '03

17 Dec '03

Yeah, but if the REAL email bomber were such an accomplished hacker, he did not alter the scripts well enough to make the SysAdmin overlook them... -kickboxer

1 0

Re: Rumors of death of Anguilla Data are greatly exagerated.
by Vincent Cate 17 Dec '03

17 Dec '03

Tim: >(I have respect for what Vince did, by actually moving to the Caribbean and >setting up a data haven/offshore ISP business. Thanks. >However, just as we discuss >the situation about remailers going down, or monitoring the cleartext, or >blocking certain addresses, so too should we discuss what Vince is choosing >to do. Maybe he is ultimately right, maybe not. I'm including this preface >just so no one thinks I'm trying to start a feud. No way.) Sure. There are things to figure out, lessons to learn, ... >>This is a fraud by taxbomber. He is totally involved with selling fake >>passports. He calls them "camouflage passports" and they have names like > >"What is truth?" Many of the things customers of a data haven are likely to >be doing are "fraudulent" or "illegal" in some jurisdictions....I'm sure I >don't have to spend effort here citing examples from religious, medical, >and business domains. The fraud I meant was his saying that he is not selling fake passports in his "fee sorry for me I got cut off" post. He was selling fake passports. >Selling fake passports seems not to be something Vince ought to even be >paying attention to. Granted, pressure from outside states may put pressure >on Vince, but this actually confirms my worst (OK, _nearly_ my worst) >suspicions about the viability of such data havens. Remember regulatory arbitrage. The more jurisdictions on the Intenet, the better for users. That some things are not permitted in Anguilla does not mean it is not a viable jurisdiction for some other things. For example, tax free corporations, IPOs over the Internet, gambling (Anguilla should have bingo on the Internet by the end of next month). Vince >My lawyer called me up and told me that fake passports are illegal in >Anguilla and that I should pull this guy immediately. I did. It is our >policy to not permit anything on our servers that is illegal in Anguilla. >My lawyer is where I get the definition of "illegal in Anguilla". Tim: >Instead of "pulling" this guy, did you first send a copy of your lawyer's >letter to you to this guy, and advise him that he should remove just this >one specific item, the allegedly illegal British Honduras passports? After my lawyer called I disabled the web access. I believe this is a big part of his business, and it really just makes more sense for him to use another provider than to remove it. >Tim: >Then I suggest you carefully provide a full copy of what you consider to be >illegal to all subscribers. Will do. More than just leggality, what I consider acceptable. This will show up as http://online.offshore.com.ai/rules.html >I have some questions, though. Would bomb-making instructions be legal or >illegal, acceptable or not acceptable on your system? How about "Kill the >Queen" screeds? And so on. Not acceptable. This is not the market I am after. I don't see the profit in it. >If you "pull" the entire account of a business when the Governor-General, >or His Royal Excellency--or whomever it is that runs Anguilla--applies >pressure....well, you won't have much of a real data haven, now will you? I may not have your idea of a data haven. But there are things, like no-taxes, where Anugilla has stood up to the US pressure for years. >>He also suggested opening up bank accounts with these fake passports >> (encouraging fraud). > >On this last point, how is this "encouraging fraud"? If the laws of a country say it is fraud to open a bank account with a fake passport, then encouraging someone to do so is encouraging fraud. Check with your lawyer and see if you can open up a bank account with a fake passport. If I were making the laws I would permit numbered accounts etc, so there was no interest in fake passports for bank accounts. >Then they deny the loan. One use of fake ID is to open up loans or credit cards under fake names, get some money, and then toss the fake ID and never pay, and never be found. You would agree that is fraud? Tim: >I should remind readers that it is legal >to sell such passports in the U.S....somewhere I have one that says "This >document not good for travel in the People's Republics of Berkeley, Santa >Monica, and Madison," or somesuch. Regulatory arbitrage is a fun thing. If you want to do something that is not OK in Anguilla, but is in the US, then you should do it in the US. -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

1 0

Re: Rumors of death of Anguilla Data are greatly exagerated.
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 3:20 PM 8/11/96, Perry E. Metzger wrote: >Timothy C. May writes: >> Selling fake passports seems not to be something Vince ought to even be >> paying attention to. Granted, pressure from outside states may put pressure >> on Vince, but this actually confirms my worst (OK, _nearly_ my worst) >> suspicions about the viability of such data havens. > >Vince has the right to run his business any way he likes. Of course. I never said otherwise, so this is a straw man argument. Ditto for remailers, ISPs, bookstores, blah blah blah. But this does not mean people should say nothing about what they learn the practices to be. >In some jurisdictions, "Fake" passports are legal. In some, they are >illegal. Vince feels that in his jurisdiction they are illegal. He has >every right to decide who to allow to run off of his web servers -- >even to be arbitrary about it. Of course. I never said otherwise. Those of us who have commented are not challenging his legal right to do so, only remarking that if he cancels accounts without stronger legal evidence, or without making it clear what is acceptable and what is not, he risks losing reptuation capital. --Tim May Boycott "Big Brother Inside" software! We got computers, we're tapping phone lines, we know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Licensed Ontologist | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

US Power Outages
by I=(!isnum(self)) 17 Dec '03

17 Dec '03

I wonder if someone's probing power-system vulnerabilities and defense strategies. Just coincidental that there's been all this noise about power grid vulnerability and two vast regional outages this summer? We spent an enjoyable evening around the oil lamps ... maybe it's not such a bad thing, this vulnerability...... <blink> ... POOF!

1 0

Re: Rumors of death of Anguilla Data are greatly exagerated.
by Vincent Cate 17 Dec '03

17 Dec '03

Perry E. Metzger <perry(a)piermont.com> > Vince has the right to run his business any way he likes. This is a very good libertarian point. > Vince has made it very clear that he is NOT a data haven. Anguilla is > a TAX HAVEN. That is, if you are selling copies of some software over > the net or what have you, and you run the business out of Anguilla, > you are not liable for any Anguillian taxes because there are none. > > Anguilla is *not* a data haven, drug haven, or any other sort of > haven. I would have thought that Vince made this clear. And Anguilla is first and foremost a taxhaven. But it tries hard to be a very clean taxhaven (does not want drug money etc). I think that "clean" corporations operating here tax free is a potentially huge market. Anguilla and OIS are not the data haven of cypherpunks wet dreams. Neither Anguilla nor I want "hit men for hire" advertising here. Sorry Tim. And I think the loss in clean business would outweigh any money from such by a long shot. The concept of a datahaven is still evolving. There are things that we can and will do from Anguilla. So while Anguilla may not really far along the cypherpunk datahaven scale at this point, I would not go so far as to say it is not a datahaven. One simple example is that OIS was given a project Gutenberg CD-ROM and may sell online copies of old books. Some countries are extending copyrights back further into the past. Anguilla is not. So we could sell books that have expired copyrights in Anguilla but not expired in USA etc. Think regulatory arbitrage. Taxhavens are a huge and well understood market. Datahavens are still new. Not counting gambling, they may only be $0/year rounded to the nearest million. -- Vince ----------------------------------------------------------------------- Vincent Cate vince(a)offshore.com.ai http://www.offshore.com.ai/vince/ Offshore Information Services http://www.offshore.com.ai/

1 0

Re: Oregon License Plate Site in the News Tonight!
by Duncan Frissell 17 Dec '03

17 Dec '03

At 11:28 PM 8/9/96 -0500, David E. Smith wrote: >In Missouri, that's all they wanted (a PO Box). That's >perfectly copacetic by them. If you want to register for >voting - since we have Motor Voter - they of course need >a real address. And the post office's requirements for >getting a PO Box are nearly nonexistent. Using a Mail Receiving Service (MRS) address will usually work. Many bureau-rats have yet to compile or use a list of Mail Receiving Services. There *are* commercial firms that do compile such lists but they have to be used to be any good. In those rare cases where they turn you down for a registration or drivers license because they happen to notice that you are using a MRS, you can find a real person to accept your mail for you. I solved the problem once by advertizing on Usenet newsgroups for an address and cut a deal. Another possibility is to use the "homeless defense." I'm homeless, this is the only address I have. Auto insurance companies are more likely to give you trouble than government if you use an accommodation address since they have actual money to lose. There are still 10 or so states that do not require auto insurance so by forum shopping, one can dodge this problem and save money at the same time. Most states are not so fussy, and one can usually just use MRS addresses. Litigation to force you to list a "real" address is exceedingly rare (it's not worth the government's time). This is particularly so since it is trivial to switch cities, counties, states, and countries (if in the US use Canada) for official address purposes. You control your address. Move into a hotel/motel that rents by the week, list the address, and then leave. Even in the Nazi strongholds of Mitteleuropa with their address registration laws, one can crash with friends or sublet apartments and avoid the process. Holiday cottages let a month at a time is another technique. Plenty of Germans are living unregistered lives even today. Residence=Domicile Domicile requires "actual physical presence plus intent to make it your home." *Your* actions establish intent not any actions by the government. DCF "Last year, the Government of the United States collected more taxes from the American people than any unit of government has ever collected before in the history of mankind -- and still it's not enough."

1 0

FCC_ups
by jya＠pipeline.com 17 Dec '03

17 Dec '03

8-10-96. WaPo: "Phone Service Via the Internet May Slash Rates." Labs of Advanced Technology has developed a way for people to make long-distance calls over the Internet using only their telephones, at about half the price of ordinary toll calls. Customers would merely call a central number, then dial their long-distance numbers. The call is carried on the Internet, then put back onto the local phone system at its destination. The company plans to charge 5 to 8 cents per minute for all domestic U.S. calls, which represents a 50 to 75 percent discount off most domestic long-distance rates. International rates would depend on arrangements made with foreign phone companies. "Twenty years from now, and probably sooner, I don't see the giants of the telecommunications industry existing anymore," said the company's president. The giants hoot, "FCC, PACs, whack him." "PCs and the Postal Service Challenge the Mailroom Reign of Pitney Bowes" New technology has made it possible for IBM, Bell Atlantic and National Semiconductor to start prowling around postage meters, which account for $20 billion a year in postage. With a telephone line to the post office and some fancy computer software, a "stamp" could spin out of the printer at the same time the envelope is being addressed. Computer-generated envelopes will not only have addresses and stamps, but also a bar code that can quickly be read by a computer to hasten delivery. Distinctive stamps called indicia carry a specially encrypted numerical code that Pitney Bowes believes the Postal Service should adopt to prevent counterfeiting. ----- http://jya.com/fccups.txt (22 kb) via: www.anonymizer.com FCC_ups

4 3

re: National Socio-Economic Security Need for Encryption Technology
by Bart Croughs 17 Dec '03

17 Dec '03

Duncan Frissell wrote: The first axiom of economics is "Wants are unlimited." I'm glad that they're "shipping all those jobs overseas." The more people we have working the more goodies are produced. If the labor of US workers is freed up, then they can go about producing something else valuable that they didn't have time to produce before because those "third worlders" weren't doing their fair share back when they were trapped in feudalism or fabian socialism. You can't get more stuff (wealth) unless everyone is out there working to capacity (consistent with their desired work/leisure tradeoff). I agree that 'shipping all those jobs overseas' will not cause the US workers to lose jobs. There is other work they can do. But there is another axiom of economics which the nationalist/socialist can use for his case against the free movement of capital. This axiom states that the wages of workers depend on the amount of capital invested. The more capital invested, the higher the wages are. If American companies are moving capital to Third World countries because of the low wages in these countries, then the workers in the Third World will of course be better off. But in the US, the amount of capital will be lowered. So the American workers will be able to get other jobs, but these jobs will pay less, because of the diminished amount of capital in the US. Of course there are advantages also for the US (shareholders will get higher returns, trade will increase), but how can you proof that these advantages will offset the disadvantage of the lowered amount of capital in the US? Anyone? Bart Croughs

3 3

Re: US Power Outages
by Dave Farber 17 Dec '03

17 Dec '03

As someone who was married in NYC during the 65 blackout *happened at 1716 -- the blackout , the wedding at 1705, I have watched with interest the attempt to explain that blackout and how to prevent such. We have not progressed very far. The avalanche behavior of power systems is still not well understood and techniques to prevent such failures are not obvious. Same can be said of telephone and computer networks at different levels. Dave

1 0

e$: I Never Meta-Certification...
by Robert Hettinga 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE-----BY SAFEMAIL 1.0----- e$: I Never Meta-Certification... Verisign, NRC-CRISIS, Crypto vs. Encryption, "Half-Way" Measures, Meta-Certification, Reputation Rental, FLAs, Groucho Marx, and a Proto-Call for IFCA Founders. August 11th, 1996 About a month ago, after the July DCSB meeting, I had a drink with Jon Matonis, who's in charge of Financial Products for Verisign. We talked about a lot of stuff, but, since he was buying, :-), we talked a lot about certification authorities (CAs), specifically, financial certification authorities. Verisign financial certification authorities, to be completely precise. I have to admit up front that until then, I didn't follow the CA world all that much. I've been a Web-of-Trust guy, and I still think the world will go to more geodesic trust models sooner or later. The only "certificates" I care much about are the "digital bearer" kind. In a financial sense, I see certificate authorities as a way to extend book-entry accounting to the internet, and I'm more interested in edgier stuff: what I claim will be the re-emergence of cash-settled bearer certificates in the financial markets, this time in digital form, on public networks. CAs and link-level encryption are just a way, as someone from MIT said to me at MacWorld this week, to move the old private networks out onto the net, which, to my mind, are the same thing to digital commerce that derigibles were to aviation. Yes, they look like ships, which we know all about, and they *can* fly, but... Anyway, it's clear we're moving from a world of insecure transactions on private secure networks to one of secure transactions on insecure public networks. CAs, SSL, and the whole enterprise of encrypting links between accounting databases seem to be halfway measures to me. They're a way to create, like our friend from MIT says, a temporary private secure network, so you can send properly authorized, but still unsecure, book-entry down it. For that "proper authorization", you need the biometric identity a CA provides, so you can hunt down and jail miscreants who change the wrong book entry. I've even made biometric-identity CA jokes about "X.BlaBla" and "Numbers of the Beast", and all that. Which reminds me of something Steve Kent said at the NRC CRISIS report roadshow this week. He likes to make the distinction between cryptography and encryption. That is, governments tolerate cryptographic signatures because they can still read your mail, while they don't tolerate encryption, because, well, they can't read your mail. Frankly, I see that as a false dichotomy, and I think most crypto people do, too, but, since the major selling point for cryptography to business is that need to keep their book-entries clean, this gives governments a lot of breathing room. As long as most other businesses (call criminal enterprise a business for the time being) can't read the encrypted link, businesses are happy, and will accept watered-down *cryptography*, not just encryption. The problem, of course, is that *governments* will have the ability to read those messages, and even forge those signatures, and businesses aren't to the point where they're sensitive about this. Given the ubiquity of the invasiveness of modern industrial government in the affairs of business, not only with respect to regulation, but also with the ability to audit for taxes and other reasons, it may take a while for business to wake up to their own need for privacy through strong cryptography. But they will. Governments are made of people, of course, and when it's possible to create enormous financial advantage for yourself by reading financial transaction data, some of those people will do so, and, given the ubiquity of networks, they'll be able to get away with it. When you outlaw crypto, only outlaws have crypto, and all that. However, the *business* knows they've been robbed, and, since government employees are the only ones with the power to break the link and forge signatures, either through computational horesepower or key escrow, who are going to be the, heh, usual suspects? A bad place for a nation-state to be in, it seems to me. Cleptocracy may work in *some* places, but in general they're bad for business. Finally, there's a red herring in all of this, and that's the so-called exemptions for "financial activity" from much proposed cryptography controls. So, how do you know what's financial activity and what isn't if a message is encrypted? This doesn't even take into account the fact that, if bearer certificate technology takes off, from micropayments like Micromint and Millicent, through ecash and on to digital bearer certificates for foriegn exchange (a $3 trillion daily business), the sheer volume of encryption on the net, of the strongest possible form, is going to explode. Don't get me wrong, I like the CRISIS report, because they are, to use a beloved scatalogical expression, inside the tent and er, pointing, out. But, to beat a few more metaphors like dead horses :-), the CRISIS report is trying to "decompress" government into a world where they can't really wiretap anymore. To do that, they want to start the bar at, say, 56-bit DES and 1048-bit RSA, and move it up as technology, er, improves. In this, they remind me more of someone trying to shovel uphill against an avalanche. If you can't sign a mortgage with a signature long enough to withstand 30 years of Moore's law, or encrypt something you don't want others to read for that long, then why do it at all? A little bit of encryption is like being a little bit pregnant --. OK, OK, I'll give the metaphors a break now... :-). So, we're back in the hotel bar, and Jon was buying, and I'm listening. (Besides, Jon's an original e$pam subscriber, and he's *still* one, so I had *better* listen.) He has a point when he says that most of the stuff I'm interested in is out *there* somewhere, and the way you make money is here and *now*, where the "halfway measures" live. Jon says that as far as he's is concerned, of all the different kinds of businesses you can use certification authorities for, banks and financial institutions the low hanging fruit, and he and his bunch are out there shaking the trees for all they're worth. Go, Jon, go. So, why *doesn't* Verisign rule the world of financial CAs already? After all, they have the patents, "modulo" the debate on the legal strength and longevity thereof. From the standpoint of mobilized resources, they're literally the only game in town, and, even if they aren't, with a tip of the black cryptographer's hat to Redmond, a lack of uniqueness hasn't kept other first movers from software hegemony before, anyway. Well, first of all, let's assume the market's already there for book-entry transactions on the internet (like credit and debit cards, and counter-cash like Mondex). Yeah, I know, "assume a frictionless surface". But, everyone else around here does, so we'll fiat the issue for the time being. Last Sunday's "Shoe" cartoon, about the wizard spending $300 in webware upgrades while ostensibly learning to get rich doing web commerce, to the contrary. Second, we can assume that banks need certification, for all the reasons I outlined above: In order to move book-entries around the net, you need *functionally* encrypted links (for the time being, what technology and governments let us have) and the digital authority to change those book-entries. Operationally, they may not need strict biometric identity just to map a signature to an account full of money, but we'll deal with that some other time. Now, let's look at what I presume is Verisign's business strategy for financial markets. They're trying to build a superheirarchy of all those bank heirarchies, so that those banks can clear trades with each other, on the net, without using a proprietary network to do it. This is, of course admirable, if not necessary, if banks want to do internet commerce efficiently with their customers. It will be necessary when electronic checks come on line, say, next year, because even though ACH is out there on the other side of those internet-ACH gateways, there might come a time where banks will want to clear checks against each other directly. Having a CA's CA, CA^2, if you will, will make that possible. To make this happen, Verisign doesn't want you to be you unless Verisign says you're you, to paraphrase the old underwear comercial, and that, I believe, is the problem. Verisign is not paying attention to what it really is: a software vendor. It is not a financial intermediary, which is what this CA's CA would be, by definition. A financial intermediary, especially one on the net, is in effect "renting" its reputation to a trade until it clears. It is saying, first and foremost, that the trade will be safe, effectively risk-free, or at least risk-calculable, to both parties of the trade. What it does to control that risk is almost immaterial as long as it works, but, in this case, it is to use RSA as the technical means of identifying the parties of the trade, with a link to a "biometric" identity of either party. If you can call it "biometric" for a financial institution. The financial institution then, of course vouches for the contents of the particular account being offset, the book-entries swap, and the trade is over. Like flying an airliner, of course, this is the easy part. If the trade is broken, what does Verisign do? Of course, it can refuse to do trades with the offending party. It can even call the law. The former is much more powerful, however, and, frankly, it's the only enforcement mechanism which we'll be able to use someday anyway. Physical force costs a lot to use, even if you can buy it wholesale, at the government rate. Fortunately, this kind of "club", as Eric Hughes calls it, is the predominant way of renting reputation in the financial community. Think of NYSE, or NASD, or CBOT, or NIDS, or SIAC, or any other FLA. ;-). (Yes, there's DTC, and CUSIP, and Other-Letter-Acronyms too.) They're pretty easy to set up. Verisign itself is *not* how to do it, however. They would to *sell* to this reputation-rental entity. Every one of the above entities is an association (not-necessarily-non-profit), or, more usually, a member-owned corporation. So, with that in mind, internet financial institutions like banks could create an association or member-owned corporation, which would "rent" reputation and function as a financial intermediary between members. Obviously we shouldn't restrict membership in this organization to just depositories like banks, because non-depositories will be significantly involved in internet commerce. See Phil Webre's CBO study on electronic retail payments for more on that. Here is one way that could be done. A bunch of banks -- and non-depository financial intermediaries, like digital cash underwriters / trustees, payment gateway companies, (someday maybe Millicent brokers and MicroMint issuers) - -- could get together, purchase shares for startup money, and form a certification authority for themselves. Revenue could come from processing and membership fees. They could then contract with Verisign to build their system. Of course, they could contract with someone else, too, but I expect that Verisign is in the best position to do this at the moment. In addition, Verisign would probably be the technology of choice for the subordinate certification heirarchies those financial intermediaries use with their customers. Pretty lucrative, but it is also tempered by whatever patent lifetimes Verisign has hanging over its head. Here's what that gets us. We get the ability for any member to clear any trade of any agreed-upon financial instrument (subject to legal restrictions, of course) with any other member, no matter where they are in the world, using the internet as the transport mechanism. Very powerful stuff indeed. In fact, this *organization* can be located anywhere, which gets really interesting, but we'll save that for some other discussion. Notice that I'm not saying that this would be a monopoly. Just like several countries have multiple stock and commodity exchanges, there will probably be multiple financial certification associations like this one. In fact, that's the core of a good prima facie name. The Internet Financial Certification Association. Nice ring to it. Four-Letter Acronym, too. I also expect that these kinds of "heirarchies" will probably devolve into a geodesic, too, but they'll probably survive the change, because there'll always be a market for, er, inter-mediary intermediation. I feel vaguely like Frege, or Russell, or Goedel here. Maybe (Groucho) Marx? So. Like most internet enterprise ideas, all it takes is a mailgroup, and, later, a meeting (I can think of this *nice* time and place in Anguilla ;-)), to set this up. Obviously, the membership/shareholders of the proposed IFCA should be companies, and the management of this enterprise should come from the membership, or at least hired by them. Any individuals (like myself, for instance) who participate at this stage are just kibbitzers along for the ride, unless they're planning to be an internet financial institution, of course. :-). As a sort of test of the idea, I've gone and set up yet another mail-group on thumper (<mailto://majordomo@thumper.vmeng.com>, with " subscribe ifca " in the body of the message) to discuss it. We'll move it someplace else later, if necessary. If there's enough interest from the right people, expect a call for founders sometime soon. If there isn't, it'll sink without a trace, as it should. So, if you, or anyone you know, is part of a financial institution involved, or wishing to get involved, in financial transactions on the internet, pass this rant along to them. Well, maybe not the *whole* rant, it might scare them. :-). But enough necessary to give them the idea, anyway. I expect that the places I put this rant will probably be enough to get critical mass for the mailgroup, at least, and we'll take it from there. Cheers, Bob Hettinga -----BEGIN PGP SIGNATURE-----BY SAFEMAIL 1.0----- Version: 2.6.i iQCVAwUBMg5FQvgyLN8bw6ZVAQF2GQP/fPHzQmgLy2ZOO8qTQIZoBgyiOUxXxkDA hoWJOc0BO5IoeK+JETLTiH5BNxbVqnWQiCO0N13RWXEDFyaBHAmRoujG1hgzs2e0 zYIS37jab3nPH7bkznswQJXOgOYBu9qRtZqrP5VonWXQxz2Zw5izFqdOIiOgoANv 0xMO8UayXEY= =MTk+ -----END PGP SIGNATURE----- ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0