December 2003 - cypherpunks-legacy

Searching an email address
by nobody＠replay.com 17 Dec '03

17 Dec '03

I have been trying to find out info re: someone via his email address and didn't find anything. The server is telaver.com, e.g., name(a)telaver.com Any suggestions outside of the usual search machines?

1 0

U.S. Helped Wipe Out One of the Kurdish Factions
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:00 PM 9/16/96, jim bell wrote: >condition which is forced on the victims. In addition, you almost always >find that these starving countries have well-supplied militaries, defending >the local warlords against each other as in Somalia. Indeed, in Somalia the >incoming food was actually used to buoy up one group against another, >because access to it is controlled directly or indirectly by the factions. The reports that the U.S. spent $100 million supporting the Kurdish struggle against the central government is a related point. The $100 M went into weapons, food, etc., which the U.S.-supported side used against the Iran-supported side. Then the U.S.-supported side allied themselves with the central government, however temporarily, and is not engaging in a "mopping up operation" (translation: summary execution of all members found of the losing side, including wives and children). Our $100 million helped wipe out the "losing side" Kurds, and also strengthened the previously-poor reputation of Saddam Hussein (who just got a unanimous vote of support from the Arab League foreign ministers meeting in Cairo...this likely explains why the weekend's predicted massive raid on Baghdad was shelved...Clinton is already backpedaling, and may send Hilary/Hillary to Baghdad to help the Baghdad "Save the Children" chapter). (Note: Only this last point, about Hilary, is made up...the rest is what is actually happening.) --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

really undetectable crypto made somewhat practical
by jim＠suite.suite.com 17 Dec '03

17 Dec '03

The primary drawback to the stego scheme I described in the previous post was the ratio of stego bits per message. The scheme would only transmit an estimated 4 stego bits per message. Then it occurred to me that I can improve the ratio by basing the scheme on the hashes or words rather than the hashes of entire messages. Previous Scheme: construct a sequence of plaintext messages such that the first 4 bits of the MD5 hashes of the messages combine to produce the cyphertext of the true stego message. The sender would only need to send the plaintext messages. The recipient would calculate the MD5 hash of each plaintext message, extract the first four bits from each hash, append them together, then decrypt the result to obtain the true stego message. New Scheme: First, calculate the MD5 hash of all the words in the various dictionary files used by the password cracker program and create a database containing every word and the first 4 bits of its MD5 hash. Given such a database, it would be possible to write a program that accepts as input a block of cyphertext (the stego message, encrypted), chunks it up in to groups of 4 bits and then, for each chunk, displays the words that have hashes that start with those same four bits. The person running the program would select words that form meaningful sentences but also produce hashes that combine into the encrypted stego message. This scheme would send 4 stego bits per word. In addition to ordinary words, the database could contain names, misspelled words, abbreviations, words with alternate capitalization, slang terms, technical jargon, whatever. Fortunately, senders and receivers don't need to synchronize word databases. The recipient doesn't need to have any word database. The receiver can reconstruct the hidden encrypted message simply by calculating the MD5 hash of each word in the plaintext message, gathering up the appropriate hash bits and decrypting the result. This scheme could send more than 4 stego bits per word, but as you increase the number of stego bits per word (sbpw), you reduce the number of words that will work for a given chunk of cyphertext, making it harder to construct meaningful sentences (e.g. given a 40,000 word database, 4 sbpw yields 16 word groups with approx 2500 words per group; 8 sbpw yields 256 word groups with approx 156 words per group. 8 sbpw would probably not work well). Would this scheme work? It works in the sense that you can use it to send arbitrary encrypted messages through channels that don't allow anything but human-readable plaintext messages, but does it do so in an undetectable manner? I think so, but I don't know for sure. Jim_Miller(a)suite.com

1 0

WinSock Remailer Now Accepting Only PGP Encrypted Messages
by Joey Grasty 17 Dec '03

17 Dec '03

Y'all: Effective immediately, the WinSock Remailer (operating at winsock(a)c2.org) will now accept only PGP encrypted messages. All incoming messages (with the exception of messages with subject headers of help, remailer-help, remailer-stats, and remailer-key) must now be encrypted with the public key for winsock(a)c2.org. All other messages will be rejected. Regards, Joey Grasty (jgrasty(a)gate.net) Jim Ray (liberty(a)gate.net) WinSock Remailer Operators -- Joey Grasty jgrasty(a)gate.net [home -- encryption, privacy, RKBA and other hopeless causes] jgrasty(a)pts.mot.com [work -- designing pagers] "Anyone who considers arithmetical methods of producing random digits is, of course, in a state of sin." -- John Von Neumann PGP = A7 CC 31 E4 7E A3 36 13 93 F4 C9 06 89 51 F5 A7

1 0

Re: forward secrecy in mixmaster
by Bill Stewart 17 Dec '03

17 Dec '03

At 06:29 PM 9/12/96 +0000, paul(a)fatmans.demon.co.uk wrote: >Stewart> I think they chose a strong prime (form p = 2q+1, q prime), ... >Strong primes are no longer of any benefit for cryptographic >applications. You're probably right, for today's factoring techniques. For a key you're only planning to use for the next couple of years, you can pretty much ignore strong primes, unless you're stuck with 512-bit keys, in which case you need to glean any crumbs you can. But for a value that needs to last a long time, such as a Diffie-Hellman modulus that's going to be a default value in a standard, and which you're only going to generate once anyway, it makes sense to generate a strong prime in case factoring methods that are affected by it become popular again in the future. It also makes sense to turn loose a bunch of people using different primality tests just in case somebody gets lucky (e.g. crank the test long enough that the probability of non-primality is 10**-9 or 10**-12 instead of just 10**-6. >Implementing strong primes won`t make your code any less secure, it >will just take longer to create the keys and won`t gain you any >security, all the big boys are using elliptic curve factoring methods >now so you really have nothing to gain. Do Generalized Number Field Sieve and its friends count as elliptic curve methods? # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Report on security of e-money by BIS
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Sender: e$(a)thumper.vmeng.com Reply-To: lvhove(a)vnet3.vub.ac.be (Leo Van Hove) Mime-Version: 1.0 Precedence: Bulk Date: Mon, 16 Sep 1996 10:39:14 +0100 From: lvhove(a)vnet3.vub.ac.be (Leo Van Hove) To: Multiple recipients of <e$(a)thumper.vmeng.com> Subject: Re: Report on security of e-money by BIS >So, I am still keen on that report ... > >> No political recommandations. >(ok) >> Possibliy the report will soon be online. Meanwhile it should be >> possible to order a copy at www.bis.org. > >but the site has no email address or ordering info. The report >is not listed as far as I could see. As I have a scanner, I >shall attempt to secure a paper copy, but it looks like recourse >to historical methods of communications is called for. Now, how >does one operate this push-button dial thingy... > >-- >iang >iang(a)systemics.com Found the following on the FRB of New York site at http://www.ny.frb.org/pihome/news/g10.html --- SECURITY MEASURES FOR ELECTRONIC MONEY ARE EFFECTIVE, G-10 TASK FORCE REPORTS NEW YORK -- Existing security measures to protect electronic money products, when implemented correctly, can provide consumers and issuers adequate protection from fraud, according to a report by G-10 central bank computer and security experts. The report, issued through the Bank for International Settlements, was prepared by <snip> *** This report will be available in its entirely on this site in the near future.*** --- leo _________________________________________________________________________ Leo Van Hove Centre for Financial Economics Vrije Universiteit Brussel (Free University of Brussels) Pleinlaan 2 B-1050 Brussels vox: +32 2 629.21.25 fax: +32 2 629.22.82 e-mail:lvhove@vnet3.vub.ac.be home page: http://cfec.vub.ac.be/cfec/leo.htm _________________________________________________________________________ --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "'Bart Bucks' are not legal tender." -- Punishment, 100 times on a chalkboard, for Bart Simpson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: 56 kbps modems
by craigw＠dg.ce.com.au 17 Dec '03

17 Dec '03

> Also note there's no mention of the hype-writer's old friend, > compression. But than if ypou are doing the compressed rate 56k is not that high. There are 28.8k modems that (in theory) do 336k including compression, so 56k would be redundant. Most current modems specify they will compress to 115k, whether they ever get close to this is unlikely Craig ,'~``. \|/ ,'``~. (-o=o-) (@ @) ,(-o=o-), +--.oooO--(_)--Ooo-----oOO-(_)-OOo-------oooO--(_)--Oooo.------+ | | | Soon, we may all be staring at our computers, wondering | | whether they're staring back. | | | | [Network Admin For WPA Business Products. aka doshai >;-) ] | | .oooO http://pip.com.au/~doshai/ Oooo. | | ( ) Oooo. .oooO ( ) | +-----\ (----( )-------oooO-Oooo--------( )--- ) /---------+ \_) ) / \ ( (_/ (_/ \_) Key fingerprint = 2D F4 54 BB B4 EA F1 E7 B6 DE 48 92 FC 8D FF 49 Send a message with the subject "send pgp-key" for a copy of my key. (if I want to give it to you)

1 0

Something crypto-financially relevant for a change
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

C-punks, I have somr wire clippings that I think are more relevant to this list's stated topic that the constant personal attacks, rants, and newbie questions. I don't have the resources to send them out on request like JYA does. Would anyone be interested in my sending more materials like this to this list? BANKS BANK ON INTERNET Internet banking is poised for a rapid growth in Europe according to a survey of the European banking industry by Booz Allen & Hamilton. Thirty seven banks took part in the survey, which found that 80% were planning to upgrade existing Web sites to incorporate most traditional banking transactions within three years. There was also signs of the emergence of the first Internet-only banks. Wide-spread concerns about security are more an issue of perception than of real obstacles, according to Claus Nehmzow, a principal of BAH. The survey predicts that over the next five years 2,000 European banking institutions will be online. -- New Media Age, 9/12/96 IBM TEAMS WITH 15 BANKS TO FORM INTEGRION FINANCIAL NETWORK Fifteen of North America's leading banks and IBM today announced the formation of Integrion Financial Network. Beginning in early 1997, Integrion will offer a broad range of interactive banking and electronic commerce services to banks in the U.S. and Canada. Representing over half the retail banking population in North America, over 60 million households, Integrion will be owned and operated by IBM and the member banks (ABN AMRO, BANC ONE, Bank of America, Barnett Bank, Comerica, First Bank Systems, First Chicago NBD Fleet Financial Group, KeyCorp, Mellon Bank, Michigan National Bank, NationsBank, PNC Bank, Royal Bank of Canada and Washington Mutual). This ownership structure enables banks to play a central role in determining the manner and format in which these services are offered to their customers, ensuring that electronic banking services are consistent with the bank's full range of services, are branded by the bank, and that the bank's customers receive maximum benefit. -- Business Wire, 9/9/96 IN CHECK FRAUD WAR, SIMPLE IDEA MAKES ITS MARK In Texas, Nevada, Arizona and more than a dozen other U.S. states, bankers are fighting check fraud by equipping tellers with ink pads so they can affix the thumbprint of customers who are not regular patrons of the bank to the backs of checks they cash. Banks lose millions each year to organized crime and gang members who steal checks or duplicate payroll checks and then cash them. These crimes cost banks $815 million in 1993 alone, more than 12 times what they lost in robberies, according to American Bankers Association statistics. Said Dawn Duplantier of the Texas Bankers Association, which began selling its member banks the pads last December, "Across the board in the first six months, we have had a 70% decrease" in check fraud," she said. Bank of America, the third-largest U.S. bank, began taking prints at 43 of its branches in Nevada in 1994. Since then the bank has seen a 40% to 60% decline in check fraud, said Robert Randolph, liaison officer for the bank's investigative services division. -- Int'l Herald Tribune, 9/7/96 DAIWA SECURITIES SELLS U.S. GOVERNMENT SECURITIES OVER INTERNET Daiwa Securities America has expanded its trading room into cyberspace by allowing dealers to negotiate purchases and sales of U.S. government securities through the Internet, the worldwide computer network. The move will let clients log on to the bank's network using any Internet Service Provider and effectively close a deal online. Clients can access Daiwa's network through the bank's Web site -- located at http://www.oddlot.com -- and from t here place their buy or sell orders. To skirt the security holes, Daiwa is using several mechanisms, ranging from Internet firewalls to Secure ID cards, in an effort to prevent hackers from placing rogue or phony deals into the system. "Anybody can hook up to our Web site, but they can only get as far as our firewall. Then they have to have a Secure ID card and an account open with Daiwa," a spokesman said. The "secure IDs" are in fact small electronic cards that give the user an entrance code, which change s every 60 seconds, to a computer network. The system is now available only for financial institutions and brokerage houses interested in dealing with Daiwa. No individuals are allowed to open personal accounts and trade using the system at this point. -- Reuter, 9/6/96 BANKS SHOULD PREPARE TO CASH IN ON E-CASH According to a new study by Killen & Associates, banks can regain the leadership position in payments by leveraging their payment transaction infrastructure to support electronic cash (E-cash) services. "By 2005, E-cash transactions will escalate to almost 30 billion," stated Michael Killen, president of the market research firm. "Non-banks see this as a new opportunity to carve further market share away from the banking industry. All will compete for new revenue streams including Internet-based micropaym ents and 'by the byte electronic commerce purchasing services. E-cash, including secured credit/debit cards, stored-value cards, smart cards, ATM derivatives, and other forms, is less expensive for business than handling cash or standard credit cards and more secure than checks," Killen continued. "Opportunities will open for financial and other product and services players, including ATM vendors; ATM/POS terminal manufacturers and network suppliers, including bank-owned networks, American Express, Deluxe, ACS, and VeriFone; and cash handling/cash management services firms." -- Business Wire, 9/4/96 THE CHECK IS NOT IN THE MAIL The federal government must stop using checks by Jan. 1, 1999. Can the rest of us be far behind? A quarter-century ago digital visionaries were predicting the checkless society, and the number of checks written in the U.S. has tripled since then, to 61 billion in 1995. But one day, the predictions will come true, and that day moved closer with a little-noticed provision in April's federal budget compromise. It will force the biggest check writer of all -- the U.S. government -- to abandon paper checks almo st entirely by Jan. 1, 1999. After that, virtually all 1 billion federal payments made each year, including Social Security, must be made through electronic funds transfers. Yet, 90% of U.S. banks, and some federal agencies, aren't capable of electronically transmitting and receiving key information that accompanies vendor payments. The new law will force them all to get moving. -- Forbes, 9/9/96 --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Forwared message from Pres. of juno.com
by Rabid Wombat 17 Dec '03

17 Dec '03

Just thought I'd pass this along. I had jumped all over Juno on the list after the "talker" started, and tarred all of juno with the same brush. I was rather harsh on a company that I really don't know all that much about, except by judging a small sample of its clients. Sorry, Charles, and good luck with the grand social experiment. - r.w. ---------- Forwarded message ---------- Date: Fri, 13 Sep 1996 15:25:58 -0400 From: Charles Ardai <charles(a)staff.juno.com> To: Rabid Wombat <wombat(a)mcfeely.bsfs.org> Subject: Annoying spam incident(s) Hi. Your posting to cypherpunks was brought to my attention, and I wanted to take a minute to respond. (I also forwarded a copy of it to "postmaster(a)juno.com", where we have a (small) staff of people to deal with incidents like the one you ran into. If you run into more in the future, please e-mail the information to that address.) Since this is not directly relevant to cypherpunks, I'm replying directly to you, but you are welcome to forward this note to the list if you want. > Complaints about spamming and cross-posting probably won't get you far, > either. On-Net spamvertizing seems to be their source of revenue. Perhaps > shaw.net needs to be contacted instead. A couple of clarifications: Juno has never sent a single piece of spam and, as long as I have anything to say about it, never will. We provide a free e-mail service which is paid for by advertising, but the advertising takes the form of graphical banners built into Juno's custom interface and the ads only appear on the screens of Juno's members. We have never sent any ads by e-mail, and have never sent any online ads of any sort to anyone who was not one of our members. What's more, we expressly prohibit the use of Juno to transmit commercial solicitations in the Service Agreement that all members have to accept before they can create a Juno account. When we hear about violations, we investigate and (if it seems appropriate) take actions up to and including terminating a violator's account on our service. Needless to say, we do not read or in any way screen the mail our members send or receive, so until we hear about a spamming incident we have no way to prevent a particular piece of spam from being transmitted; but I promise you we do listen to the complaints we receive and act on them as quickly as we responsibly can. In short, we do not send spam, we do not tolerate spam, and we will not allow our service to become a home to spammers. Note that today we supply e-mail to more than 400,000 members, and over 6000 people create Juno accounts every day. At this rate of growth, we can expect to have millions of members by this time next year. The vast majority of our members use our service responsibly; it's only a fraction of a fraction of one percent who send spam. I appreciate your frustration at dealing with these abusers of our service -- and believe me, they don't frustrate you half as much as they do us -- but I ask that you not penalize the hundreds of thousands of responsible Juno members (and those users of your network who want to communicate with them) because of the actions of the handful of miscreants doing their best to give us a bad name. Juno has no more (and, alas, no less) spam-producing potential or control over the spam its members send than Netcom, AOL, CompuServe, or any other e-mail provider. (We're slightly better, perhaps, because Juno currently offers its members no tools for direct posting to newsgroups or information about mail->news gateways, and slightly worse because it is possible to get a Juno account without having to give us a credit card number.) By shutting off access to your network by our members' mail you hurt the spammers only minimally -- they'll find another address elsewhere and spam again, I'm afraid -- but may hurt Juno quite a lot. And since we're the only major provider of free e-mail in the country today, I'd hate to see the service needlessly or inappropriately hurt. (I also have personal reasons, of course, for not wanting to see Juno hurt.) I apologize for the length of this message, and if we have been unresponsive to your past complaints I apologize for that as well. If you have any questions, please don't hesitate to contact me directly. Best regards, Charles Ardai President Juno Online Services, L.P.

1 0

Re: Unsolicited email advertising already illegal in US?
by Richard Johnson 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- At 15:54 9/16/96, Ian Goldberg wrote: >This piece from RISKS looks interesting. My computer certainly _is_ > > "equipment which has the capacity to transcribe text or images > (or both) from an electronic signal received over a regular > telephone line onto paper." > >Now, are HipCrime et al. liable for $500 in damages for each piece of spam? >If so, where do I sign up? The intent of that law is to prevent the shifting of advertising costs to the unwilling recipients of junk faxes. (The $500 per message damages figure is what prompted me to raise my proofreading rates to $500 per message.) Twisting this law to apply it to junk email sent to computers with carefully selected peripherals and net connections is certainly following that anti-cost-shifting intent. Quite amazing, that, to twist a law so cruelly and at the same time follow its intent. However, which way a judge would jump on it remains to be seen. One source considers its application to junk email to be unlikely, because in essence it's too much of a twist. See: http://www.ca-probate.com/faxlaw.htm for another copy of the law, and http://techweb.cmp.com/net/issues/036issue/036law.htm for an opinion that actual application of the law to junk email is unlikely. Richard -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMj4YF/obez3wRbTBAQEHVQQAgP+35ZmOpsw1A7VsMHAONCFL4c5+xXSI 8NR9bibFZ+X+vNRSgp8KsEH2JyUk3g50ygYWx8DrzC0jhDdu902VTTN9lI92RJf5 66P5mzOCIzbfULra7wy4nSjfGR7vRTNrvY3y5fKodDvPRekkd8TcBSn/aPW/ONRa Gk/AbxKd6Cc= =qTcT -----END PGP SIGNATURE----- -- "As the most participatory form of mass speech yet developed, the Internet deserves the highest protection from governmental intrusion. ... Just as the strength of the Internet is chaos, so the strength of our liberty depends upon the chaos and cacophony of the unfettered speech the First Amendment protects." -- Judge Stewart Dalzell Unsolicited advertising/promotional email proofread for $500/message! Your sending such a message to me is an explicit request for my services!

1 0