December 2003 - cypherpunks-legacy

Data leak in Estonia
by Jüri Kaljundi 17 Dec '03

17 Dec '03

The following are some news clips from Baltic News Service about a scandal in Estonia, where some government and private databases were sold on black market on CD-ROM disks. This brings up an interesting question, who should own information like police and IRS databases, and is it illegal to copy such information once it is available. Juri Kaljundi jk(a)stallion.ee --- SECRET INFO IS SOLD ON BLACK MARKET, ESTONIAN POLICE SAY TALLINN, Nov 09, BNS - Classified information of important state institutions is available on the black market, according to Estonian security police and central criminal police officials. A database containing information on hundreds of thousands of people, collected by the Tax Department, Estonian Mobile Telephone and Radiolinja companies, the Social Affairs Ministry and several other state agencies and large companies, has hit the black market, the Eesti Paevaleht daily reported on Saturday. Supposedly, also Customs Department and national car registry databases have been secretly copied. The CD-ROM with the confidential informations costs about 50,000 kroons, according to the daily. Security Police Director General Juri Pihl and acting deputy director of the central criminal police, Andres Anvelt, confirmed that numerous institutional databases are available on the black market. Anvelt said he had happened to see a pirate copy of the buildings registry showing all transactions with buildings and their owners. "I've also heard that information on who owns which telephone number has leaked from mobile telephone companies," he added. Pihl said security police would investigate information leaks only when they concerned security police itself. Looking into database thefts is not directly the province of security police, he said. Such a secret database is a powerful weapon in the hands of organized crime, the daily said. Criminals have managed to take advantage of the insufficient protection of electronic databases and are sometimes better informed than the police, Anvelt confessed. Baltic News Service --- ESTONIAN COMMITEE CLAIMS IT HAS NO INFORMATION ON DATABASES ON BLACK MARKET TALLINN, Nov 11, BNS - Chairman of the Estonian parliament's security police committee, Vahur Glaase, said he had not enough information on allegedly illicit trafficking in classified databases. "I have too little information to draw any conclusions," chairman of the parliamentary committee controlling the activity of the Estonian security police told BNS. The Eesti Paevaleht daily Saturday claimed that a database containing information of the taxation department, the Eesti Mobiiltelefon and Radiolinja mobile telephone companies, the social affairs ministry and some other agencies and companies on hundreds of thousands of people had arrived on the Estonian black market. Presumably, the illegally copied database also contains data of the customs department and the motor vehicles registration center. Glaase said that while a large proportion of the official information is open to the public, the publication of a classified telephone number is a crime. "This seems to smack of misprision, and police must start investigating it when an application is filed," Glaase said. According to the Eesti Paevaleht report a CD-ROM with the illegal database costs about 50,000 kroons. The paper claimed that the pirated information is a powerful weapon in the hands of criminals. Security police general director Juri Pihl and central criminal police acting assistant director Andres Anvelt confirmed there was black-market traffic in many institutions' databases. Pihl said that the security police would launch an inquiry into the information leak if it also concerned the security police. He said investigation of database theft was not an immediate task of the security police. According to the criminal code, the potential punishment for destroying or manipulating with other people's electronically recorded information is punishable with a prison sentence for a term of up to one year. Baltic News Service --- ESTONIAN CABINET EXPRESSES SHOCK AT GOVERNMENT DATA LEAK TALLINN, Nov 12, BNS - The Estonian Cabinet is shocked by the appearance on the black market of government information, foreign minister and acting prime minister Siim Kallas said. "It is a complicated problem and the Cabinet is shocked by it," Kallas told reporters on Tuesday. Kallas said Interior Minister Mart Rask had known about the information leak since two months ago. "Investigation of the leak has started at the Interior Ministry and by today criminal proceedings have been taken in the first case," Kallas said. Kallas said that in the nearest future the Cabinet would adopt a decision obliging state institutions to protect the information at their disposal. "The security systems and leaking connections must be checked," he said. The acting prime minister said that it was important to establish how, by which channels and through whom the information came to the black market. Baltic News Service --- ESTONIAN POLICE QUESTION FIRST PEOPLE IN DATABASES LEAK CASE TALLINN, Nov 13, BNS - Estonian police Tuesday questioned several people in connection with criminal action brought in the databases leak case. An interview with an alleged author of the black market databases, Imre Perli, has been scheduled for Wednesday. Tallinn police deputy prefect Peeter Sults told BNS that investigators had contacted Perli by telephone and he had promised to come for an interview. "Perli is not a suspect," Sults said. "Criminal action was brought concerning the fact of the leak, not any concrete person." Sults said the perons interviewed were connected with institutions from which information had allegedly leaked out. The Tallinn criminal police brought criminal action in the classified information leak case on Tuesday. The action was taken concerning violations of regulations of government register keeping or of the use of the information contained in such registers. The punishment stipulated for this in the criminal code is a fine or a prison sentence for a term of up to two years. The press has claimed that most of the classified databases were compiled by Perli, until September an Eesti Mobiiltelefon mobile telephone company employee. He may also have compiled the motor vehicles register database by which car owners can be established. Databases containing thousands of mobile and ordinary telephone numbers, traffic offences, as well as data of the motor vehicles and companies registers are currently being offered for sale in Estonia. Such databases are of high value for organized crime. Baltic News Service

1 0

Re: pgp3
by Gary Howland 17 Dec '03

17 Dec '03

> Gary Howland wrote: > > > > > Someone suggested to me that Derek posted a draft spec for PGP 3.0. > > > Anyone know of the whereabouts of this document. > > > > Yes. That document has evolved to RFC 1991: > > > > 1991 I D. Atkins, W. Stallings, P. Zimmermann, "PGP Message Exchange > > Formats", 08/16/1996. (Pages=21) (Format=.txt) Hmm - I don't know I managed to make this post - I had started writing a reply, but exited my mailer, and for some reason it decided to send a cut down version of the unfinished mail anyway ... > Nope. This RFC is merely a rehash of the pgformat.doc file in the PGP > 2.6.? distribution. I'm doing an independent implementation of the PGP > 2.6 message formats, and found this document unclear in a few spots. For > example, can anyone else figure out the weird CFB variant mode from this > document? I used a debugger on the PGP code to help me figure it out. Exactly - I spent ages on the same thing. Then there's the problem that packet length headers must be specific lengths for various types (eg. key certificates must have a 2 byte length, even if only one is required). It is also not clear what the exported key certificates should contain, the spec simply mentioning that there should be no trust packets etc. etc. > The PGP 3.0 "spec" that you're referring to is actually a draft for a > PGP library API. A couple of those got circulated on some PGP mailing > lists, but none have been publicly released, another example of the > secrecy surrounding the whole PGP effort. > > Now that PGP Inc. is happening, it's not exactly clear whether the PGP > 3.0 release is going to include an API closely resembling these drafts. I agree with your comments. For example, we are developing PGP compatible libraries in both Perl and Java, and are going to add SHA, Blowfish, T-DES, etc., along with a better key ring format, encrypted key rings, and features such as key generation from a passphrase, and we would very much like to remain compatible with the new PGP, but how can we when there is so little information available? I think we need a forum to discuss PGP development issues - I would be happy to set one up if there was interest. Best regards, Gary -- pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

Re: Taxation Thought Experiment
by Gary Howland 17 Dec '03

17 Dec '03

> o TAXES THOUGHT EXPERIMENT > > 1) I generate $100 of productivity for my company > 2) Company is taxed %30, $70 left > 3) Company pay shareholders and costs, $30 is left > 4) Company pays me > 5) I pay 40% in taxes, so $18 left > 6) With $18 I can buy a $16.82 object (%07 sales tax). > > Results: > 1) I see $16.82 realization from $100 productivity increase. > * Govt. gets $49.26 of my productivity, or nearly 3 times the amount I get. The government gets $59.26, not $49.26 (30+16+12+1.26). That leaves you with 16.74 (not 16.82) - they get nearly four times as much. In other countries the situation may be worse, not only due to different rates of tax, but because of social security contributions, employers tax, and the like. Then if you spend your money on beer or fags, you may be paying even more tax, due to taxes on alcohol and tobacco, leaving the government with perhaps 10 times as much money as you. Many imported goods also have a tax on them (eg. motorcycle import tax is around 50% in the UK). It is probably more fun to do these calculations without involving the shareholders, since they are, after all, earning their "cut". [ Crypto relevance? Assasination taxation? ] Gary -- "Of course the US Constitution isn't perfect; but it's a lot better than what we have now." -- Unknown. pub 1024/C001D00D 1996/01/22 Gary Howland <gary(a)systemics.com> Key fingerprint = 0C FB 60 61 4D 3B 24 7D 1C 89 1D BE 1F EE 09 06

4 3

FW: Returned mail: User Unknown
by Butler, Scott 17 Dec '03

17 Dec '03

> >>The address you mailed to is no longer valid. >>This is probably because the user in question was an >>old Open Net subscriber. Open Net is NO LONGER an ISP, >>and has not been since May 1996. > >>We have no redirection address for that user. Please >>remove them from any mailing lists you might have. > >>This response was generated automatically. > Can whoever is responsible for this please........STOP IT ! Thanx ScOtT >;-D

1 0

No Subject
by Bovine Remailer 17 Dec '03

17 Dec '03

Foulmouthed Timothy May rehashes his lies like a rabid parrot choking on a stale mantra stuck in its poisonous beak.

3 2

Litt: 10/28 speech to ABA/ABA
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)tiac.net Date: Tue, 12 Nov 1996 17:46:02 -0500 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: Litt: 10/28 speech to ABA/ABA Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> < gopher://198.80.36.82:70/00s/current/news/topic/econ/96102905.lec > *96102905.LAR 10/29/96 FIGHTING ELECTRONIC MONEY LAUNDERING DEMANDS MULTI-PRONGED STRATEGY (Byliner by DAAG Robert S. Litt) (1930) By Robert S. Litt Most observers believe that widespread electronic commerce is probably inevitable. It offers us the exciting prospect of doing away with many of the costs, burdens, and problems associated with paper money. But the advent of electronic commerce presents certain challenges to law enforcement as well. One of the biggest challenges is the new opportunities for criminals to launder their dirty money. Traditionally, money launderers have deposited troublesome and bulky cash proceeds into banks or other financial institutions to obscure its criminal origins. Or they have created phony companies, or engaged in sham transactions, to hide illicit profits. These methods usually create paper trails that can be traced by law enforcement. Through education, training and the enactment of stringent laws and regulations in this regard, and through close cooperation between the Departments of Treasury and Justice, law enforcement has made great progress preventing and detecting money laundering. As a result, it is increasingly difficult for criminals to launder their money successfully. But certain types of electronic commerce systems permit virtually anonymous transactions and leave no paper trail. These systems could undo years of hard law enforcement work. Electronic commerce could allow a money launderer who wants to transfer tainted funds to do so without the risk of engaging in personal contact with a potentially suspicious bank employee. And the funds could be transferred anywhere in the world by an automated on-line banking system that could be accessed from the safety of the money launderer's home. Similarly, a bank that operates completely on-line could court the business of money launderers with little danger of prosecution. Such a virtual bank could easily be located overseas, beyond the reach of U.S. law enforcement. A recent article in the Washington Post suggests that we are already encountering offshore, on-line banks. According to the Post article, one offshore bank describes itself as the first bank on the Internet, offering the opportunity to open accounts, wire money, order credit cards or write checks by computer from anywhere in the world, around the clock. The bank's Worldwide Web page describes the benefits it offers to customers: "Since there are no government withholding or reporting requirements on accounts, the burdensome and expensive accounting requirements are reduced for you and (the bank). The bank maintains the strictest standards of banking privacy in offshore business and financial transactions. Indeed, (the bank's country) has stiff penalties for officers or staff that violate banking secrecy laws." It is not hard to imagine who will be attracted to this kind of banking. Some smart card systems go further, and would permit money launderers to obscure the origins of funds while avoiding financial institutions entirely. These systems have no central registry of transactions which would allow the transactions to be reconstructed. A sophisticated launderer, using multiple cards, could create an intricate series of transfers that could not be unraveled, and that would circumvent almost all existing money laundering laws. Internet payment systems can similarly permit multiple transactions that could be next to impossible to trace, particularly if unscrupulous merchants cooperate with the criminals. How do we respond? One big step toward eliminating money laundering and other law-breaking through electronic commerce would be to implement electronic cash technologies that track all transfers. We have received information that at least one provider of a smart card system that is already in use in Europe has modified its cards for use in the United States so that financial institutions will be able to track card usage. The system will allow them to audit for fraud, if not recreate every transaction. But a solution such as this raises a fundamental philosophical issue for our society -- striking the proper balance between anonymity and accountability. This question is being debated in many contexts as the Internet grows. Important reasons abound to allow anonymity in communications networks. Whistleblowers may want to remain anonymous to avoid retribution. Consumers may wish to obtain information on a product without ending up on hundreds of mailing lists. Rape victims may want to discuss their experiences without revealing their identities. Unfortunately, criminals also benefit from anonymity. They want to avoid getting caught. Anonymous remote communications can help them avoid detection and apprehension. And so effective law enforcement requires accountability. We must be able to hold individuals who harm others accountable for their conduct. We can find a middle ground between anonymity and accountability in the principle of confidentiality. In a confidential system, a person's identity is not generally known, but in appropriate circumstances -- for example when a court order is obtained -- the identity can be determined. Confidentiality permits us to allow anonymity in appropriate circumstances but does not permit criminals to obtain new advantages from the anonymous capabilities of the Net. This concept of confidentiality embodies the message chosen by the framers of the U.S. Constitution to limit law enforcement through the Fourth Amendment. They rejected a system under which law enforcement could have unfettered access to citizens' papers; but equally they rejected a system where those papers could be immune from scrutiny under any circumstances. Rather, they provided for access to a person's documents under appropriate judicial supervision, forbidding unreasonable searches and seizures and requiring warrants and subpoenas. The same kind of balancing, an approach that protects both anonymity and accountability, should govern our approach to electronic cash. Those are some of the challenges we will face. The Department of Justice has been taking some steps to help us prepare for these challenges, drawing on the expertise we have had in dealing with other computer crimes such as hacking. The first lesson that we have learned is the need for extensive training. To fight computer crime, agents and prosecutors must understand computer and telecommunications technology, and be dedicated full time to this complex area of law. The FBI has now created three computer crime squads, in Washington, San Francisco and New York City. The Secret Service also has agents trained to deal with electronic crimes against financial institutions. The expertise of these agents will be a crucial asset in fighting abuses of electronic commerce. Successful investigation of high-technology crime also requires the participation of technically literate prosecutors. In 1991, the Criminal Division of the Department of Justice created what is now the Computer Crime and Intellectual Property Section, which we have recently doubled in size. And we have set up, with the cooperation and support of our U.S. attorneys nationwide, a network of prosecutors who have been specially trained to serve as Computer and Telecommunications Coordinators. These "CTCs," as they are known, presently serve as resident experts on computer crime issues. But to be successful in combating money laundering or any other form of electronic crime, an international response is absolutely necessary. Many of the crimes of the future will not be hampered by international boundaries, because electronic funds need not be physically transferred; they can be instantaneously and covertly shipped via telephone and data networks. Because computer criminals often are not in the same country as the electronic funds that they are stealing, passports and other existing international controls are of limited use in identifying and apprehending them. Thus, a concerted international effort will be necessary to ensure that electronic commerce criminals cannot take advantage of weak laws in one country to commit crimes with impunity in the United States. We are making great progress in this effort. We have already had several instances of international cooperation leading to the arrest of overseas hackers who have broken into U.S. computers, and we are working in a number of international forums to institutionalize that cooperation and to seek coherent rules and policies that will enable us to prevent abuses of electronic commerce. In addition to working with other governments, we will have to work with industry. The issue of encryption is particularly prominent now. Without strong encryption, successful electronic commerce is probably a fantasy. But encryption that is too strong -- that cannot be broken when appropriate -- risks terrible and irrevocable damage to law enforcement capabilities that are critical to our ability to protect us all. Our goal is to encourage the use of strong encryption to protect privacy and commerce, but in a way that preserves law enforcement's ability to protect public safety. We're not looking to expand what we can do now, just to preserve this ability against the threat of unbreakable encryption. Our goal is confidentiality -- protecting the privacy of individual communications while preserving our present ability under the law to obtain this information when we need it. Similarly, in electronic commerce, we want to work with industry to ensure that the needs of law enforcement are met without either stifling the development of a vibrant new technology or compromising individual rights. We believe that the electronic commerce industry should incorporate certain features into the designs of their smart cards systems, features that we consider necessary to avoid abuses in this area. We don't want to dictate how these features are designed, but there are certain reasonable elements that industry should build into its systems. First, a transaction using a digital purchasing system should generate and safely store records similar to those of credit cards whenever a cardholder makes a purchase or transfer that exceeds a designated size. In this regard, we must again emphasize that we are not seeking to give government any new authority, merely to ensure that we can get information when we are authorized to do so. Second, electronic commerce systems should be designed to maintain sensible limits on the amount of value that may be stored or transferred on a single smart card or personal computer. Few people carry tens of thousands of dollars in cash on their persons; permitting "smart cards" of such value would greatly increase the opportunities for fraud. Finally, and for obvious reasons, we must encourage the major smart card system providers to use responsible financial entities as the primary outlets for their cards. Our last challenge is to update laws that might otherwise become outdated. At present it is not clear whether our existing laws are adequate to deter and punish electronic commerce abuses. Since Congress did not and could not have foreseen the current electronic commerce revolution, law enforcement authorities must be prepared, at least at first, to combat these abuses through existing criminal statutes that are not perfectly adapted to the problem. We do not want to create new laws for their own sake, and certainly not without understanding the effects that they would have on a vibrant new industry. On the other hand, if we find that the law enforcement problems presented by electronic commerce are outstripping our ability to deal with them, changes in our legal structure may be required. The challenges faced by law enforcement in electronic commerce will be enormous. We have already begun to prepare for some of these challenges, but we realize that we have much more to do. With training, technological understanding, international cooperation, diligent law enforcement, and the cooperation of industry, we will meet these challenges. (Mr. Litt, a deputy assistant attorney general, is President Clinton's nominee to head the Justice Department's Criminal Division. The article was adapted from his Oct. 28 speech to the American Bar Association and the American Bankers Association in Washington. It is in the public domain and may be reprinted without permission.) NNNN ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

"Perceptions and Misperceptions of Privacy on the Net"
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)tiac.net Date: Tue, 12 Nov 1996 19:59:39 -0500 To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> From: The Old Bear <oldbear(a)arctos.com> Subject: "Perceptions and Misperceptions of Privacy on the Net" Mime-Version: 1.0 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> The George Washington University School of Engineering and Applied Science Cyberspace Policy Institute FREE AND OPEN TO THE PUBLIC Tuesday, November 19, 1996 4-6 p.m. Room 410 Marvin Center, 21st & H St. NW, Washington, DC "PERCEPTIONS AND MISPERCEPTIONS OF PRIVACY ON THE NET" Speaker: Steven Emmert, Corporate Counsel for Lexis-Nexis Commentators: William W. Burrington, Assistant General Counsel, America Online Deidre Mulligan, Staff Counsel, Center for Democracy and Technology Privacy norms, regulations, and laws have been developed over the years, in balance with norms, regulations and laws governing access to government information and open meetings. The advent of widespread Internet use has called into question some previously unchallenged uses of information, reopened discussion on some problems once thought resolved, and raised new questions which have never been addressed. In addition to the commercial players involved, individuals, in greater numbers than at any time in the past, have joined these discussions about the proper uses of information. LEXIS-NEXIS recently experienced this increased individual participation first hand following the release of a commercial product, P-TRAK. This product, which makes limited information about individuals available to LEXIS-NEXIS' subscribers (typically law firms, Fortune 1000 corporations, and government agencies including federal law enforcement agencies) became the centerpiece of an Internet controversy about privacy. Information and misinformation about P-TRAK was widely disseminated on the Internet (and still is) and in the mainstream media. In response to this controversy, the Congress directed the Board of Governors of the Federal Reserve System, in consultation with the Federal Trade Commission, to conduct a study of whether organizations which are not subject to the Fair Credit Reporting Act are engaged in the business of making sensitive consumer identification information available to the general public. Senators Bryan, Pressler, and Hollings have requested "that the FTC conduct a study of possible violations of consumer privacy rights by companies that operate computer data bases." As these studies proceed it will be important for all concerned -- corporations, individuals, the government, law enforcement and others-- to ensure they fully understand the issues and policies involved in order to strike the proper balance between the legitimate information needs of businesses, professionals, individuals, the press, the public, government and law enforcement, and an individual's right to privacy. Lessons learned from this experience will be shared. The policy and legal issues raised will be identified. Implications for the future of the Internet and for electronic commerce in information will be discussed. Additional information on this and other seminars is available at www.cpi.seas.gwu.edu/Activities/Seminars/96-97.html ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

RE: Taxation Thought Experiment
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

>azur(a)netcom.com (Steve Schear) wrote: >>The crypto-relevance is via crypto anarchy: we need to undermine the tax >>system enough that _everyone_, not just us, loses faith in it. >> >>--Tim May >> > >I've posed similar questions to friends and aquaintences. The >working-class stiffs (who can't easily hide from the IRS) feel taxes are an >unwelcome but necessary burden in order to provide the blanket of >government protection they feel exists. They resent and oppose widespread >tax fraud. Self-employed tend to be more open to 'alternative' income >structuring. And in the meantime, it would seem prudent to use the existing system to maximum advantage. In Canada, you can set up a personal trust called a Registered Retirement Savings Plan (similar to an IRA?) wherein you can trade securities without tax liability until you withdraw the money into your hands. As long as you aren't trying to spend it, no taxes are owing. There is a withholding tax of 25% if you eventually leave the country, but the tax free compounding effect over a decade or two will make this virtually irrelevant. There are also tax credits for venture capital (especially if it relates to R&D) or scientific research investments. Since we are in fields that likely are related to this type of work, it seems that we would be able to take advantage of these types of credit. In Canada, they can pay 80-90% of the related payroll. Add NRC (National Research Council) grants available for R&D projects and you can run a company with a dozen people for NO money. This is not fantasy since I know at least two companies that do this. The only caveat is that you need a good idea to start with. It is also not hard to have a nominal 50+% marginal tax rate yet pay 15% net income taxes. Since I can use the Canadian tax system to advantage, I'm not sure that I want to get rid of it just yet. So, while you are waiting for that anarchy, you may want to retain a good tax accountant. Ciao, James The grass is always greener over the septic tank.

1 0

RE: Remailer Abuse Solutions
by Mullen Patrick 17 Dec '03

17 Dec '03

Sounds like another attempt to raise the cost of using the Net, nothing more. Sure, paying postage (Is $1 really necessary? Why email when snailmail's cheaper??) may reduce general spamming done by local punks, but it does nothing against corporations which already spend millions on snailmail spamming. Also, what happens when your long-lost friend comes across your addy and tries to email you? Surely you don't want to charge postage for an otherwise free service to him/er. Maintaining a list of "accepted sources" would be a hassle not many people would accept. Slight variation is to generate a list of "toll these entities." A smaller list (hopefully :-), and generally easier because then it defaults to no-bill. Or, to accomodate superstars/actors/etc, generate files like rhosts.accept rhosts.deny in UNIX. That way, the user may use either/both types of filtering. Again, the average user wouldn't want to deal with this hassle, everyone's mail software would have to be rewritten, and I basically oppose any ideas that cost me money for something I already get for free... :-) PM _______________________________________________________________________________ From: Peter Hendrickson on Wed, Nov 13, 1996 4:10 Subject: Remailer Abuse Solutions To: cypherpunks(a)toad.com What do you do if you are operating a remailer and somebody complains they are getting spammed? That's easy, you keep a list of people that you don't send mail to. What's hard is if that person wants to receive other anonymous mail. The solution is easy: charge e-cash to send mail to certain addresses and send the money to the owner of the account. Never put an address on a kill list, just raise the price of sending mail to it. This generates lots of positive publicity for your remailer. People will beg to be spammed! And, since the remailer operator handles the financial parts of the deal, the technically naive "victim" does not have to have specialized knowledge or even an e-cash account. This also eliminates the spam problem generally. If you are plagued by spam, create a list of names you will accept mail from. When a message comes in that is not on the list, return a message directing them to send you the mail through a paying remailer. This solves a problem for famous people, too. They get lots of mail but they don't have time to read it all. How to sort it? Raise the price of sending a message. (I heard that Arnold Schwarzeneggar was once paid $1 million just to read a script and look at the set of a movie with no obligation to act in it.) Okay, now lets go to mailing lists. We like to read anonymous mail on this list, but we don't like getting spammed. It's hard to filter anonymous mail for obvious reasons. The solution: don't accept anonymous mail. Only people on the "approved" list would be allowed to post. People who wish to post anonymously could then send mail through the paying remailer to people on the "approved" list and request that their message be relayed. Most people on the list would be happy to accept a dollar or two to provide this service. This would eliminate inappropriate mail while allowing anybody to post. For that matter, postings to the list itself could be priced at, say, a dollar to cut down on the noise levels. Payments, and addresses which complicate payment, make it harder to rely on the remailer network. When you send a message through a few remailers and make a faux pax on the last one, you won't know what happened. Did one of the remailers go down? Did you make a mistake? I think I know a solution to this one, too. If somebody wants to get error messages, they include a random 128 bit number with their message. This is a different number for each remailer in the chain. When an error occurs, the remailer distributes an error message with the number attached. Error message distribution is pretty easy. The remailer operator could publish a web page with the errors. Or, the messages could be bundled and made available through anonymous ftp, or mailed to an error message mailing list, or posted to a newsgroup. Peter Hendrickson ph(a)netcom.com ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;13 Nov 1996 04:10:17 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Wed, 13 Nov 1996 9:06:01 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id RAA13602 for cypherpunks-outgoing; Tue, 12 Nov 1996 17:07:45 -0800 (PST) Received: from netcom19.netcom.com (root(a)netcom19.netcom.com [192.100.81.132]) by toad.com (8.7.5/8.7.3) with SMTP id RAA13594 for <cypherpunks(a)toad.com>; Tue, 12 Nov 1996 17:07:36 -0800 (PST) Received: from [192.0.2.1] (ph(a)netcom21.netcom.com [192.100.81.135]) by netcom19.netcom.com (8.6.13/Netcom) id RAA03014; Tue, 12 Nov 1996 17:07:31 -0800 X-Sender: ph(a)netcom15.netcom.com Message-Id: <v02140b04aeaec9f1fa9b(a)[192.0.2.1]> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Date: Tue, 12 Nov 1996 17:07:41 -0800 To: cypherpunks(a)toad.com From: ph(a)netcom.com (Peter Hendrickson) Subject: Remailer Abuse Solutions Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0

PGP3.0 & ElGamal
by Bert-Jaap Koops 17 Dec '03

17 Dec '03

On Fri, 25 Oct 1996 00:32:52 +0100, Adam Back wrote: [snip] > Also I understand, though there appears to be no available > documentation saying as much, that pgp3.0 will not use RSA, nor IDEA, > nor MD5, using instead El Gamal for public key encryption and > signatures, 3DES (unsure?), and SHA1. Can someone confirm that PGP3.0 will use ElGamal? Bert-Jaap

8 10