December 2003 - cypherpunks-legacy

[NOISE] Interesting datum.
by roy＠sendai.scytale.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- The Prez was in Minneapolis today, so all the TV stations have to act as though it were a big deal. In the wrapup coverage of the non-event, a WCCO talkinghead trotted out another non-story of a security breach at MSP, where someone is thought to have slipped by security. The talkinghead gave complete and clear instructions on how to accomplish this in the process of "reporting" the incident. If I find it "reported" on their website, can I blame the net? - -- Roy M. Silvernail [ ] roy(a)scytale.com DNRC Minister Plenipotentiary of All Things Confusing, Software Division PGP Public Key fingerprint = 31 86 EC B9 DB 76 A7 54 13 0B 6A 6B CC 09 18 B6 Key available from pubkey(a)scytale.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMnVLYBvikii9febJAQHlkAP7BWeaJEkmOLJr+OT+qLPuxm1bvUwxhPRJ UU2TkfHs+VYoFwT0jvx6tz3Flli4UZ7Pi9WcXsN4HXkVMXXVggDC5g4Ce6RqHDvI M0REcSbKoQXOc9/dfaTvWrfoy8rIx5TjycF1tkdkECtKfJ1ntavdsVqNwelpPdqo qa8qa0xgxX4= =X85R -----END PGP SIGNATURE-----

1 0

Re: When did Mondex ever claim to be anonymous?
by L. Patrick Elam, III 17 Dec '03

17 Dec '03

You have claimed many flaws with the Modex system and there are even more you have not mentioned. I won't go into that here, except one. When the hardward fails how do you purchase, enter, or exercise your rights of purchase or entry? Privacy, there is none with a system like the Modex. A trial was held in Atlanta during the Olympics and it was a total disaster. The system worked half the time. People had money they could not spend. But, believe me the system is coming and the world doesn't need another avenue of access to personal data and private issues. Bring on the encryption and encrypt every thing. Pat Elam At 01:31 PM 10/28/96 +0000, you wrote: >I'm a student at Exeter University in England. If you are researching >Mondex, I am sure you are aware that we are currently undergoing a >world-wide Modex trial. > >The National Westminster Bank have teamed up with the University to >provide every student with an "Intelligent Student Card" to replace our >old Student ID. > >The new card has an electronic chip which can store a variety of >information on it. We are not sure of exactly what it holds, but it can >store "cash" - placed onto it from specific points around campus, or any >Nat West Cash Point machine, or even using any phone box (Yep, the bank >have also teamed up with the phone company (BT) in order to get the >thing working). > >The card can be used to pay for almost everything around campus. Even >in the student pubs and bars. The Uni are offering cheaper drinks for >those who pay by Mondex. It is a wierd sight to watch people handing >over their student cards to pay for a pint! > >I can give you as much information on the system as I can get hold of if >you want it. > >As far as privacy is concerned, The claim that Modex is as private as >cash is plainly incorrect. Both the card chip and the card reader store >details of the transaction. The student can use a phone box, card >reader or Nat West Bank Cash Machine to get details of the last ten >transactions stored on the card. > >As for the Bank, they get details on the item the student has purchased, >purchase location (the building and exact 'Mondex point' in the bar/shop >where the transaction took place), the exact time and date the >transaction was carried out, together with (obviously) the name and ID >of the purchaser, etc. > >Should the police require the information for Criminal purposes, then (I >am almost certain) the Bank/University would be obliged by law to hand >over the information. Where's the similar "privacy" for cash >transactions? > >As far as the card is concerned, we need it to enter all of our student >facilities. Without the card, you can't play sports in the sports hall, >or get into many Univerity social events. I think we will even be able >to use the card to electronically vote. (The implications of this are >obvious - will the hierarchy know your poitical standing in >elections???) > >It's funny, I never realised how much information they have on me, until >I've just sat down and thought about it. > >If you want any more details, just send us an Email. > > > Rob. > > > > > >_____________________________________________________________________ > > cs94rjb(a)dcs.ex.ac.uk Rob Blakemore, Exeter University. >_____________________________________________________________________ > -----BEGIN PGP SIGNED MESSAGE----- ------------------------------------------------------- Patrick Elam patelam3(a)atl.mindspring.com Engineering at its finest! http://www.mindspring.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfwmggBXLW8oj+lZAQHCiwP+La/CLNY/yRvrH8TZQdvTxHK7Dgf0e1Dp j1xsa0h4VoWXrM4v5LYHbjyFYcpJGpOY7s6yIl1vFj2HGaix6DTv222/dHleMZZp lUJtAoJAW7AmbwA51skDc5EZZ0oSBh2BRXUfuAEzicm709SmKUKn0oH0vtKoS4Z2 xaGZ7952BX8= =MM2Y -----END PGP SIGNATURE-----

1 0

Re: Lawyers, companies to create Internet legal group
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

This is a great example of why we need organized people like Greg to help express an alternative viewpoint. As Greg and myself, and the other lawyers on this list know, there are often multiple sides to any legal argument. To have this be the only voice regarding Law and the Net would be a bad idea. I do favor its general intent - to take the formation of policy out of the legislative venue. I do not think the major interests listed will have my interests at heart. Mom and Pop ISPs, Web Consultants, the HTML Guild, the ideas of GPL may not even be in the consciousness of some of the larger organizations (I remain to keep my hope out for Netscape). I would like to propose a professional response to this organization in the form of a Law Review type of organization. I know there are enough lawyers on the list to set this into motion. I would like to know what kind of interest there would be before I put the great deal of effort it would take into such a project. Let me know. Matt

1 0

Dimacs workshop on network threats?
by Adam Shostack 17 Dec '03

17 Dec '03

Anyone else planning to go to the DIMACS workshop on network threats? December 4-6 at Rutgers. http://dimacs.rutgers.edu/Workshops/Threats/index.html Seems like its shaping up to be a fun workshop. Adam -- "Every year the Republicans campaign like Libertarians, and then go to Wasthington and spend like Democrats." Vote Harry Browne for President. http://www.harrybrowne96.org

2 1

German Draft Digital Sigature Law
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 29 Oct 1996 02:06:50 EST Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Christopher Kuner <100442.3075(a)COMPUSERVE.COM> Subject: German Draft Digital Sigature Law To: CYBERIA-L(a)LISTSERV.AOL.COM For your information, my translation of the German Draft Digital Signature law is now available on my homepage "Law of Electronic and Internet Commerce in Germany" (http://ourworld.compuserve.com/homepages/ckuner) Christopher Kuner, Esq. Gleiss & Partners Gaertnerweg 2 60322 Frankfurt, Germany tel. 49-69-955140 fax 49-69-95514198 e-mail 100442.3075(a)compuserve.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Nations Bank Visa scam/error
by Brad Dolan 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- This may be off topic or then again it may not be. A friend paid his balance and cancelled his Nations Bank Visa card about 6 months ago. A couple of days ago, he received a bill from Nations Bank for a *recent* charge, which the indicated vendor denies submitting. My friend has been trying for two days to get through to Nations Bank on its customer service line, to no avail. He keeps getting a "due to heavy calling volume our queue is full" message. Anybody know who screwed up how? bd -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMmT3y680j2q8tTgtAQGC7wQA2ris5C3KAD6qLy3AmtglJRoZrei72CIH MEm7DGasD4AXqfwkjdmvZScAVXRD+KHHgVZQKQp+H0+D/TWHZCN9nrwE1z5/j73R o8qXDCC0owwJabZHknOMwpBm4Sf6JUGs7Wm1K9JmpVlF01GP+z7rxOMXfvZrlxvy mwcK3wjIPCU= =PTmz -----END PGP SIGNATURE-----

3 2

[Fwd: Re: Looking for Cryptographic Expert who Knows SSL]
by jch＠vdsi.com 17 Dec '03

17 Dec '03

1 0

Japan tightens crypto export restrictions, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

The Netly News http://www.netlynews.com/ October 29, 1996 The Japan Factor By Declan McCullagh (declan(a)well.com) In a move designed to stem the global availability of products that use strong encryption technology, Japan last month succumbed to U.S. pressure and dramatically tightened its export restrictions, The Netly News has learned. The restrictions amount to a stranglehold. Officials from Japan's Ministry of International Trade and Industry (MITI) characterize the shift as a very small change, but the new rules require businesses to seek prior government approval for any overseas crypto-order that totals more than 50,000 yen, or about $450. The previous limit was 10 million yen, around $91,000. "We made a very small change of the licensing exception of limited value," says Jun Takashina, the deputy director of the Security Export Control Division at MITI. Takashina denied that the U.S. pressured Japan. "It's our decision. We didn't have any pressure from the United States." Japan says its regulations are designed to codify the "Wassenaar Arrangement" on export controls for armaments and advanced technology, which was crafted over a two-year period to replace the Cold War-era COCOM treaty and was signed in July by over 30 countries. "In the Wassenaar Arrangement, we have consensus to cooperate -- not coordinate, but cooperate," Takashina said. "In this sense we influence each other. We cooperate in our regulations to achieve the same purpose." In implementing the agreement, Japan relaxed controls on many products -- and, tellingly, only tightened the regulation of encryption. However, other countries that signed the agreement have not done the same. Japan's move follows a hot summer of even hotter debate on Capitol Hill, where Justice Department officials claimed that criminals use PGP to scramble files and software company executives testified that current regs cost U.S. industry millions. Boosting the political temperature further was RSA Data Security's announcement in June that NTT and RSA's Japanese affiliate were ready to ship a triple-DES chip more secure than anything U.S. manufacturers are permitted to sell overseas. Privacy advocates quickly heralded it as exposing the fatal flaws in the Clinton administration's regulations. Phil Zimmermann, inventor of PGP, told me at the time that "the Japanese took over the American television manufacturing industry" and are poised to take over this one unless Congress approves the Pro-CODE bill. This widely-publicized announcement almost certainly prompted Japan's new crypto-muzzling decision. The company's president, Jim Bidzos, says that Tokyo has started to "look a little closer" at its encryption policies. "With all the press about NTT chips and whatnot in Japan, the U.S. government is going to try to stem the flow." (One White House scheme designed to do just that is the soon-to-be-announced creation of an ambassador-level position whose sole job will be to marshal international support for U.S. crypto policy.) Stewart Baker, former NSA general counsel, calls Japan's move a sign that the country's leaders are awakening to -- and are sensitive to -- the U.S. government's position. "This is a signal that they did not want to be at the center of the policy debate over export controls if they could avoid it," he says. "As [the policy] gets covered in the New York Times on the front page, the Japanese government focuses more attention.... This is a reflection of concern that that kind of story is not good for Japan," says Baker, who recently wrote about Japan's stance on encryption in Wired. The key question, though, is how strictly will Japan enforce the new regulations? The Wassenaar Arrangement is designed to keep arms and technology out of the hands of rogue countries, but companies in Silicon Valley already are complaining that Japanese shipments of data-scrambling hardware are being delayed. And the fine print of the new Japanese regs seems to require the end user's name and address -- which is impossible for U.S. distributors to provide. I think Marc Rotenberg, director of the Electronic Privacy Information Center and international crypto-watcher, has it right. Today he said to me that U.S. crypto isn't our biggest export in this area; instead, it's U.S. crypto policy. I agree -- and I say that's where we need more government intervention. Any government employee or erstwhile crypto-czar who wants to export a dumb crypto policy should be required to say why it should be allowed to infect other countries. I'm sure Japan won't mind. -- By Declan McCullagh (declan(a)well.com) with reporting by K. N. Cukier (100736.3602(a)compuserve.com) Wassenaar Arrangement: http://www.dfat.gov.au/dfat/dept/isd/peace_and_disarmament/pd_4_96/pd10.html RSA announces NTT chip: http://www.eff.org/pub/Publications/Declan_McCullagh/cwd.got.away.0696.arti… U.S. to create crypto-ambassador: http://www.netizen.com/netizen/96/43/index3a.html Stewart Baker on Japan's crypto-politics: http://www.hotwired.com/wired/4.09/es.crypto.html Marc Rotenberg on OECD crypto-politics: http://www2.eff.org/~declan/global/japan/rotenberg.reply.102896 ###

1 0

Anyone going to "Computers & The Law III"?
by Alex Newman 17 Dec '03

17 Dec '03

Hi all, I'm Alex Newman, on of the conference organizers for "Computers & The Law III", Dec 1-4, 1996 in San Jose, CA. The theme this year is "Assessing the Internet Threat". I was wondering if there was anyone in the San Francisco/Silicon Valley area who was going to be there who wanted to sit on a panel about the CDA. Drop me a line if your interested. If you just want more information about the conference, take a look at www.sug.org/CL3 or send mail to conference(a)sug.org --a Alexander Newman Sun User Group troll(a)sug.org 1330 Beacon St., Remember, to die with honor (617) 232-0514 voice Suite #344 ...you still have to die. (617) 232-1347 fax Brookline, MA 02146

1 0

Rumours of NSA breakin
by hallam＠ai.mit.edu 17 Dec '03

17 Dec '03

Hi, I've been hearing rumours of an alledged compromise of the NSA Web server but no hard evidence. The claim made is that several Mb of files were downloaded from the server and posted to the "Internet". I can't see it in sci.crypt or alt.conspiracy though. I am more than a little skeptical of the claim, unless the files in question were not considered sensitive - and there is no reason to believe that the NSA would be keeing anything secret on their Web server. Banks do not keep money stuffed under mattresses and the NSA does not keep secrets on Internet servers. The origin of the rumour may be an "observation" that the DOJ hack was on the 19th August, the CIA one on the 19th of September. It is no secret that several sites were watching out for attacks on the 19th October. Has anyone heard anything more than a rumour of this alledged event? Phill

3 2