December 2003 - cypherpunks-legacy

SPA Press Release on ISP suits (fwd)
by David Lesher 17 Dec '03

17 Dec '03

Michael Dodson sez: In CYBERIA-L(a)LISTSERV.AOL.COM The formatting may be a bit rough. I am not a pro at this. FOR IMMEDIATE RELEASE ((edited)) Contact: David Phelps, (202) 452-1600, ext. 320, dphelps(a)spa.org SPA Files Copyright Suits Against ISPs and End Users Internet Anti-Piracy Campaign Launched (Oct.10, 1996 --Washington, D.C.) -- The Software Publishers Association (SPA) announced today that it has filed five civil lawsuits for copyright infringement occurring on the Internet. Three of the lawsuits were filed against Internet service providers (ISPs), and the remaining two were filed against individual end users. Additionally, SPA launched its Internet Anti-Piracy Campaign, which includes education and enforcement components, in an effort to educate and work cooperatively with ISPs regarding copyright infringement. ISP lawsuits were filed on Oct. 7 and 8 against Community ConneXion of ................................................^^^^^^^^^^^^^^^^^^^ Oakland, Calif.; GeoCities of Beverly Hills, Calif.; and Tripod Inc. of Williamstown, Mass. The SPA members named as plaintiffs in all three suits were Adobe Systems Inc., Claris Corp. and Traveling Software Inc. In each case, SPA first contacted the ISP and requested that the infringing material be removed, but the ISP failed to respond and cooperate. {.....} ((end of edited release)) See http://www.computerworld.com/news/news_articles/961010spa.html for early reactions. Michael Dodson dodsonm(a)wane-leon-mail.scri.fsu.edu -- A host is a host from coast to coast.................wb8foz(a)nrk.com & no one will talk to a host that's close........[v].(301) 56-LINUX Unless the host (that isn't close).........................pob 1433 is busy, hung or dead....................................20915-1433

1 0

[NEWS] Crypto-relevant wire clippings
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

It seems that this batch didn't make it to the list, so I'm trying again... News Release (Netscape): Monday, October 7, 1996 Netscape to Use CyberCash Technology Netscape Communications Corporation (NASDAQ: NSCP) and CyberCash, Inc. (NASDAQ: CYCH) today announced a technology and marketing relationship to broaden payment options for Internet consumers. As part of the agreement, CyberCash has licensed its CyberCoin Internet payment technology to Netscape. Netscape will bundle its technology into future versions of Netscape products, including Netscape LivePayment server software for online payment processing. The two companies will also collaborate on including future CyberCash payment services, such as CyberCash's electronic check services, into future Netscape commerce offerings. Netscape and CyberCash plan to jointly market these Internet payment solutions to consumers and businesses, and will work together on efforts to accelerate the deployment of Secure Electronic Transactions (SET) credit card payment protocol in the marketplace. "We have had customer demand for small value payment technology particularly from the professional information publishing industry -- the integration of CyberCash's CyberCoin with Netscape's commerce solutions provides our customers with a way to complete small transactions over the Internet," said Srivats Sampath, vice president of marketing for server, tools and applications at Netscape. "By offering a range of payment options for businesses and consumers, Netscape and CyberCash will help expand the range of goods and services available in the electronic marketplace." "Combined with Netscape's customer base, CyberCoin is filling a need in the marketplace for small payment processing," said Denis Yaro, executive vice president, products and operations at CyberCash. "This is a huge step in our efforts to bring Internet transaction technology to consumers and businesses and to increase online inventory, making the virtual mall a reality." "We are pleased to see this agreement between Netscape and CyberCash," said Chuck White, senior vice president of First Data Card Services Group's Electronic Funds Services unit. "The relationship between Netscape and CyberCash will make it easier to deliver integrated payment solutions to our client financial institutions, and their merchant customers that are using Netscape LivePayment." CyberCoin is a payment service which permits online purchases for items costing between 25 cents and $10.00. This new payment solution opens up significant opportunities for merchants to market low cost, high value items such as news and information, graphics, games and music. It also allows merchants to unbundle larger product offerings, and sell them in smaller increments. Financial institutions to offer the CyberCoin service include First Union Bank, First USA Paymentech, Michigan National Bank and First Data Corp. Bundling CyberCash's CyberCoin technology into future releases of Netscape's LivePayment point-of-sale software will enable online businesses to accept multiple payment methods and implement new pricing and business models. Netscape LivePayment will integrate this new payment functionality seamlessly and cost-effectively, providing business people with administration and configuration controls with flexible logging reports, and a variety of sample merchant applications to minimize the start-up development costs of merchants. Both Netscape and CyberCash will market Netscape LivePayment software to businesses looking to develop or expand online distribution channels. Netscape plans to integrate CyberCoin into future versions of Netscape Navigator client software, which includes technology that streamlines consumers' shopping experience by providing a uniform interface for Internet purchases and transactions. Similar to a real wallet, this technology will organize into one place a user's credit card numbers, shipping addresses, digital IDs, electronic receipts and other payment instruments needed to purchase goods and services on the Internet. Netscape and CyberCash will coordinate their efforts on SET to assure interoperability between their credit card-related electronic commerce implementations. Netscape was one of the principal architects of the SET specifications proposed by Visa International and MasterCard International. Committed to being among the first to deliver SET-compliant products to the marketplace, both Netscape and CyberCash will also collaborate with other important industry leaders in an effort to facilitate SET's arrival in the shortest possible timeframe. About Netscape Netscape Communications Corporation (NASDAQ: NSCP) is a leading provider of open software for linking people and information over enterprise networks and the Internet. The company offers a full line of clients, servers, development tools and commercial applications to create a complete platform for next-generation, live online applications. Netscape Communications Corporation is based in Mountain View, California. About CyberCash CyberCash, Inc., (NASDAQ: CYCH), of Reston, Virginia, founded in August 1994, is a leading developer of software and service solutions for secure financial transactions over the Internet. The CyberCash system is designed to allow banks to offer secure Internet payments to their customers. CyberCash works with virtually all financial processing institutions, and is currently working with VISA and MasterCard to develop and implement the Secure Electronic Transaction (SET) protocol for online credit card transactions. The company's initial service, which handles payments using major credit cards, was introduced in April 1995. CyberCoin, the company's innovative micropayment service that enables cash transactions, was launched on Sept. 30, 1996. CyberCash's electronic check service is expected to be released in Q4, 1996. Edge: Tuesday, October 8, 1996 VeriFone Introduces Personal ATM and VeriSmart VeriFone, Inc., Monday announced plans to bring the convenience of a bank automatic teller machine into the homes of millions of consumers around the world, enabling them to replace cash and access dozens of personal services anytime, anywhere, using telephones, televisions, personal computers and other low-cost devices and information appliances.Announced Monday at the ABA Bank Card Conference, VeriFone unveiled plans to introduce a low-cost, palm-sized, smart card reader/writer called the Personal ATM (P-ATM). The P-ATM will connect to any standard telephone line, allowing consumers to interact with their bank account to download cash,' securely and conveniently in the privacy of the home or office. In addition, leveraging VeriFone's leadership in Internet commerce, the P-ATM will also interface with the VeriFone vWallet, and any stored-value card scheme, enabling consumers to make purchases over the Internet, download funds from their bank onto their smart card, transfer funds between accounts, and perform on-line transactions between consumers and merchants. VeriFone also revealed the development of the VeriSmart System architecture, which is expected to accelerate consumer adoption of smart card applications. The VeriSmart System will integrate a low-cost personal ATM device, a powerful set of software applications that lets consumers securely interact with any provider offering smart card services, and a comprehensive package of support services. Applications might include the ability to download electronic cash from their bank, instantly receive rewards from loyalty programs, or provide selected healthcare information to their doctor or pharmacist. Six leading technology companies -- CIDCO, Gemplus, Key Tronic, Mondex International, Scientific Atlanta and WebTV Networks, Inc. -- have announced their support for VeriSmart and plan to work with VeriFone to develop further technologies around the system. "We are taking an aggressive role in developing the infrastructure for smart card applications with our plans to introduce the Personal ATM and the VeriSmart System," said Hatim Tyabji, chairman, president and CEO of VeriFone. "VeriSmart will be the first technology that is card-scheme and hardware-device independent, uniting all the elements in a truly end-to-end solution. We plan to actively layer VeriSmart technology into our merchant point-of-sale terminals and Omnihost client-server systems, to create solutions that bridge all VeriFone markets worldwide. This action unveils the third element in our three pronged strategy -- traditional debit/credit business, Internet commerce and now consumer smart card technologies -- expanding VeriFone's leadership in secure payments technologies worldwide." In addition, American Express, GTE, Hewlett-Packard Company, MasterCard, NIPSCO Industries, Inc., Sparbanken Bank (BABS), Sears Payment Systems (SPS), and Wells Fargo have all announced support of the VeriSmart System. The VeriSmart System is being designed to electronically link consumers to their banks, telephone and utility companies, retail merchants and other personal services. Using any one of a variety of smart card-ready devices, such as the Personal ATM, telephone, PC, or set-top-box, a consumer will access numerous personal services and interact with multiple stored-value card schemes, loyalty programs, identification, and health care information. The VeriSmart System will provide end-to-end security for all communications between the access device and the smart card applications on the VeriSmart server, ensuring data integrity of financial transactions and other confidential information. "This is the beginning of a new era for smart card applications," said Tom Kilcoyne, general manager of VeriFone's Consumer Systems Division. "The industry has been waiting for a compelling, cost-effective solution that enables financial institutions, and a broad range of consumer service providers, to move aggressively to build smart card applications. Endorsement in the consumer market from these respected companies, combined with VeriFone's global leadership position and expertise in the secure payment transaction market, supports our belief in VeriSmart as a powerful system that can accelerate development of the market for smart cards worldwide." Wide Industry Support VeriFone's Consumer Systems Division's effort to enhance the market for smart cards is drawing the support of consumer market leaders that will contribute in pivotal areas of the system. CIDCO Inc., the world's leading producer of subscriber terminal equipment that supports intelligent network services being offered by telephone operating companies, has formed an alliance with VeriFone to incorporate VeriSmart technology into its products and to work with VeriFone on future projects. "CIDCO is excited to be collaborating with VeriFone in the explosive consumer smart card market," said Paul Locklin, CIDCO president and CEO. "The VeriSmart system brings a strong added value to the products we market to our regional Bell operating company customers." "VeriFone and Gemplus have had a close and long-standing relationship over the years and we are proud to be part of this latest breakthrough solution," said Marc Lassus, Gemplus CEO. "As a market leader, our strategy has been to partner with companies that enable us to offer the best-of-breed solutions, and our participation in VeriSmart extends this strategy to the consumer market for smart cards." "As consumers become more accepting of smart cards, initiatives like VeriSmart will make it easier for banks and other institutions to introduce new products and services that provide greater choice and convenience," said Ruann F. Ernst, general manager of HP's Financial Services Business Unit. Associated Press: Tuesday, October 8, 1996 Bankers Hope to Control 'Electronic Cash' By E. SCOTT RECKARD The largest organization of U.S. banks wants "smart cards" and "electronic cash" limited to the banking industry. The American Bankers Association, in its first official position on how electronic cash should evolve, says such "stored-value" cards should be issued only by regulated institutions with direct access to Federal Reserve payment services -- namely banks, thrifts and credit unions. The bankers' recommendation comes as several software companies are also jockeying to provide payment systems over the Internet. At a convention here, the bankers trade group warned that users of prepaid phone cards have been ripped off by fly-by-night issuers. The same could happen in storing funds for general use on plastic cards like credit cards or in computers, the bankers said in issuing their report Sunday. "If a nonbank issuer of stored value fails, consumers could be left holding the bag - an empty bag," said James M. Culbertson, president for the past year of the ABA and chairman of First National Bank in Asheboro, N.C. The bankers' group acknowledged that some day computer companies may get into the business of electronic cash. But if that happens, banks want the computer companies to be subject to the same regulatory scrutiny that applies to banks and thrifts. While seeking exclusive rights to smart cards and their ilk, banks have resisted the idea that conventional bank regulations should apply to electronic cash. They oppose a proposal to apply the Federal Reserve's "Regulation E" to stored-value cards. That regulation requires banks to offer written confirmations of ATM transactions. Bankers say such a requirement would make stored-value cards too expensive to issue. And in pilot projects, banks have not treated the smart cards as deposits that are insured by the Federal Deposit Insurance Corp. That means the consumer does not earn interest on the unused cash backing up the card and the banks do not have to set aside reserves as they would for a conventional deposit. A smart card has a computer chip that stores information, including how much the consumer has deposited. As a purchase is made, the amount is automatically deducted from the balance in the card's memory. In the future, consumers will be able to transfer cash to smart cards from their home computers or at an automatic teller machine at a bank. Electronic money is also being tested to pay for purchases over the Internet. The move away from paper-based transactions has been a boon in many ways for banks. The replacement of manual check-processing by electronically stored images of the checks has probably paid off more for banks than any other high-tech innovation, bank technology consultant Charles O. Hinely said in an interview. But banks could be pushed out of the payment system altogether if they don't quickly get into computerized services and transactions, said Don Tapscott, author of "The Digital Economy." "If you don't, you're basically toast, and punishment is swift," he told the bankers. The trade group's new president, Walter A. Dods Jr., said he would work to improve the image of bankers, whom he described as unfairly maligned despite the financial support and considerable charity work they provide their communities. "But what do we get in return? We get legislation to limit ATM fees. We get a reader telling Business Week recently that 'banks are just sucking us dry,"' said Dods, the chairman of First Hawaiian Bank. Washington Post: Wednesday, October 9, 1996 AT&T Adds On-Line Card Protection By David S. Hilzenrath When it comes to using credit cards on-line, many Internet businesses say their biggest fear is fear itself. Citing consumer concerns about the security of credit-card numbers as an impediment to on-line commerce, two industry powerhouses have introduced guarantees in an effort to overcome what they call unwarranted anxieties. AT&T Corp. Tuesday said it would indemnify holders of its own credit card against fraud when they use AT&T security software to shop at World Wide Web sites that AT&T maintains for its business clients. That means AT&T would assume responsibility for the customer's usual $50 deductible. America Online Inc. said last month that it would assume responsibility for the deductible when subscribers shop at on-line retailers that have been certified as meeting its own customer-service standards. That would include about 50 of the more than 250 merchants on-line with AOL, which only recently began the evaluation process, said Michael Minigan, vice president of marketing for AOL's interactive-marketing unit. ``We think that this is a way to jump-start the industry for both businesses and consumers,'' said Kathleen Earley, vice president of AT&T's EasyCommerce Services for businesses. Through the power of the AT&T name and the security guarantee, ``we can help customers overcome any concerns that they may have,'' Earley said. AT&T introduced a different guarantee in March, promising that holders of its Universal Card who also use AT&T as their on-ramp to the Internet would not be held liable if their credit cards were compromised anywhere in cyberspace. AT&T said it didn't think the guarantee would cost it much money because the risk of a security breach is so small. Many analysts and retailers agree that the burgeoning business of electronic commerce is battling a perception problem. Concerns about hackers stealing credit-card numbers on-line have spawned a new industry of companies dedicated to making on-line transactions secure through the use of encryption. ``There's still a reluctance to use credit cards on-line,'' said David Simons, managing director of Digital Video Investments, which studies the Internet for institutional investors. ``It's irrational because there's probably a greater chance of theft or fraud by giving your credit card out to an individual on an 800 number or ... the old-fashioned way, over the counter.'' ``This is strictly a perception issue,'' said Jeff Bezos, founder and chief executive of Amazon.Com, an Internet-based bookstore that handles thousands of sales a day. ``It's so much easier to go through a trash can or dumpster and get credit-card numbers than it is to break the encryption schemes that are used on the Internet.'' Still, Bezos said there is evidence that perceptions are changing. When Amazon.Com opened for business 15 months ago, about half of its customers opted to provide their credit-card numbers over the phone instead of over the Internet. Now, 85 percent complete the transactions on-line, Bezos said. AP Online: Tuesday, October 8, 1996 Bankers Shrug Off Cybertalk BY E. SCOTT RECKARD HONOLULU-- Go high-tech or wither, speakers as auspicious as Federal Reserve Chairman Alan Greenspan told the 1,100-strong American Bankers Association convention. ''If you don't, you're basically toast, and punishment is swift,'' agreed convention speaker Don Tapscott, author of ''The Digital Economy.'' You might think conventioneers from the largest organization of U.S. banks would all be rushing to be first in online banking, computerized marketing to customers, and other services and automated processes. You would be wrong, especially at smaller banks, where many seem content to take a more relaxed approach. Louis Prichard, president of Farmers National Bank of Danville, Ky., is computer literate. He rose at 5 a.m. Hawaii time Monday to e-mail colleagues and check the bank's latest financial picture via his laptop. Farmers has a World Wide Web site with information about services and rates. But home and online banking are still being studied by the four-branch, $190 million assets bank, and Prichard says that while Tapscott glossed over computer security concerns, his customers worry about them. He wants other banks to solve the start-up problems before he wades in. ''We're like water skiers: We'll let someone else cut through the waves,'' he says. ''We'll ride along, not far behind.'' Far fewer than half the bank officials in a huge ballroom at the Hilton Hawaiian Village here held their hands up when Tapscott asked if they had tried the Internet. Some, like Harold R. Pehlke, never use computers and are downright hostile to the idea. Pehlke, 57, chief executive of Republic Bank of Chicago, sat through one of many small-group sessions on new technology, then announced to the consultant making the presentation: ''You have convinced me to retire in three years.'' ''I wasn't sure I was going to do it, but after listening to you I am.'' Even featured speakers older ones, anyway shared similar views. William Seidman, head of the Federal Deposit Insurance Corp. under presidents Reagan and Ford, said he had listened to Tapscott's presentation, ''and my immediate reaction was, 'Thank God I'm old.''' On reflection, though, Seidman said he realized that most bank depositors were probably in no particular rush for high-tech banking. ''Don't panic,'' he told the bankers. ''It'll take plenty of time before your average customer gets there.'' That sounded good to Gib S. Nichols, a director of the Flathead Bank of Bigfork, Mont. ''Our customers will let us know when it's time,'' he said. Seidman, who ran the Resolution Trust Corp. when it began selling off the wreckage of the 1980s savings and loan debacle, said the now flourishing bank industry had better watch for risks as well as find new high-tech ways to market services. Many banks ''are reaching for loans today,'' he said. ''When the going gets tough, the tough get out of the way and let someone else do the dying,'' he said. ''We used to say as regulators, 'When the tide goes out you'll see who's swimming without a bathing suit.' Those of you who feel the tide better look down.'' News Release (NationsBank):Tuesday, October 8, 1996 NationsBank Official Partner of NCL's Internet Fraud Watch NationsBank (NYSE: NB) is joining the National Consumers League's battle to ensure the safety and security of online commerce. Through a $100,000 grant, NationsBank is becoming the exclusive bank sponsor of NCL's Internet Fraud Watch. Internet Fraud Watch, launched in February by the League and operated from its National Fraud Information Center, is a first-of-its-kind program for monitoring, reporting and preventing fraud on the Internet. NCL shares Internet Fraud Watch data with local, state, and federal agencies, including the Federal Trade Commission and state attorneys general, as well as international law enforcement groups. "Internet Fraud Watch is a resource that consumers can use to get educated on the Internet," said NCL President Linda F. Golodner. "Since our launch in February, our Web site alone has received more than 300,000 visits from consumers and averaged 25,000 hits a week. We have helped consumers as well as law enforcement officials keep cyberfraud in check." The NationsBank grant will significantly expand the Internet Fraud Watch consumer education and protection programs, according to Golodner. With plans to offer Web-banking in mid-1997 and more than 120,000 customers already using its PC banking product, NationsBank ranks online security as a top priority, according to NationsBank President Ken Lewis. "NationsBank is happy to help NCL broaden its fraud education and prevention efforts," said Lewis. "The Internet's growing popularity and potential for commerce make it a vitally important avenue for American business. It's equally important that consumers know the Internet is a safe and secure place to do business." The Federal Trade Commission rigorously monitors the Internet. The FTC recently cracked down on a pyramid scheme it believed had bilked consumers of more than $6 million. It also took action against several firms that marketed business opportunities by using deceptive claims and false earnings reports. "Consumers who suspect a scam on the Internet have critical information that can be used by law enforcement agencies to track down and stop potential frauds before more consumers are victimized," said Jodie Bernstein, director of the FTC's Bureau of Consumer Protection. "The Internet Fraud Watch program gives consumers an easy and cost-free way of providing this information, and it has been a major help to the FTC in identifying particular scams in their infancy." National Consumers League advisors field calls about alleged incidents of online fraud, direct callers to local resources and report the information to state and federal enforcement authorities. Enforcement agencies use the data to help shut down cybercrimes and boiler rooms. Work-at-home schemes are among the top-five scams currently operating online. (NCL Top Five Internet Scams will be available on Wednesday, Oct. 9.) Consumers can reach NCL's Internet Fraud Watch by phone through the National Fraud Information Center at (800) 867-7060, or visit the home page at http://www.fraud.org . They may also send e-mail messages to nfic(a)internetmci.com. Financial Times: Wednesday, October 9, 1996 Smartcard Trials Extended The race to replace notes and coins with electronic cash hots up this month as the Mondex consortium extends trials of its smartcards. The group, which includes British Telecom, Midland Bank and NatWest Bank, is issuing students at York and Exeter universities with the cards, which contain a microchip that can be loaded with electronic money from automatic teller machines and home telephones. The cards are "swiped" through retailers' tills to deduct payment for purchases. Users do not have to sign an authorisation slip as they do with direct debit and credit cards. Electronic money saves banks and retailers the considerable costs of handling physical cash. But so far consumers testing Mondex smartcards in the UK have not received a share of this saving. Mondex is well ahead of its main rival in the UK, VisaCash, whose backers include Barclays and Lloyds Bank. It could be a year before VisaCash starts its own trials; Mondex could be offering its cards to the public by then. Jonathan Guthrie AP Worldstream: Tuesday, October 8, 1996 Banker Sentenced to Death for Fraud HANOI, Vietnam-- A Vietnamese private bank executive has been sentenced to death after a court in southern Vietnam found him guilty of financial fraud and stealing funds from accounts, state-run media reported Tuesday. Nguyen Van Son, deputy general director of Gia Dinh Joint Stock Commercial Bank, will face a firing squad for his crimes, said the Communist Party newspaper Nhan Dan, or The People. Ho Chi Minh City's People's Court convicted Son of fraud linked to the private bank he and his wife, Thai Kim Lieng, established in 1992. The court said Son stole about $4.5 million from the bank's accounts. Unable to collect the necessary capital to qualify for a bank license, Son and his wife forged several documents claiming they had about $800,000 worth of funds from 17 shareholders, court records said. When the State Bank of Vietnam granted the couple a banking license in 1992, they began siphoning off money from newly opened savings and other accounts. At the time, the bank had more than $6.5 million worth of accounts, the newspaper said. The bank also had collected substantial gold reserves. Son continued to forge credit documents over several years to increase the bank's financial standing, the report said. A police investigation in 1994 led to the arrests of Son, his wife and five other bank associates. Lieng and bank director Nguyen Le Tue also stood trial with Son. Both were sentenced to life in prison. Four other bank executives were sent to prison for terms ranging from 3 to 20 years. Although a number of banking scandals have been reported in Vietnam since Hanoi began shifting toward a market economy. This latest case is the largest of its kind and marks the first time a bank executive has been sentenced to death for his crimes. Nhan Dan described Son's crimes as ''organized acts that cause extremely serious consequences and pose dangers to society.'' In addition to the death and prison sentences, the court ruled that the culprits must repay money taken from the bank. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: Microsoft CAPI
by James A. Donald 17 Dec '03

17 Dec '03

Mike McNally writes: >> And so what happens when the Microsoft key is compromised? >> It might be hard to break by purely cryptographic means, but >> surely there are some people at Microsoft who aren't >> millionaires. At 03:13 PM 10/9/96 -0500, Andrew Loewenstern wrote: > I ask: "Who Cares?" It is easy enough to distribute with the secure-non-GAK > plug-in a patch for disabling the module authentication. Heck, you could > even make an ActiveX applet that did it. Better than disabling, would be to give the user the choice of whose signature to trust. Perhaps many users would prefer a crypto engine signed by Zimmerman, rather than Microsoft. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

2 1

AW: AW: Binding cryptography - a fraud!
by Eric Verheul 17 Dec '03

17 Dec '03

On vrijdag 11 oktober 1996 1:21, Jim McCoy[SMTP:mccoy@communities.com] wrote: > >Eric Verheul <everheul(a)NGI.NL> writes: >[...] >>The whole problem is that you don't trust your government, well I do (till >>some >>extend). I get the impression that this is a typical USA problem. > >If we wanted to be EuroSheep we would be living over there. Of course, we europeans are too civilized to go into these kind of childish discussions. > >jim > Eric

1 0

BAY AREA CYPHERPUNKS SATURDAY 10/12 TRESSIDER HALL STANFORD
by Bill Stewart 17 Dec '03

17 Dec '03

There will be a San Francisco Bay Area Cypherpunks meeting on Saturday 10/12 at Stanford University. The meeting location will be the tables outside Tressider Hall, where we've met for several previous meetings. The canonical time is noon for lunch and milling around, and 1pm for organized program. Hugh Daniel will be organizing the program, and will be demonstrating how to install the SWAN encrypting firewall system that John Gilmore talked about at the September meeting. Maps of Stanford are available on the web under www.stanford.edu. For the MIME-equipped, I've attached a GIF that has the meeting area outside Tressider marked. Ample parking is available in the parking lot between Mayfield Ave. and Lagunita. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # You can get PGP outside the US at ftp.ox.ac.uk Imagine if three million people voted for somebody they _knew_, and the politicians had to count them all.

1 0

Re: "Forward Privacy" for ISPs and Customers
by Scott McGuire 17 Dec '03

17 Dec '03

Tim said > IANAL, and I have been skimmming over most of the Bell v. Unicorn v. Nuri > debates about the legality of wiretapping, but something jumped out at me: > ... stuff deleted ... > > I agree that ISPs look a lot like phone companies for the purposes of > regulations and wiretaps. My ISP sells me some connectivity, sends me a > bill, etc. > It seems to me that they are actually selling two seperate things. One is connectivity the other storage. The storage might have a different legal status than the connectivity. So, is email part of the connectivity or the storage? What is the legal status of phone company provided voice mail? This seems pretty close to email. > Thus, if it is constitutionally OK (a technical term) for courts to order > phone logs to be turned over to law enforcement, why not logs of e-mail? Or > logs of Web sites visited, for example? I see no basis for a special > distinction. Records are records, and businesses routinely have to turn > over various records under court order. > > However, there are certain things my phone company does *not* do. They > don't keep _copies_ (recordings) of my phone conversations. This means a > court order can't yield copies of past conversations. They also don't track > incoming phone calls to me. (I don't believe such records of incoming phone > calls are kept; maybe I'm wrong. Certainly with Caller ID, storing incoming > phone numbers is possible....I just don't think local or regional phone > companies care about such records, and hence don't bother to accumulate > them.) > > Now, should the phone company keep such records, they would be accessible > via court order. > > My point? ISPs are currently in a position to turn over *far* more > information than phone companies are able to turn over. It's as if the > phone companies kept audio recordings of all conversations, without even > the need for law enforcement to do a wiretap or pen register or whatnot. It > would be trivial for law enforcement to say: "Phone Company, here's a > subpoena/court order for the last 6 months of phone conversations Tim May > has had. Please ship the tapes via FedEx." > Do we know that if phone companies kept recordings of your conversations they would have the same legal status as the records that they already keep? > This makes the ISP case a bit different. Not legally, but technologically. > > There are some fixes. > > Something ISPs could do--and may do if there is sufficient customer > pressure--is to adopt a policy of "forward secrecy" (to slightly abuse this > technical term). That is, to have an explicit policy--implemented in the > software--of _really_ deleting the back messages once a customer downloads > them to his site. This means that _backups_ must be done in a careful > manner, such that even the backup tapes or disks are affected by a removal. > > (Recall that Ollie North thought he had deleted his incriminating White > House PROFS messsages, but that they were faithfully preserved on backup > tapes, and could be retrieved.) > > My Eudora Pro mail programs sucks down messages from my ISP and, as yours > probably does, tells the ISPs mail server to delete it upon downloading. An > option for users could be something like "Don't make longterm backups of my > account, and leave no copies whatsoever once I have downloaded my > messages." > > This would make the job of a law enforcement or TLA a lot more difficult > than it is now, where the e-mail and logs are ready to be handed over on a > silver platter, all nicely accumulated and human-readable. > It would be good to get ISP's to work this way regardless of the law. Its better for the data not to exist than have it legally hard to obtain. > Back to the legal issue. Perhaps the Digital Telephony Act will be > interpreted to require ISPs to make their systems "tappable," possibly by > adding message logging. possibly just by offering access to the T1s and T3s > only ("OK, Feds, here's where the T3 enters the building...be careful you > don't cut the core, OK?"). > > But if no logs and backup tapes of mail are kept, at least the job of > gaining access to communications is made more difficult. > > And, I'm sure the lawyers will agree, while ISPs may be treated essentially > the same as telephone companies, absolutely *nothing* requires either to > keep specific kinds of account records (*), to "know their customer" (a la > banking laws, supposedly), or to record all traffic. > > (* Prepaid phone cards, paid for in cash, and payphones, tell us that True > Names are not needed with the phone companies. And so on.) > > We don't have to make it easy for them. > > --Tim May > > > "The government announcement is disastrous," said Jim Bidzos,.."We warned > IBM that the National Security Agency would try to twist their > technology." [NYT, 1996-10-02] > We got computers, we're tapping phone lines, I know that that ain't > allowed. ---------:---------:---------:---------:---------:---------:---------:---- > Timothy C. May | Crypto Anarchy: encryption, digital money, > tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero > W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, > Higher Power: 2^1,257,787-1 | black markets, collapse of governments. > "National borders aren't even speed bumps on the information superhighway." > > -------------------- Scott V. McGuire <svmcguir(a)syr.edu> PGP key available at http://web.syr.edu/~svmcguir Key fingerprint = 86 B1 10 3F 4E 48 75 0E 96 9B 1E 52 8B B1 26 05

3 2

RE: legality of wiretapping: a "key" distinction
by nobody＠zifi.genetics.utah.edu 17 Dec '03

17 Dec '03

jim bell <jimbell(a)pacifier.com> writes: ... >Ironically he said it, despite the fact that wiretapping is comparatively >rare. Perjury, "drop guns," faking and planting evidence, accepting bribes, >strongarming suspects, and similar techniques are probably far more commonly >used than wiretapping ever was, but I don't see Unicorn describing those as >"firmly entrenched" even though that would be an accurate characterization. Donuts and coffee are firmly entrenched in law enforcement, too. Must Unicorn say _all_ obvious things in his (futile, but increasingly humorous) quixotic quest for your continuing (and free) legal education? Say it ain't so.. me

1 0

Re: AW: Binding cryptography - a fraud-detectible alternative to key-esc
by jim bell 17 Dec '03

17 Dec '03

At 01:08 PM 10/11/96 +0100, Adam Back wrote: >As your paper describes, your system allows anyone to check the >correctness of the escrowed session key. Have you considered >modifying it so that the only person who can check is the owner of a >designated private key of a public/private key pair? This would allow >say for the TTP to check correctness, and not the TRP, nor the public. >I'm not sure of the usefulness of this, but it allows you to select >from the full spectrum according to requirements: > >a) no one can check, PGP second recipient (Carl Ellison, Bill Stewart) >b) recipient only can check (my suggestion) >c) holder(s) of designated keys can check >d) anyone can check (your proposal) I think the biggest problem with allowing "anyone" to check the correctness of a key is that what is a technical possibility today, will become a legally-mandated requirement tomorrow. What if Internet backbone companies and/or ISP's were told that they had to implement software check these keys, and if they discovered an "incorrect" escrowed key, they were legally obligated to either refuse to forward that message, and/or forward a copy of that message to someone like Spooks(a)NSA.gov or Thugs(a)DOJ.gov. Even worse, if this checking process revealed the sender, or at least a coded identity unique to the sender, the government could issue "digital APB's" where it would insist on being sent copies of all messages with a given ID number. Suddenly, the Internet might go from being hard to tap, to being practically automatically tapped. Jim Bell jimbell(a)pacifier.com

1 0

Say what?
by rollo＠artvark.com 17 Dec '03

17 Dec '03

I'm enclosing a header taken from a message in <Cypherpunks Lite Digest 96/10/05>. Can anyone tell me how to determine (1) who wrote it; (2) who sent it to me; (3) Who was the original recipient? It seems like it's to Cypherpunks Lite <cp-lite(a)comsec.com>, but that can't be it, since the author starts by saying "I must first say that your program is one of the finest in news reporting, and I tune in every day." >From owner-cp-lite Sat Oct 5 19:13:54 1996 Return-Path: owner-cp-lite Received: from localhost (eb@localhost) by comsec.com (8.6.5/8.6.5) id TAA21237 for cp-lite-real; Sat, 5 Oct 1996 19:13:54 -0700 Received: from localhost (eb@localhost) by comsec.com (8.6.5/8.6.5) id TAA21233; Sat, 5 Oct 1996 19:13:54 -0700 Message-Id: <199610060213.TAA21233(a)comsec.com> To: Cypherpunks Lite <cp-lite(a)comsec.com> Sender: owner-cp-lite(a)comsec.com Date: Thu, 3 Oct 1996 15:38:11 -0700 (PDT) From: Ernest Hua <hua(a)chromatic.com> Subject: Lack of reporting on CALEA and Encryption issues ... Precedence: bulk I must first say that your program is one of the finest in news reporting, and I tune in every day. Rollo Silver / Amygdala | e-mail: rollo(a)artvark.com 216M N. Pueblo Rd, #107 | Website: http://www.artvark.com/artvark/ Taos, NM 87571 USA | Voice: 505-751-9601; FAX: 505-751-7507

1 0

[NOISE] Funny quote in Word-A-Day
by P. J. Ponder 17 Dec '03

17 Dec '03

the Word-A-Day mailing list came up with a humorous quote, almost germane to some of the ramblings on this list.... >Reputation: what others are not thinking about you. > >To subscribe or unsubscribe, please send a message to >wsmith(a)wordsmith.org >with "Subject:" line as "subscribe <Your Real Name>" or "unsubscribe". >Email anu(a)wordsmith.org if you have any questions, comments or >suggestions. >Archives, FAQ, words and more at the WWW site: >http://www.wordsmith.org/awad/ So long, Perry.... Let us know when you get a new list set up & best wishes. -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.2 mQCNAzBz1GQAAAEEANGl0daeboCV8dBSLxycjYd5tIJNOmKN2Y8hCXhF5cLt0nVu NUDMgmUWF4zoZtBDNbtVF0wTTxEcBEHOLjIuZKPeiT7Bw266HhTahXxOIaOXZyDj 5VMISVvt9/Ua31JfxfCwK0iPtojFtKcNU13z/hrYA7Q5LfqsVF4ZsVsZPDGdAAUT tClQLkouIFBvbmRlciA8cG9uZGVyQG1haWwuaXJtLnN0YXRlLmZsLnVzPg== =lVU7 -----END PGP PUBLIC KEY BLOCK-----

1 0