December 2003 - cypherpunks-legacy

The Beauty of "A la Carte" Insurance Plans
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 8:44 PM 9/18/96, jbugden(a)smtplink.alis.ca wrote: >I don't speak for the left, nor for the right. I don't think that there is a >unified voice on either side of the political spectrum. However I do find it >ironic that market driven health insurance has the potential to be more >intrusive into personal life than many government systems (cf. genetic >screening). > >If all you do is replace Big Brother with Big Business, then all that has >changed is the name. To paraphrase the character in "The Graduate": "One phrase, Benjamin...a la carte insurance." I delight in explaining this point to people, and watching the glimmer of understanding take hold, then watching them realize the implications. I recall explaining this view a couple of years ago here on this list, but probably not since then. So, time has come for me to give it another shot. Is there an alternative to a Giant Corporation (tm) essentially performing the role of Big Brother? I submit that there is. Here's what one does. I'll use a concrete example. Suppose that one is not a homosexual, is not engaging in anal intercourse with partners, is not an IV drug user, and is not a hemophiliac. Further, suppose that one is reasonably monogamous (e.g., fewer than several different sex partners a year, and such partners are themselves not in high-risk groups, as defined in the first part of this paragraph). Such a person is in a very low risk group for AIDS. What one does is to *opt out* of any coverage for AIDS-related coverage. One opts out completely, signs a waiver to this effect, and absolves the insurer of any responsibility for AIDS- or ARC-related illnesses. (This is not perfect, is not "fine-grained" enough, compared to an insurer doing exhaustive tests and lifestyle interrogations and then offering some precise rate to be paid. But it has the advantage that the insurer does not get the exhaustive and intrusive lifestyle information, and the rough cut of "opting out" is almost certainly OK for most low-risk persons. Your mileage may vary, in which case you may submit to a detailed lifestyle analysis. Sadly, many laws exist which don't allow insurance companies to ask the questions and do the tests needed to establish the risk of getting AIDS--sort of like not allowing an insurance company to ask if a person is a low-risk philosopher or a high-risk aircraft test pilot!) Ditto for any other disease which one can either make a reasonable estimate of, or can be _tested for_ (tested privately, independently of any insurance company!). Thus, for the various _genetic_-related diseases, one can check independently to see if one is a reasonably likely carrier of such genes, and, if not, can *opt out* of any coverage for those diseases. This process of *opting out* has the beautiful advantage of taking one's self out of the "subsidizers" pool while not materially affecting one's actual risk of being uncovered for some disease or condition. And all without an intrusive physical exam (though an exam may still be asked for, etc.). The parallel is quite close to people opting out of coverage for things they know they are not at risk for, such as hang-gliding accidents, horseback-riding accidents, aircraft test piloting, etc. (Such exemptions are not "enforced" by the insurance company following one around, or mounting a "position escrow" device on one's body, but by the eminently reasonable approach of simply not paying off if the accident was due to a hang-gliding accident, a horseback riding accident, etc. This is how the "non-smoker" discounts in auto insurance work...finding strong evidence that one is actually a smoker (crud in the lungs, cigarette butts all around the house when living alone, etc.) is positive evidence that one lied about being a non-smoker, and the policy is cancelled without payout.) I wish I could say I thought of this strategem of "opting out," but I believe I read about it some years ago in "Reason" or "Liberty." It understandably outrages liberals, who realize that people will arrange private tests for themselves, and will then opt out of a la carte coverage of diseases they reasonably believe are unlikely to affect them. (Nothing is certain, of course, and there is some chance that if one opts of coverage for Lou Gehrig Disease, or MS, or AIDS, that one may still end up with one of these diseases. TANSTAAFL, and most people will jump at the chance to remove themselves from a pool for something they feel they are very unlikely to get.) To relate this to the other examples, if one opts out of SCUBA-diving coverage, because one is not a SCUBA diver, this does not require the insurance company to intrusively investigate one's life. Diving accidents just don't get covered, period. Some have argued that a la carte insurance should be banned, for precisely this reason, that people will always be able to "game against" the rules. (To make this clear, the flip side of someone opting out of coverage for Disease A is that someone else may already know they are very likely to have Disease A or be at strong risk for Disease A. Forcing an insurance company to accept all applicants means this second category can game against the system, getting more out of the system than they expect to put in.) Supporting the "opting out" or "a la carte" approach to insurance allows personal privacy to be maximally preserved. --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

1 0

Re:really undetectable crypto made somewhat practical
by Steve Reid 17 Dec '03

17 Dec '03

I'm on FCPUNX instead of regular Cypherpunks, so please excuse me if I'm a little behind the thread. > New Scheme: First, calculate the MD5 hash of all the words in the various > dictionary files used by the password cracker program and create a > database containing every word and the first 4 bits of its MD5 hash. > Given such a database, it would be possible to write a program that > accepts as input a block of cyphertext (the stego message, encrypted), > chunks it up in to groups of 4 bits and then, for each chunk, displays the > words that have hashes that start with those same four bits. The person > running the program would select words that form meaningful sentences but > also produce hashes that combine into the encrypted stego message. This > scheme would send 4 stego bits per word. As a slight improvement, you could turn this into a complete stealth encryption scheme, using only the one-way hash function operating as a MAC. Instead of hashing just the word in an effort to get stego bits, you could hash a key along with the word. In order to get the intended hash you would need to know the key. Since you're probably hashing a whole block of 512 bits (or whatever's specified in the algorithm) appending a key should not affect the speed of the system. I'm certain that this would increase the security, possibly enough that you wouldn't need to use a regular encryption algorithm (but I wouldn't bet on it). Crude example: Assume that Alice can use the words "Greetings" and "Salutations" interchangably without drawing suspicion. Also assume that "PASSWD" is a secret known only to Alice and Bob, and that the stego software looks at the low bit of an MD5 hash. MD5 ("GreetingsPASSWD") = c7bf6e051731a0dcf52baa330c9d2e7d <- low bit=1 MD5 ("SalutationsPASSWD") = 2dd2ba080b5feb060ffbc6d196fd1b34 <- low bit=0 If you say "Greetings" you're sending a 1, if you say "Salutations" you're sending a 0. Eve doesn't know about "PASSWD" so she can't do the hash and figure the bit. Of course, if you're using this to send more bits, you'll need something harder to guess than "PASSWD". The trick is in figuring out which words have stego bits and which don't. It might be better to stego bits into a whole line instead of a word, as that would probably offer more flexibility. ===================================================================== | Steve Reid - SysAdmin & Pres, EDM Web (http://www.edmweb.com/) | | Email: steve(a)edmweb.com Home Page: http://www.edmweb.com/steve/ | | PGP (2048/9F317269) Fingerprint: 11C89D1CD67287E68C09EC52443F8830 | | -- Disclaimer: JMHO, YMMV, TANSTAAFL, IANAL. -- | ===================================================================:)

2 1

RE: Bernstein hearing reminder: THIS Friday 11:45AM, SF Federal Building
by Batman 17 Dec '03

17 Dec '03

For the 200th time, unsubscrive me of your fucked mail lists.

3 3

Counter "noise" with "signal" (please?)
by Douglas B. Renner 17 Dec '03

17 Dec '03

If a S/N ratio becomes irritating, by all means, don't increase the denominator! In other words, do your part to let undeserving threads die. Certain things can only be dignified with a response, but I imagine that goes without saying. -Doug Renner

1 0

Morality, Responsibility, Technology.
by Douglas B. Renner 17 Dec '03

17 Dec '03

Some previous thread mentioned the potential usefulness of a large database containing private medical information, and possibly genetic detail as well. While I agree on the tremendous constructive potential of such a hypothetical data-mine, I seriously doubt that Mankind has the moral integrity to use this type of knowledge responsibly. Supposing for example, a particular genetic "defect" were found with such a database to have a 90% correlation with the presence of epilepsy. Immediately, doctors & scientists would strive to find a way to gain some leverage against this "defect." We might for example see a testing procedure for human fetuses to determine whether a particular pregnancy "should be" terminated. People would become famous, and much money would change hands due to this "discovery." Generally people will conclude that Science has given them more control over their lives than they previously had. The problem is, nobody really understands just what this "defect" really means. Nobody understands why it is there, or what kind of a choice we are really making my attempting to remove it from our gene pool. Remember that Sickle Cell Anemia is caused by a genetic "defect". We are lucky enough to know that the carriers of this "defect" are uniquely able to survive certain plagues. This so-called "defect", as troublesome as it may be to some individuals, is really a latent strength, which is how natural selection reinforced it in the first place, and we may need it again. The term "defect" is therefore entirely out of line. We have no business placing judgements from our own limited material value sets onto something which has the definite potential of affecting all future generations of Humanity. It's none of our business. Further, when such a database is eventually created, I ask not "who" but "what" will have access to it? What kind of non-sentient group mentality will have sufficient authority and be presumptuous enough to declare itself morally objective? What kind of a larger process might such an entity be unwittingly serving? We already have many times more material knowledge than we are morally capable of handling as a species. Here's one tiny example. The most widespread use of the knowledge of psychology is guess what? Advertising and Marketing. Our average American sits entranced watching hours of television daily, unwittingly absorbing countless impressions by advertisers with more money than morality. Can he identify the "glittering generalities" or the "bandwagon appeals" or any of the other effective forms of propaganda? Does he know the truth from a lie when sexual titillation is part of the presentation? May he readily accept what is presented, and most of all: Does he see himself sitting there, absorbing these impressions? We don't see our selves in action. We can't know what we're doing. None of us have developed sufficient "presence" to know what we are really doing most of the time. We can't possibly be objective, except in extremely rare, life-changing moments, and even then only if we're lucky. Just thinking about yourself thinking isn't enough, because where are your emotions? Do you really understand why your thoughts are what they are? Did *YOU* put those thoughts in your head intentionally, or did they sort of happen on their own... one thought following another through some combination of association and external stimuli? And while you've been busy reading this, with your attention directed outward, why haven't you been aware of the sensation in your feet, or the tension in your face, or your posture, or your breath? As westerners we have directed so much of our attention "outward" that we develop little or no objective knowledge of what goes on within us. Can we break this cycle? If there really are esoteric schools, with disciplines and methodologies of obtaining self-knowledge, then this knowledge must be such that by its very nature, it cannot possibly be communicated successfully in any large, public manner. But I digress. As a reader of this list, have you ever asked yourself Why, why is it that you personally want strong encryption to be widely available? It's a very powerful emerging technology, and it's in the palm of your hands. Douglas B. Renner dougr(a)usa.globelle.com

2 2

Re: 56 kbps modems
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:41 AM 9/17/96 -0700, Eric Murray <ericm(a)lne.com> wrote: >Crypto/security related: how hard is it to hack a Frame Relay >connection? My impression is that it requires access to >one of the telco's routing computers, which would make it >about equivalent in difficulty to hacking POTS. Frame Relay doesn't get handled by the telco's POTS routing (unlike ISDN) - it's handled by whatever frame relay switch the telco uses. I don't know what Pac Bell uses; AT&T uses Stratacom switches, I think MCI uses Cascade, USWest uses a mixture. Frame switches mostly use Permanent Virtual Circuits, though Switched Virtual Circuits will be coming out in the next year or so. PVCs are pretty tough to hack, because they mostly get provisioned from an administrative interface on the switch rather than in-band. SVCs will offer a bit more risk, since switching is switching. But it's probably pretty tough. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0

Re: Cryptologie: Conference internationale - 25 SEPT - Paris
by Remo Pini 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: quoted-printable To: cypherpunks(a)toad.com Date: Thu Sep 19 11:31:08 1996 > September 25, 1996 > > Centre de Conf=E9rence Internationale > 19 Avenue Kleber, Paris 16, France > > Program, registration and further information (English): > http://www.epic.org/events/crypto_paris > I'll be there, how about any of you out there (yes, I know some of you wi= ll be there as a feature)? - ------< fate favors the prepared mind >------ Remo Pini rp(a)rpini.com PGP: http://www.rpini.com/crypto/crypto.html - ----< words are what reality is made of >---- -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: noconv iQEVAwUBMkES3RFhy5sz+bTpAQEzmAf/d1XqnIlGj3jgX/hgGLwom15WLsNvPjfZ YcQqOjP3e5pEeHjWWAUUjQ2dopTOI7+Kytb4ZCIgoI6TIFmkWj/jAMfpx/IYx89C Db3f7+jvEN19Q/NQUYdUXktqaMC7zFMjgX8U2LBfiuR7qloMMJV+O3pDTvdJCjln BumjKnk9NwebtBrcmMIw3Y1LZ1jjFfwbanUEYlKMUgp32XXxxe+q0HOWI4x9gb32 NvPlXSftPSkpHt2M8V52wZljbtnd9WfDTsqscEjaZ3e++IousAc2itkFSV3jvS72 XT2ZZrU3lJc0n8qOjKyYR19hMIfzQgzwmrbukK0/W8R923SSA01nGA== =ERW9 -----END PGP SIGNATURE-----

1 0

Re: DL in exchange for fingerprint
by tcmay＠got.net 17 Dec '03

17 Dec '03

At 9:13 PM 9/19/96, Gary Howland wrote: >Timothy C. May wrote: >> >> (Yes, I disliked being thumb-printed, but I could see no viable >> alternative. I'm sure Duncan has some scheme to declare himself a Botswanan >> exchange student, but I decided being thumb-printed was the lesser hassle.) > >Sure, it's always less hassle doing what they want. Privacy doesn't >come for free. It's easier to let the police search you in the street >than it is to make them arrest you so that you can make a formal >complaint. So, just what it is _your_ method of dealing with this? While it is noble to talk about fighting the system, just how do you go about doing it yourself? Do you simply drive without a valid driver's license? I know some folks who do, of course, but it's not something that's "worth it" to me. (This space reserved for your lecture about how I need to be prepared to go to jail to defend my right not to be thumbprinted, etc. On second thought, why don't you be the one to go to jail, and then you can let us know your experiences.) >> Paraphrasing that famous quote, just which part of "not for identification" >> don't they understand? > >Hmm - who are you paraphrasing here? (Just curious). "What part of "No" don't you understand?" and "What part of "Congress shall make no law" don't you understand?" --Tim May We got computers, we're tapping phone lines, I know that that ain't allowed. ---------:---------:---------:---------:---------:---------:---------:---- Timothy C. May | Crypto Anarchy: encryption, digital money, tcmay(a)got.net 408-728-0152 | anonymous networks, digital pseudonyms, zero W.A.S.T.E.: Corralitos, CA | knowledge, reputations, information markets, Higher Power: 2^1,257,787-1 | black markets, collapse of governments. "National borders aren't even speed bumps on the information superhighway."

6 5

CIA hacked
by Mike van der Merwe 17 Dec '03

17 Dec '03

Hi everybody Heh! This one's good for a laugh :-)) http://www.odci.gov/cia Seems the DOJ hack was a good inspiration. Heh! Life's good when you're willing to work at it. Later Mike ____________________________________________________________________ I'm sure we will find out in a few years that Microsoft invented the Net. Or brought it to the masses. Or saved it from a certain and early demise. Or all of the above. JAMES SEYMOUR

3 4

Re: GAK, GAP, GAY
by Bill Stewart 17 Dec '03

17 Dec '03

At 10:52 AM 9/18/96 -0700, Tim wrote: >It doesn't matter if cash is still allowed if one cannot interact with any >health care person without a proper citizen-unit data base entry. They've >got you tracked even if you pay in gold dust. > >(Putting on my Duncan cap--not to be confused with dunce cap--I wonder what >will happen the first time someone dies because a hospital wouldn't treat >someone without a proper citizen-unit health care card?) By definition, without a citizen-unit health card number, a Health Status Transition Event can't be recorded, therefore nothing will happen. It's possible that some auditor may notice a short-term increase in the amount of hazardous medical waste disposal at the facility that can't be properly allocated to health-services-consumption-units for cost recovery purposes, but there are overhead accounts for such things, which are simpler than creating fictitious accounts for "un-persons" or some such. # Thanks; Bill # Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com # <A HREF="http://idiom.com/~wcs"> # You can get PGP software outside the US at ftp.ox.ac.uk/pub/crypto

1 0