December 2003 - cypherpunks-legacy

Hey! Dr. Vuilis!
by se7en 17 Dec '03

17 Dec '03

SHUT THE FUCK UP, BITCH!!! You think we can have at least one fucking week with having to listen to your clueless bullshit? Or am I gonna have to put the slap down on you? Rant like a bitch, get slapped like a bitch! se7en

3 3

Re: When did Mondex ever claim to be anonymous?
by L. Patrick Elam, III 17 Dec '03

17 Dec '03

You have claimed many flaws with the Modex system and there are even more you have not mentioned. I won't go into that here, except one. When the hardward fails how do you purchase, enter, or exercise your rights of purchase or entry? Privacy, there is none with a system like the Modex. A trial was held in Atlanta during the Olympics and it was a total disaster. The system worked half the time. People had money they could not spend. But, believe me the system is coming and the world doesn't need another avenue of access to personal data and private issues. Bring on the encryption and encrypt every thing. Pat Elam At 01:31 PM 10/28/96 +0000, you wrote: >I'm a student at Exeter University in England. If you are researching >Mondex, I am sure you are aware that we are currently undergoing a >world-wide Modex trial. > >The National Westminster Bank have teamed up with the University to >provide every student with an "Intelligent Student Card" to replace our >old Student ID. > >The new card has an electronic chip which can store a variety of >information on it. We are not sure of exactly what it holds, but it can >store "cash" - placed onto it from specific points around campus, or any >Nat West Cash Point machine, or even using any phone box (Yep, the bank >have also teamed up with the phone company (BT) in order to get the >thing working). > >The card can be used to pay for almost everything around campus. Even >in the student pubs and bars. The Uni are offering cheaper drinks for >those who pay by Mondex. It is a wierd sight to watch people handing >over their student cards to pay for a pint! > >I can give you as much information on the system as I can get hold of if >you want it. > >As far as privacy is concerned, The claim that Modex is as private as >cash is plainly incorrect. Both the card chip and the card reader store >details of the transaction. The student can use a phone box, card >reader or Nat West Bank Cash Machine to get details of the last ten >transactions stored on the card. > >As for the Bank, they get details on the item the student has purchased, >purchase location (the building and exact 'Mondex point' in the bar/shop >where the transaction took place), the exact time and date the >transaction was carried out, together with (obviously) the name and ID >of the purchaser, etc. > >Should the police require the information for Criminal purposes, then (I >am almost certain) the Bank/University would be obliged by law to hand >over the information. Where's the similar "privacy" for cash >transactions? > >As far as the card is concerned, we need it to enter all of our student >facilities. Without the card, you can't play sports in the sports hall, >or get into many Univerity social events. I think we will even be able >to use the card to electronically vote. (The implications of this are >obvious - will the hierarchy know your poitical standing in >elections???) > >It's funny, I never realised how much information they have on me, until >I've just sat down and thought about it. > >If you want any more details, just send us an Email. > > > Rob. > > > > > >_____________________________________________________________________ > > cs94rjb(a)dcs.ex.ac.uk Rob Blakemore, Exeter University. >_____________________________________________________________________ > -----BEGIN PGP SIGNED MESSAGE----- ------------------------------------------------------- Patrick Elam patelam3(a)atl.mindspring.com Engineering at its finest! http://www.mindspring.com -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQCVAwUBMfwmggBXLW8oj+lZAQHCiwP+La/CLNY/yRvrH8TZQdvTxHK7Dgf0e1Dp j1xsa0h4VoWXrM4v5LYHbjyFYcpJGpOY7s6yIl1vFj2HGaix6DTv222/dHleMZZp lUJtAoJAW7AmbwA51skDc5EZZ0oSBh2BRXUfuAEzicm709SmKUKn0oH0vtKoS4Z2 xaGZ7952BX8= =MM2Y -----END PGP SIGNATURE-----

1 0

Re: Lawyers, companies to create Internet legal group
by Matthew J. Miszewski 17 Dec '03

17 Dec '03

This is a great example of why we need organized people like Greg to help express an alternative viewpoint. As Greg and myself, and the other lawyers on this list know, there are often multiple sides to any legal argument. To have this be the only voice regarding Law and the Net would be a bad idea. I do favor its general intent - to take the formation of policy out of the legislative venue. I do not think the major interests listed will have my interests at heart. Mom and Pop ISPs, Web Consultants, the HTML Guild, the ideas of GPL may not even be in the consciousness of some of the larger organizations (I remain to keep my hope out for Netscape). I would like to propose a professional response to this organization in the form of a Law Review type of organization. I know there are enough lawyers on the list to set this into motion. I would like to know what kind of interest there would be before I put the great deal of effort it would take into such a project. Let me know. Matt

1 0

Secure Internet-based Electronic Commerce: The View from Outside the US
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I've just made a draft copy of this paper available for comment as http://www.cs.auckland.ac.nz/~pgut01/paper.htm, a copy of the introduction is given below. The whole thing is around 170K long (40 A4 pages when printed). If anyone has any comments to make on it, please let me know. Peter. Introduction ------------ The creation of a global electronic commerce system will provide an extremely powerful magnet for hackers, criminals, disgruntled employees, and hostile (but also "friendly") governments intelligence agencies. This problem is magnified by the nature of the Internet, which allows attackers to quickly disseminate technical details on performing attacks and software to exploit vulnerabilities. A single skilled attacker willing to share their knowledge can enable hordes of dilletantes around the world to exploit a security hole in an operating system or application software within a matter of hours. The Internet also enables an attacker to perform an attack over long distances with little chance of detection and even less chance of apprehension. The ability to carry this out more or less anonymously, at low cost, and with little chance of being caught, encourages attackers. Because of well-publicized break-ins there has been a steadily increasing demand for encryption and related security measures to be included in software products. Unfortunately these measures often consist either of "voodoo security" techniques where security is treated as a marketing checkbox only, or are rendered ineffective by the US governments refusal to allow non-americans access to the same security measures which it allows its own citizens. Organisations employing such (in)security systems may make themselves liable for damages or losses incurred when they are compromised. This paper covers the issues of using weak, US government-approved security as well as problems with flawed security measures, examines some of the measures necessary to provide an adequate level of security, and then suggests several possible solutions.

4 3

German Draft Digital Sigature Law
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Tue, 29 Oct 1996 02:06:50 EST Reply-To: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> Sender: Law & Policy of Computer Communications <CYBERIA-L(a)LISTSERV.AOL.COM> From: Christopher Kuner <100442.3075(a)COMPUSERVE.COM> Subject: German Draft Digital Sigature Law To: CYBERIA-L(a)LISTSERV.AOL.COM For your information, my translation of the German Draft Digital Signature law is now available on my homepage "Law of Electronic and Internet Commerce in Germany" (http://ourworld.compuserve.com/homepages/ckuner) Christopher Kuner, Esq. Gleiss & Partners Gaertnerweg 2 60322 Frankfurt, Germany tel. 49-69-955140 fax 49-69-95514198 e-mail 100442.3075(a)compuserve.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

[Fwd: Re: Looking for Cryptographic Expert who Knows SSL]
by jch＠vdsi.com 17 Dec '03

17 Dec '03

1 0

Japan tightens crypto export restrictions, from The Netly News
by Declan McCullagh 17 Dec '03

17 Dec '03

The Netly News http://www.netlynews.com/ October 29, 1996 The Japan Factor By Declan McCullagh (declan(a)well.com) In a move designed to stem the global availability of products that use strong encryption technology, Japan last month succumbed to U.S. pressure and dramatically tightened its export restrictions, The Netly News has learned. The restrictions amount to a stranglehold. Officials from Japan's Ministry of International Trade and Industry (MITI) characterize the shift as a very small change, but the new rules require businesses to seek prior government approval for any overseas crypto-order that totals more than 50,000 yen, or about $450. The previous limit was 10 million yen, around $91,000. "We made a very small change of the licensing exception of limited value," says Jun Takashina, the deputy director of the Security Export Control Division at MITI. Takashina denied that the U.S. pressured Japan. "It's our decision. We didn't have any pressure from the United States." Japan says its regulations are designed to codify the "Wassenaar Arrangement" on export controls for armaments and advanced technology, which was crafted over a two-year period to replace the Cold War-era COCOM treaty and was signed in July by over 30 countries. "In the Wassenaar Arrangement, we have consensus to cooperate -- not coordinate, but cooperate," Takashina said. "In this sense we influence each other. We cooperate in our regulations to achieve the same purpose." In implementing the agreement, Japan relaxed controls on many products -- and, tellingly, only tightened the regulation of encryption. However, other countries that signed the agreement have not done the same. Japan's move follows a hot summer of even hotter debate on Capitol Hill, where Justice Department officials claimed that criminals use PGP to scramble files and software company executives testified that current regs cost U.S. industry millions. Boosting the political temperature further was RSA Data Security's announcement in June that NTT and RSA's Japanese affiliate were ready to ship a triple-DES chip more secure than anything U.S. manufacturers are permitted to sell overseas. Privacy advocates quickly heralded it as exposing the fatal flaws in the Clinton administration's regulations. Phil Zimmermann, inventor of PGP, told me at the time that "the Japanese took over the American television manufacturing industry" and are poised to take over this one unless Congress approves the Pro-CODE bill. This widely-publicized announcement almost certainly prompted Japan's new crypto-muzzling decision. The company's president, Jim Bidzos, says that Tokyo has started to "look a little closer" at its encryption policies. "With all the press about NTT chips and whatnot in Japan, the U.S. government is going to try to stem the flow." (One White House scheme designed to do just that is the soon-to-be-announced creation of an ambassador-level position whose sole job will be to marshal international support for U.S. crypto policy.) Stewart Baker, former NSA general counsel, calls Japan's move a sign that the country's leaders are awakening to -- and are sensitive to -- the U.S. government's position. "This is a signal that they did not want to be at the center of the policy debate over export controls if they could avoid it," he says. "As [the policy] gets covered in the New York Times on the front page, the Japanese government focuses more attention.... This is a reflection of concern that that kind of story is not good for Japan," says Baker, who recently wrote about Japan's stance on encryption in Wired. The key question, though, is how strictly will Japan enforce the new regulations? The Wassenaar Arrangement is designed to keep arms and technology out of the hands of rogue countries, but companies in Silicon Valley already are complaining that Japanese shipments of data-scrambling hardware are being delayed. And the fine print of the new Japanese regs seems to require the end user's name and address -- which is impossible for U.S. distributors to provide. I think Marc Rotenberg, director of the Electronic Privacy Information Center and international crypto-watcher, has it right. Today he said to me that U.S. crypto isn't our biggest export in this area; instead, it's U.S. crypto policy. I agree -- and I say that's where we need more government intervention. Any government employee or erstwhile crypto-czar who wants to export a dumb crypto policy should be required to say why it should be allowed to infect other countries. I'm sure Japan won't mind. -- By Declan McCullagh (declan(a)well.com) with reporting by K. N. Cukier (100736.3602(a)compuserve.com) Wassenaar Arrangement: http://www.dfat.gov.au/dfat/dept/isd/peace_and_disarmament/pd_4_96/pd10.html RSA announces NTT chip: http://www.eff.org/pub/Publications/Declan_McCullagh/cwd.got.away.0696.arti… U.S. to create crypto-ambassador: http://www.netizen.com/netizen/96/43/index3a.html Stewart Baker on Japan's crypto-politics: http://www.hotwired.com/wired/4.09/es.crypto.html Marc Rotenberg on OECD crypto-politics: http://www2.eff.org/~declan/global/japan/rotenberg.reply.102896 ###

1 0

Anyone going to "Computers & The Law III"?
by Alex Newman 17 Dec '03

17 Dec '03

Hi all, I'm Alex Newman, on of the conference organizers for "Computers & The Law III", Dec 1-4, 1996 in San Jose, CA. The theme this year is "Assessing the Internet Threat". I was wondering if there was anyone in the San Francisco/Silicon Valley area who was going to be there who wanted to sit on a panel about the CDA. Drop me a line if your interested. If you just want more information about the conference, take a look at www.sug.org/CL3 or send mail to conference(a)sug.org --a Alexander Newman Sun User Group troll(a)sug.org 1330 Beacon St., Remember, to die with honor (617) 232-0514 voice Suite #344 ...you still have to die. (617) 232-1347 fax Brookline, MA 02146

1 0

copyright violations
by jacobs＠tfn.com 17 Dec '03

17 Dec '03

FYI, American Banker and all sister publications are copyrighted material. As such, only very few select third parties have permission to redistribute our material. Please notify us immediately of any third party contacting you with our material so that we may protect our copyright. Do not redistribute any information you receive from a third party.

2 1

Dimacs workshop on network threats?
by Adam Shostack 17 Dec '03

17 Dec '03

Anyone else planning to go to the DIMACS workshop on network threats? December 4-6 at Rutgers. http://dimacs.rutgers.edu/Workshops/Threats/index.html Seems like its shaping up to be a fun workshop. Adam -- "Every year the Republicans campaign like Libertarians, and then go to Wasthington and spend like Democrats." Vote Harry Browne for President. http://www.harrybrowne96.org

2 1