December 2003 - cypherpunks-legacy

Re: Information [for new PGP user]
by Alan Olsen 17 Dec '03

17 Dec '03

At 07:08 AM 11/7/96 -0800, Dale Thorn wrote: >stewarts(a)ix.netcom.com wrote: >> You can read and compile the source code yourself. > >[snip, snip] > >Really? All 60,000 or so lines, including all 'includes' or attachments? > >I'll bet you can't find 10 out of 1,000 users who have read the total source, >let alone comprehended and validated it. Depending on the system, compiler and version of PGP, compilation may or may not function as expected. I have had a number of odd problems compiling the code for the PC over the years. (It has always compiled easily on the Unix boxes I have used.) The "gorrila" version on the Cypherpunks FTP site does not want to compile at all. (It wanted specific libraries that were not in the version of the compiler I was using.) Microsoft's compiler had a few odd problems as well with some of the earlier versions. (I think I was compiling PGP 2.6 with VC++ 7.0.) Also, you have to have the compiler in the first place. The latest compilers are getting pretty big. (100+ megs!) Most people either do not have the disk space, the money for them (or do not know where to get free ones), or the needed arcane knowledge to get the compile to happen at all. (And if there was a subtile bug in the code, most people would not be able to find it. This includes many programmers.) BTW, there is a Windows95 console version of the International version. (Check out http://www.ifi.uio.no/pgp/download.shtml for versions available.) It is the "non-us approved" version, so use at your own risk. My problem with PGP is that there is no protection for information on what keys are on your secret keyring. It would be quite possible to create a program that read the keyring and saved off the names of all nyms and truenames it found there. (It would make it quite easy to then find out that "Nym X" is associated with "User Y".) And with Active X, it could be offloaded to a remote site without anyone being the wiser... --- | "Remember: You can't have BSDM without BSD." - alan(a)ctrl-alt-del.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.teleport.com/~alano/ | alano(a)teleport.com |

1 0

(Fwd) Re: Euro Key Escrow
by Peter Trei 17 Dec '03

17 Dec '03

>From the SSL-users mailing list. ------- Forwarded Message Follows ------- Subject: Re: Euro Key Escrow To: ben(a)algroup.co.uk Date: Thu, 7 Nov 1996 13:42:16 +0100 (NFT) Cc: cypherpunks(a)toad.com, ssl-talk(a)netscape.com, ssl-users(a)mincom.com, ietf-pkix(a)tandem.com, ben(a)gonzo.ben.algroup.co.uk From: um(a)c2.net (Ulf =?ISO-8859-1?Q?M=F6ller?=) > It is, apparently, true that the EC is considering schemes for key escrow, by > "trusted third parties" There is an extensive survey at the European Cryptography Resources page, http://www.modeemi.cs.tut.fi/~avs/eu-crypto.html The EU commission's group DG XIII has been discussing key escrow for quite some time, but they have not yet been able to agree on a position. Jerome Thorel has posted some rather scaring interviews with EU official David Herson who is in favor of a key esrow scheme. Victor Mayer-Schoenfelder reports that crpyo regulation is likely to be delegated to the more liberal DG XV. A number of member states, such as Denmark, very unlikely to accept key escrow. > ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps Ross Anderson has analyzed Mitchell's scheme, drawing the conclusion that "The GCHQ protocal is very poorly engineered." See ftp://ftp.cl.cam.ac.uk/users/rja14/euroclipper.ps.Z > I'm informed that this is likely to be introduced into EC legislation, though > my understanding is that members are not required to actually incorporate the > legislation. No doubt France will embrace it with happy shouts. The final decision will almost certainly with the member states, because cryptography is considered essential for national security.

1 0

(Fwd) Euro Key Escrow
by Peter Trei 17 Dec '03

17 Dec '03

>From the SSL-TALK mailing list. ------- Forwarded Message Follows ------- Subject: Euro Key Escrow To: cypherpunks(a)toad.com, ssl-talk(a)netscape.com, ssl-users(a)mincom.com, ietf-pkix(a)tandem.com Date: Thu, 7 Nov 1996 09:21:55 +0000 (GMT) From: Ben Laurie <ben(a)gonzo.ben.algroup.co.uk> Cc: ben(a)gonzo.ben.algroup.co.uk Reply-to: ben(a)algroup.co.uk Someone, somewhere, posted a rumour that Europe was about to go for a key escrow scheme known as "Royal Holloway". I have done a little research and gleaned the following: It is, apparently, true that the EC is considering schemes for key escrow, by "trusted third parties" (trusted by who, I'd like to know?). "Royal Holloway" is one of these schemes. It is named after the college of origin, if anyone cares. It essentially revolves around each pair of TTPs sharing two out of three parts of a key, and generating the third part for each of their users. The idea is that either of the TTPs who generated keys for an encrypted message exchange can decode it (by using the private key of their "client" and the public key of the other TTP's "client"). Full details can be found at: ftp://ftp.dcs.rhbnc.ac.uk/pub/Chris.Mitchell/istr_a2.ps This is in PostScript. I'm not aware of any plain text versions. I'm informed that this is likely to be introduced into EC legislation, though my understanding is that members are not required to actually incorporate the legislation. No doubt France will embrace it with happy shouts. Of course, it is our duty as netizens to resist this kind of rubbish, and I encourage you to write to your MP/EuroMP (or local equivalent). Cheers, Ben. -- Ben Laurie Phone: +44 (181) 994 6435 Email: ben(a)algroup.co.uk Freelance Consultant and Fax: +44 (181) 994 6472 Technical Director URL: http://www.algroup.co.uk/Apache-SSL A.L. Digital Ltd, Apache Group member (http://www.apache.org) London, England. Apache-SSL author

1 0

Who owns cypherpunks
by Jim Ray 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit To: cypherpunks(a)toad.com Date: Fri Nov 08 02:39:25 1996 Jim Choate writes: > There is one important legal aspect which the operator of the Cypherpunks > mailing list has opened themselves up for with this action. In short > they > have now opened themselves up for defamation and liable suites by > imposing > an editorial policy on the contents of this list (1). I fear you mean "libel," and I think not. (see below.) <snip> > Censorship is censorship, irrespective of the source of the limitation. Oh good. I think I'll sue the Miami Herald for not printing my last letter to them. After all, they "censored" me, right? NOT!!! > Free expression is impossible in an environment of censorship. The right > to > speak not only implies a right to not speak, it also implies the right > to > emit complete mumbo jumbo. I'm afraid we have an excess of living proof around here, lately. <sigh> I am beginning to see why people vote the way they do... >The actual content of the speech is irrelevant. > > The Constitution guarantees freedom of speech and press. This does not > imply > in any way an abrogation of responsibility by the party speaking or > distributing it. Only that they would not have limitations on their > actions > imposed by the federal government. I am beginning to wonder if you are serious about promoting John to the level of "the federal government." If this was a joke and I don't get it, I ma sorry to have taken you seriously. > ARTICLE I. > > Congress shall make no law respecting an establishment of religion, > or prohibiting the free exercise thereof; or abridging the freedom of > speech, or of the press; or the right of the people peaceably to > assemble, > and to petition the Government for a redress of grievances. [Would that it were so, but...] John is not in the U.S. Congress, and even if he were, this list is _his_ property, not mine, and not yours. He can do with it what he likes. <snip> > I have argued in the past that this list is a defacto public list because > of > the way it is advertised and to the extent it is advertised. All the > protests > by the operator to the contrary will not convince a court. Name one ad for cypherpunks. This list is John's property, and he could cut us all off tomorrow for any reason or no reason. Deal with it. I seriously doubt that even the most socialistic judge in the U.S. (and there are plenty) would buy this kind of garbage. > Hope you folks have a good lawyer. I'm sure John's quaking in his boots. Reread my campground analogy, and try to refute it. You can't. Go start your own list with no moderation. Go start a more moderated list than John's, like Perry's will be. Do whatever, but this moronic thread must end! It is very strange to me that the people asserting some sort of "implied contract" among cypherpunks have yet to offer to pay even *one* month of John's costs. If you want to call the tune, then pay the piper (if he lets you). If you don't, then be quiet about what you're obviously ignorant about. JMR Please note new 2000bit PGPkey & new address <jmr(a)shopmiami.com> This key will be valid through election day 2000. PGP id.A7D63DA9 98 1F 39 BA 93 86 B4 F5 57 52 64 0E DA BA 2C 71 Please avoid using old 1024bit PGPkey E9BD6D35 anymore. Thanks. -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEPAwUBMoLjsTUhsGSn1j2pAQFE6AfQgbWxLHSqdGMsKEg+jUSlMIsctR8MIQ6i ZU+7JFoSiAREYIrsrlMs7AYsuzLvaGYLTdlT3reC9EvmWPchfawV+tYzBlKZkLs3 vS6PTghqovDheIiEmwr+E4zq9yuV/ElGs7ZOuO4Ob9LuwSx7Tm+m6OQNGuOoGjpV Y6Gc6vFZ2fEb/Yt3qadQF1Q2Zlf+qjVjglilOefoe2Q+7y7FhYysTvlLGqc42h0P M5J/fbZ3RtpT6dtkT7sqHvj4eZtDMpdn+bXseJkQv4jsbolTyTGR88ee3HU1P/I7 ywWPtOZdoPpP6lSraF0S+PxBOEpkeTRI84Xxw1Jbtblx9Q== =014g -----END PGP SIGNATURE-----

2 1

Re: Is there a Win PGP?
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Ben Laurie wrote: > > I did a port of PGP to a Windows DLL a long time back, but I never got > around to releasing it. I could bring it up to date and put it out > there if there is popular demand. I think that would be cool, especially given the growth in Windoze web servers and the halting start of PGP authentication for the web. Another WinPGP, of a sort, designed for email only, is FTP OnNet. You can get a demo from http://www.ftp.com/cgi/newmail.cgi They still haven't put any real export controls in place. - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMoI/9yoZzwIn1bdtAQGG+wGAsSx6NcpJHxOgI1bwa52M2Fogd29C4XmO iMr/eoKCWRj+vIHjbLhNsPT966WmgiWT =SKCU -----END PGP SIGNATURE-----

1 0

Copyright violations
by alzheimer＠juno.com 17 Dec '03

17 Dec '03

Financial Times: Tuesday, November 5, 1996 Visa Launches New Multi-Function Card By Mark Ashurst in Johannesburg Visa International yesterday launched its first multi-function smart cards in partnership with two South African retail banks, First National and Nedcor. The new cards combine debit, credit, and pre-paid facilities, by using a microchip in place of the traditional magnetic strip. Ms Anne-L. Cobb, president of Visa Central and Eastern Europe, Middle East and Africa, said the deal fulfilled "Visa's vision of the future of card payment products". Chip-based cards would replace paper-based and magnetic strip-based cash systems within 20 years, she said. South African banks were "very much in the lead" in developing this technology for debit and credit services. FNB and Nedcor have issued more than 200,000 multi-function cards, under their own brands, since the South African industry agreed on an inter-bank standard for smart cards in October, 1995. These cards will now be branded with Visa, and will be converted to international EMV, Europay-Mastercard-Visa standards by the end of next year. A common standard for card transactions in South Africa had been adopted later than in many developed countries, but was already close to the international EMV standards agreed earlier this year. The South African variant would "allow customers access to multiple accounts at their financial institution," said Ms Cobb. In time, the cards would also be used to encourage loyalty programmes and to store personal information. The Visa branding is expected to raise use of multi-function cards. Ms Gail Kelly, general manager of Nedcor card services, said the two banks would invest R5bn-R7bn (#651m-#912m) in upgrading technology at retail points and banking machines with the aim of issuing 1m new cards within a year. In June, Visa acquired the rights to the Universal Electronic Payments System, a software package used by South African banks to manage inter-bank cashflows. The group was "working with the two South African banks to implement the future platform" for global inter-operability, said Ms Cobb. South African banks have pioneered chip-based cards because of the country's poor telecommunications infrastructure and an over-reliance on cash in a society riddled with violent crime. It was initially devised by South African brewers as a safer and more efficient alternative to cash on delivery. Less than 30 per cent of credit card transactions are authorised on-line because of telecommunications problems. However, a microprocessor and memory chip embedded in the new cards keeps track of clients' spending, reducing the banks' risk in card transactions. This would make formal banking services more widely available to low income groups, said Mr Viv Bartlett, FNB managing director. The cards, secured by personal PIN codes, enabled "off-line transactions without the umbilical cord linking points of sale to mainframes". They could also be prepaid for use as "an electronic purse", which was a safer alternative to cash. Ms Kelly said the South African model should not be compared with current projects involving the use of smart cards for electronic commerce in Australia, France and Japan. "We are not testing. We are authorising credit cards and debit cards." Asiaweek: November 8, 1996 New Competitors and Technology Shake up Card Industry By Cesar Bacani and Julian Gearing You take pride in being a responsible credit-card user. You make sure you never exceed your credit limit. You avoid using cash-advance privileges even in emergencies. And every month, you pay in full the outstanding balance on your card on or before the due date. A model customer? Think again. Looking at your spotless payment record, the bank officer in charge of your account is likely to throw up her hands in despair and ask: "How can we persuade this cardholder not to pay on time?" The truth is that the people behind plastic money make the most profit from interest payments on overdue bills and cash advances. The problem: Asians generally don't like debt. "Many of the cards used in the region are debit cards, which deduct money from the holder's bank account as soon as a purchase is made," says Niall Brady, a senior researcher and analyst with the Dublin-based financial-services research organization Lafferty Group. The number of credit cards -- plastic that allows users to pay only a portion of what they owe every month -- is estimated at less than 310 million across Asia last year. That's not a lot in a region that is home to about half of humanity. But as Asians grow more affluent, card associations like Visa and MasterCard are betting they will be willing to take on more debt to finance their purchases. They see opportunities in the rising numbers of Asians traveling overseas and the liberalization of the financial-services industry. New players are joining them. American Express recently introduced a new credit card in Hong Kong. GE Capital has chosen Indonesia as the launch pad for its first card outside the U.S. "There will be a far more competitive environment in Asia for cards in five to seven years," predicts Steven Pinto, a vice-president at Citibank in Singapore. "With 2.7 billion inhabitants, this region has real potential," says Michael Lafferty, founder of the group that bears his name. How real? In the U.S., which has 276 million people, there is one credit card for every person. But some governments worry that easy access to credit may erode their people's traditional savings ethic, which is credited with sustaining the region's economic boom. Last week, Finance Minister Anwar Ibrahim required cardholders in Malaysia to pay the government an annual $20 service tax on each of their credit cards. About 42% of $1.7-billion worth of credit-card transactions in June was overdue. Kuala Lumpur already requires every cardholder to pay at least 15% of his outstanding balance. To understand what is happening, it helps to know how the card industry works. The major credit-card associations, Visa and MasterCard, provide the brand name and authorization service. Banks and other financial institutions buy shares in one or both groups, which makes them association members and gives them the right to issue Visa and MasterCard credit cards. The issuers make money from fees and interest on cash advances and overdue payments levied on cardholders. The associations are paid by issuers for every credit-card authorization they process and other services. American Express, Diner's Club and Japan's JCB issue charge cards, which require users to pay monthly balances in full. Amex has added a credit-card line to its traditional charge- card range. After launching its Optima credit card in the U.S. in 1987, it introduced the American Express Credit Card in Britain in 1995. The Amex plastic was brought to Canada, Hong Kong and Australia this year. Visa and MasterCard have asked their members to think twice before deciding to market the new product. The intramurals aside, all brands face tough challenges in Asia. "It's very easy to think that the Asian market is homogenous, but there are major differences," says Suresh Nanoo, regional director of brand management for Visa. Japan and Taiwan do not like debt. Malaysians, Singaporeans and Thais are more receptive, but their governments are not. "If everyone becomes a big spender, it could become a problem for the whole country," says Tarisa Watanagase of the Bank of Thailand, which early this year doubled the annual salary requirement for cardholders to $9,420. With just 14 million credit cards for its 1.2 billion people, China has huge potential. But tight controls there - only state-owned banks can issue plastic, for example - are stunting growth. Largely unfettered by government intervention, the Philippines, Indonesia and India are considered among Asia's best credit-card prospects. Indonesia had 1.4 million cards by the end of 1995. "Industry insiders believe it can easily support a card base of 4 to 5 million," says Brady. As for the Philippines, "the top five credit-card issuers, which [together] have averaged 33% annual growth since the early 1990s, had fewer than 700,000 cards last year" -- three times less than the potential immediate market. For its part, India is estimated to have up to 2 million cards. "The general consensus is that this could grow to as many as 10 million by 2000," says Brady. The problem is infrastructure. Telecommunications (for credit authorization] and postal systems (for billing) are often unreliable. The absence of credit-checking agencies makes screening card applications a headache. And a nationwide merchant network is not yet in place. This is where an international player's financial muscle and commitment make a difference. Citibank has become the leading credit-card issuer in India and Indonesia, and ranks second in the Philippines. It set up subsidiaries that focused entirely on credit-card operations, including card marketing and credit screening. Rivals like Hongkong Bank and Standard Chartered Bank are following Citibank's lead. "But local competitors are in the best position to develop the retail outlets where credit cards can be used," says Brady. "Only they have the on-the-ground presence needed to establish and service merchant-acceptance networks." Equitable Card Network, for example, boasts the largest merchant base -- 18,000 shops -- in the Philippines. Because of government curbs, credit-card firms are under pressure in Singapore (number of credit cards: 1.6 million) and increasingly so in Malaysia and Thailand (1.8 million each). "The most draconian of Singapore's restrictions came into force in August," says Brady. "It caps the maximum credit limit to twice the cardholder's monthly income. This also robs charge-card issuers like American Express and Diner's Club of their competitive weapon -- no pre-set spending limits." The government requires all cardholders to earn at least $21,275 a year -- more than four times the typical annual salary issuers in laissez-faire Hong Kong ask for. Not all restrictions have turned out badly for the credit-card industry. In South Korea, banks generally cannot extend card-based revolving credit -- debt that cardholders can run up so long as they pay off part of the principal and the interest owed every month. Credit cards thus function essentially as deferred debit cards -- payment is automatically debited from the cardholder's bank account. But issuers still earn money on interest payments. Because of Seoul's tight credit policy, Koreans make wide use of cash advances. The card associations profit from processing transactions involving the country's 33 million credit cards. MasterCard says Korea is its most profitable Asian market after Japan, which has 230 million cards. Tokyo allowed banks to grant card-based revolving credit in 1992. Four years on, only a fifth of Japanese consumers use plastic regularly and almost all clear their entire balance every month. Cash also remains king in Hong Kong, one of Asia's most mature credit-card markets. The territory, which has a population of 6.3 million people, has an estimated 5 million credit cards. But credit-card purchases account for only 5% of all transactions (22% in terms of value) and drawing cash advances on credit cards is not common. The purveyors of plastic are learning to flow with the cash tide. In Hong Kong, Visa is trying out VisaCash, a card that users can throw away after using up its money value. It can be used to make small purchases like newspapers in participating outlets. MasterCard Cash is more versatile: it's a debit card with a chip that can load and reload money from automatic teller machines. "You can use the debit function for big purchases and the cash for small items," says Margaret O'Connor of MasterCard in Singapore. The microchip in Hongkong Bank's Mondex cash card also reloads electronic cash, though the card itself cannot be used as a debit card market research indicates that many in Hong Kong are willing to pay for the convenience," says Manjoosh Joshi, manager of Hongkong Bank's Project Mondex. Won't these chip-based smart cards cut into credit-card use? "They complement each other," says Francis Hsu, a senior manager at Hongkong Bank's credit-card center. "Cash cards are for small-value transactions while credit cards are for big- ticket items." Amex president for Asia Stephen Friedman says: "Companies will just have to learn how to deal with smart cards." Some credit cards already use smart-card technology. Manila's Bankard One has a microchip that makes charge slips and signatures unnecessary. U.S. consultant Jerome Svigals, who helped develop the magnetic strip on today's cards, sees this as the wave of the future: "Smart cards will do away with on- line authorizations. That's bad for card associations, which gain 90% of their income from this service." An exaggeration, says Visa. "Cards cannot operate in a totally off-line environment," argues spokeswoman Sonja Kernon. Card associations get income from other services such as reconciling balances and settling accounts. There are other ways to make money. Some issuers charge merchants high rates for the privilege of carrying their cards. To encourage borrow-and-buy binges, others target young Asians, who are more willing to pile on debt. There are credit cards just for women, doctors and other professionals. Issuers are also developing proprietary brands, allowing them to bypass the card associations and sometimes to cut customer and other fees. All this means the poor consumer gets inundated by offers. How to choose? "Are you going to use the card simply as a convenient way of payment?" asks Brady. If so, consider a charge, debit or cash card. If you want credit, look for plastic with a low annual interest rate. And be wary of your emotions. "On the rational plane, you're going for reasonable fees, a reasonable rate of interest and a reasonable rate of merchant acceptance," says Citibank's Pinto. "But in status- conscious Asia, brands also matter. You ask yourself, `what does this card say about me?'" You'll have lots of choice - just read the fine print. GETTING THE MOST FROM YOUR CARD If you intend to pay the balance every month, you may be happier with a charge card, which has no pre-set spending limit. But there are killer surcharges on defaults and you get only a short grace period before the issuer cancels your card. If you plan to pay the monthly bill in full but still want a credit facility for emergencies, look for a credit card with no annual fee. The trade-off: a sky-high interest rate on overdue payments and cash advances. If you mean to pay only part of what you owe every month, shop around for a credit card with the lowest interest rate. American Express has shaken up the Hong Kong market with an 18% interest rate on its new credit card, 6 percentage points lower than the competition. Check out the card's market acceptance. Many shops may not take the brand. Or they may slap a surcharge on purchases, even though it violates their agreement with the issuer. Look at the incentives on offer. As competition heats up, issuers are coming up with frequent-flyer programs, hotel discounts and free merchandise. But make sure you are not required to spend a huge amount before you can get the freebies. Washington Post: Monday, November 4, 1996 Internet Banking With a Sales Twist By Brad Dorfman As the world's first Internet bank, Atlanta-based Security First Network Bank has had an identity problem with many potential customers. "We get a lot of questions," chief executive James Mahan III said. " 'Are you real? Are you virtual? Where are you really?' " Part consumer bank, part software testing site, Security First opened its virtual doors a year ago this month. But now it plans to add actual doors, opening small offices in Atlanta, Cambridge, Mass., and Silicon Valley in California. "I think we can more effectively market if we have a physical presence," Mahan said in an interview. Comparing his bank to discount brokerage firm Charles Schwab & Co., Mahan said having the offices may give customers a sense of security, even if they never use an office. Security First's current location is on the Internet. The bank is one of five in the United States that operate directly on the Internet, according to the Bank Administration Institute. Federally insured Security First can be reached at the Web site www.sfnb.com, a home page that looks like a bank lobby. Customers can reach their accounts anywhere they have access to the Internet, rather than being tied to a single terminal where they have finance software, as is true with many other computer banks. "Our goal was to have a bank that was fully interactive, where an individual could see all his information," Mahan said. Most Security First customers have a money market account and a demand deposit account. Customers can open an account with $ 100, an amount most choose at the start to make sure the bank works, Mahan said. Customers can pay bills electronically, purchase certificates of deposits or acquire Visa cards. Security First also is hoping to offer brokerage products and first and second mortgage products by the end of the year. Cash can be obtained through automated teller machines, and Security First absorbs interbank fees for using the machines. With few costs for rent and other infrastructure, Security First can offer higher yields, Mahan said. The bank has been offering a six-month CD with an annual percentage yield of 5.9 percent. Security First was spawned as an idea of Mahan, who was chief executive at Kentucky-based Cardinal Bancshares Inc., and Michael McChesney, who was starting a security software firm. "He educated me on the Internet for years and years and years," Mahan said. Mahan used the charter of one of Cardinal's thrifts, changed its name to Security First and used it to start the Internet bank. McChesney's firm, SecureWare Inc. developed software that Mahan said has military-grade security. So far, the bank has not had its security breached, Mahan said. "That doesn't mean that there haven't been a number of sophisticated attempts," he said. "If you have enough money and enough time you can break into anything." Outsiders agree that Security First has shown a record of being secure, avoiding viruses and other potential dangers of Internet commerce. "They do use a level of security that the Pentagon reserves for its most secure and sensitive systems," said Paul Schmeltzer, an executive vice president for network services at Southeast Switch Inc., which operates the Honor Network, the fourth-largest ATM network in the country. "Is any security design totally foolproof or totally secure? Probably not." Selling that software and other programs developed for the bank is likely to be the prime money-maker for Security First. Mahan admits that Five Paces Inc., Security First's software unit, will be the prime contributor to the company's net income. "The bank is really a test site to use as a demonstration for potential customers of the software business," said Gary Craft, an analyst who follows the bank for Friedman, Billings, Ramsey & Co. of Alexandria. Security First has opened about 5,600 accounts. Most of its customers are male, between the ages of 25 and 45, with average income above $ 63,000 a year. More than 80 percent own their own home, attractive demographics for marketing. Security First also has attracted competition. This month, Atlanta Internet Bank opened for business with customers of AT&T's WorldNet Internet service. Unlike Security First, Don Sha pleigh, chief executive of Atlanta Internet, says he does not plan to open any customer offices. "I have the WorldNet. I have other ways to get out." Shapleigh also argues that Atlanta Internet is the first true Internet-only bank, saying that Security First is really a software company. "I'm not selling software," he said. "I'm a banker." Atlanta Internet, which is a service provided by a unit of Carolina First Corp., can be reached on the Internet at www.atlantabank.com. American Banker: Wednesday, November 6, 1996 Internet Bank In Australia Plans a Pilot Using Ecash Ecash, the cash alternative for the Internet developed by Digicash Inc., has entered Australia. Digicash, which is based in Amsterdam, said Advance Bank of Sydney has licensed Ecash and is planning to begin testing it with Australian consumers and merchants by yearend. Ecash's competitors include Cybercash Inc.'s Cybercoin and the on-line transfer capability of Mondex electronic cash. The latter, a smart-card- based system, has the backing of most major banks in Australia and New Zealand. Advance Bank, a second-tier bank with more than $10 billion of assets, joins a list of Ecash licensees that includes Mark Twain Bank of St. Louis, Deutsche Bank in Germany, Merita Bank in Finland, and a postal bank in Sweden. The Australian launching is "an important collaboration between the premier electronic cash company and the leading Internet bank in a country that is very advanced in Internet usage," said Digicash chairman and founder David Chaum. Advance Bank is "reinforcing its position as Australia's leading Internet bank," said David Brown, the institution's head of public affairs. He said Ecash would complement customers' ability to see account statements, transfer money between accounts, and pay bills through Advance's Internet site.

1 0

No Subject
by Jayme 17 Dec '03

17 Dec '03

PLEASE TAKE ME OFF YOUR MAILING LIST!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

1 0

Re: FW: Dr. Vulis is not on cypherpunks any more [RANT] (fwd)
by networks＠vir.com 17 Dec '03

17 Dec '03

Jim Choate Wrote: > Hi all, > > There is one important legal aspect which the operator of the Cypherpunks > mailing list has opened themselves up for with this action. In short they > have now opened themselves up for defamation and liable suites by imposing > an editorial policy on the contents of this list (1). > > This opens up the potential, for example, for Tim May to sue the operator of > the Cypherpunks mailing list now for posts from users (even anonymous ones) > which defame or otherwise liable his character, reputation, or ability to > pursue income in his chosen field. In short the operators of the list > becomes publishers and distributors of the material. It is the legal > difference between a bookstore and a book publisher. It seems that, like a bookstore, the cypherpunks mailing list has the right to choose the content it distributes and who it distributes the content to. Bookstores are free to select what titles they offer for sale, and can even refuse to sell a book to a particularly annoying customer if they so choose (my legal knowledge is lacking, but I think this is correct). To extend the analogy, what has happened in this particular case is that Dr. Vulis is now forced to buy all his books by mail order :) Thanks, Alan Majer networks(a)vir.com

1 0

Why is cryptoanarchy irreversible?
by ph＠netcom.com 17 Dec '03

17 Dec '03

It appears to be widely believed that cryptoanarchy is irreversible. Everybody believes that the race to deploy or forbid strong cryptography will define the outcome for a long time. I can't think of a reason why this should be so. If the wide use of strong cryptography results in widely unpopular activities such as sarin attacks and political assassinations, it would not be all that hard to forbid it, even after deployment. I am curious why many people believe this is not true. Peter Hendrickson ph(a)netcom.com

9 10

Re: Blocking addresses by default
by Rich Graves 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Mark M. wrote: > > -----BEGIN PGP SIGNED MESSAGE----- > > With remailer abuse becoming more popular and remailers going down > because of complaints, there seems to be some interest in remailer > software that will block all email by default and will only pass > along email that is explicitly unblocked. I think this threatens serious security problems for the remailer network in two ways: 1. You'd create a list of people interested in anonymous information, which could potentially be obtained by police or other armed thugs. 2. The traffic would go down so substantially that traffic analysis would be trivial. As a counterproposal, I'd like to see better disclaimers on remailed messages. The reason the people complaining are so pissed off is that the blocklists are neither advertised nor automated enough. I'd like to see disclaimers and block list instructions at the top of the body of every single message. This would be encapsulated in some mark characters so that it could easily be removed by remailer chains. E.g., To: remailer(a)erehwon.com Request-Remailing-To: remailer(a)nowhere.com [message] remailer(a)erehwon.com prepends the following to the message before it is sent along: $$ This message was sent through the anonymous remailer network. Neither the operator of this remailer, remailer-op(a)erewhon.com, nor the postmaster at this site has any way of determining the source or filtering the content of remailer messages. No logs are kept. If you do not wish to receive such anonymous messages from any link in the remailer network, send an email message to remailer-operators(a)c2.net with subject line "block." For more information on the remailer network, see [Raph's list] or send email to help@[?]. $$ remailer(a)nowhere.com looks for "$$" as the first line of the message, and strips everything up to the next occurrence of "$$". It then appends its own disclaimer block before sending the message to the hop (remailer or final destination). A bit annoying, yes, but I think this would go a long way towards improving public relations. I don't see how it compromises security. What's wrong with this scheme? Other than the fact that all remailers would have to change their software at the exact same moment. :-) [By the way, someone told me that the Chardos remailer doesn't include Complain-To or block-list instructions anywhere, not even in X-Headers. Is this true? I think that would be bad. [tm]] - -rich - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMoJFnCoZzwIn1bdtAQEZSwF/eurxI6jVBcv4srS8FEE3Rtc5rVCTfyw8 gNrC5p5ZzBGgFCaM3MOair4gH91zH/HK =oqSh -----END PGP SIGNATURE-----

3 2