December 2003 - cypherpunks-legacy

No Subject
by azur＠netcom.com 17 Dec '03

17 Dec '03

I came across some interesting passages in the RAND Corp. study, An Exploration of Cyberspace Security R&D Investment Strategies for DARPA: "The Day After ... in Cyberspace II", MR-797-DARPA. http://www.rand.org/publications/MR/MR797 The report describes the results of an exercise sponsored by the Defense Advanced Research Projects Agency (DARPA) using the RAND "The Day After..." methodology to elicit the views of participants on research and investment strategies addressing the security and safety of systems and networks supporting various U.S. physical and functional infrastructures. The exercise was held on March 23, 1996 in Washington D.C., and involved approximately 60 participants from government, universities, and commercial industries involved with the U.S. information infrastructure. Has this report been discussed on the list? ---------------- Is it possible to "sterilize" data passing through our telecommunications systems? Billions of bits of data pass through our national information infrastructure each second. Some of those bits represent information about individual citizens' login and password combinations, social security and credit card numbers, account information, health status, and innumerable other sensitive information items. Our nation has superb communications monitoring tools, housed primarily in the National Security Agency. However, the NSA is precluded by law from collecting information about U.S. citizens. When incidents of "information warfare" are being waged against U.S. systems, could key data flows be "sterilized" or "sanitized" by computer hardware and/or software in such a manner that the NSA could help monitor and track perpetrators in cyberspace without violating these laws? This topic was raised during exercise discussions. We have not studied all the relevant laws and regulations to assess whether such sterilization measures would allow the power of NSA's analyses to be brought to bear on telecommunications involving U.S. citizens, but perhaps the topic merits further investigation. If so, what kinds of pattern detection and replacement algorithms would suffice to accomplish this goal? Sponsor development of an aircraft-like "black box" recording device When a cyberspace security incident happens, it is often not detected in real time, and the trail back to the perpetrator becomes lost. Could a "black box" recording device be developed, to be attached to key nodes or links of cyberspace systems, that would record every transaction passing through that node or link during the last n minutes (where n=5 or 10, for example)? If so, that record would be invaluable in tracing the source of incidents, whether they are accidental or deliberately perpetrated. Thousands of such systems would be required to cover key links or nodes; could they be made robust, inexpensive, and ultra-reliable? PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Hacker Opportunities (Let's Make Lots Of Money) I've got the brains, you've got the tricks Let's make lots of money You've got the code, I've got the hacks Let's make lots of ... I've had enough of scheming and messing `round with jerks My crypto code's compiled, I'm afraid it doesn't work I'm looking for a partner, someone who gets things fixed Ask yourself this question: do you want to be rich? I've got the brains, you've got the tricks Let's make lots of money You've got the code, I've got the hacks Let's make lots of money You can tell I'm educated, I studied at CalTech Doctored in mathematics, I could've been set I can program a computer, choose the perfect time If you've got the inclination, I have got the crime Ooooh, there's a lot of opportunities If you know when to take them, you know There's a lot of opportunities If there aren't, you can make them (Make or break them) I've got the brains, you've got the tricks Let's make lots of money Let's make lots of ... You can see I'm single-minded, I know what I could be How do you feel about it? Come, take a walk with me I'm looking for a partner regardless of expense Think about it seriously, you know it makes sense Let's (Got the brains) Make (Got the tricks) Let's make lots of money (Money) Let's (You've got the code) Make (I've got the hacks) Let's make lots of money (Money) I've got the brains (Got the brains) You've got the code (Got the hacks) Let's make lots of money (Money) Money!

2 1

No Subject
by almika 17 Dec '03

17 Dec '03

unsuscribe cypherpunks

1 0

RE: considering internet/privacy periodical
by blanc 17 Dec '03

17 Dec '03

From: Greg Broiles I see it not as a business but more like a way of organizing what I'm thinking about already in a way that might be interesting to others. ................................................................................... Once you create your web newsletter and see how many hits you get, you can better gauge the interest. In any case, you will have your thoughts and references organized and can always use it in your communications to others on mailing lists or newsgroups, etc. Since there's so much info on the net, one of the most valuable elements to introduce into it, besides search engines, is the organization of all that data in ways which make sense and speeds up the time involved in grasping the issues. Plus, of course, if you give it a libertarian/anarchist slant, it would be an added "feature" for certain people. Like Cpunks. .. Blanc

1 0

One-time password logic/code/information?
by Mike 17 Dec '03

17 Dec '03

I am looking to write a sort of password server replacement for NIS, and I am curious as to white papers, or otherwise information on authorization scheme's for this type of application. Regards, - Mike

1 0

MASTERCARD TO TEST IBM DIGITAL WALLET;
by amp＠pobox.com 17 Dec '03

17 Dec '03

Date: Mon, 28 Oct 1996 09:35:00 -0500 (EST) MASTERCARD TO TEST IBM DIGITAL WALLET; Software Will Open Market to Electronic Commerce MasterCard International Inc. this week expects to begin testing its digital wallet developed by IBM Corp. and will offer some of its customers incentives to use the product. The move is expected to advance widespread acceptance of electronic commerce and increase opportunities for Internet service providers (ISPs) and software developers looking to capitalize on what analysts say will be a huge market. The digital wallet, containing a digital ID card, should be available to the mass market in the second half to end of 1997, said Steve Mott, senior vice president of electronic commerce/new ventures at MasterCard. After the IBM test, MasterCard will work with another set of vendors and continue testing through the first half of '97, he said. The other vendors probably will be CyberCash Inc., Netscape Communications Corp., VeriFone Inc., Fujitsu, and Open Market, Mott said. In the first quarter of '97, testing will involve five to 10 merchants and 1,000 card holders, he said. The IBM digital wallet, part of IBM's CommercePOINT family of products, is used with Netscape Navigator and incorporates the SET (Secure Electronic Transaction) protocol. Mott said MasterCard wants to seed the market with the IBM product. "They're going to be our guinea pigs," he said. In the next few weeks, Mott said, MasterCard will announce agreements with U.S. banks, but declined to name them. Next month, MasterCard expects to release from its Web site the SET Reference Implementation Code, which will show developers how to build SET applications, he said. The implementation code, being developed by Terisa Systems Inc., offers "an unambiguous application of the code" to be used to build interoperable software, he said. SET will make credit card transactions more secure because it provides confidentiality for payment information, insures integrity for transmitted data and provides authentication. Ken Mohr, product marketing manager at Terisa Systems, said Visa International Inc. and MasterCard are reviewing the first beta version of the implementation code. The company is scheduled to deliver the second beta version next month, he said. Terisa Systems hopes the second beta will be the last version and that Visa and MasterCard will accept the implementation code in the first quarter of '97, Mohr said. Visa Testing in Europe Visa also is moving forward with efforts to implement SET. Last week, it announced a pilot launch in Europe involving 38 Visa members in 16 countries. A number of banks will be able to offer secure electronic commerce within six months; full implementation of the project will begin in the first quarter of 1998. "Electronic commerce will be global in nature, so it is important we begin work on an international basis," Visa EU President Hans van der Velde said in a prepared release. "SET is now robust enough to go to the single worldwide market offered by the Internet and other networks," he said. Some vendors already have SET-ready products available. VeriFone has its Internet Payment Solution that includes vPOS, vGATE and vWallet to cover the three parts of an electronic transaction. Wells Fargo Bank is one of VeriFone's initial customers. The bank is implementing vPOS and expects to launch the service to merchants in mid-November, spokeswoman Janet Otsuki said. CyberCash has a Secure Internet Payment System with a CyberCash Wallet, Secure Merchant Payment System and CyberCash Gateway Servers. The system has been operational since April 1995. GTE has CyberTrust, which provides digital certificates that are issued over the Internet to consumers with credit cards, Internet merchants and institutions processing transactions. Terisa Systems is working on an as-yet-unnamed product to implement SET into its SecureWeb Toolkit. A beta version will be ready by year's end, Mohr said. Michael Goulde, an analyst with the Patricia Seybold Group, predicted that the SET protocol will greatly lessen the perceived risk of doing retail business over the Internet in 12 to 18 months. But, in a report written this month, he cautioned that there are barriers to electronic commerce. "Consumers won't install the software until it is seen as providing benefits, there won't be benefits until merchants support SET, and merchants won't support SET until consumers have the software. "This vicious cycle probably won't be broken unless Microsoft provides SET-compliant software as an integral part of Windows in 1997," Goulde said. James Miller, a research scientist at the World Wide Web Consortium (W3C), predicted SET won't be widely available until Christmas '97. He said consumers will take to electronic commerce when one or two large companies figure out that security isn't such a huge issue for consumers and go ahead with electronic commerce. In the meantime, W3C and CommerceNet have completed specifications for the Joint Electronic Payments Initiative (JEPI). JEPI provides a universal payment platform to allow merchants and consumers to do business over the Internet using different forms of payment. The SET protocol was scheduled to be included in the first phase of JEPI, but work on SET was not completed in time, said Daniel Dardailler, JEPI project manager. A second phase should begin by the end of the year, and several companies, including VeriFone, have agreed to participate, he said. The second phase, which is not publicly available, will set out to validate the Universal Payment Preamble (UPP) logic put forward in the first phase and add more payment systems, such as SET, and micropayments, such as CyberCoin, Ecash and Digital Millicent, Dardailler said. JEPI is a standard mechanism for Web clients and servers to negotiate payment instrument, protocol and transport between one another. It has two parts -- Protocol Extensions Protocol (PEP), an extension layer that sits on top of http, and UPP, which identifies the appropriate payment methodology. More information is available at (http://www.w3.org/pub/WWW/Payments) For more information, contact MasterCard at (914) 249-4606, IBM at (914) 766-1162 or Terisa Systems at (415) 919-1776. =30 30 30= ------------------------ Name: amp E-mail: amp(a)pobox.com Date: 10/28/96 Time: 23:03:26 Visit http://www.public-action.com/SkyWriter/WacoMuseum EARTH FIRST! We'll strip mine the other planets later. ------------------------

1 0

(no subject)
by Arnaldo Giacomitti Junior 17 Dec '03

17 Dec '03

unsuscribe cypherpunks

4 4

BankAmerica, First USA to Use Net Software From Verifone
by se7en 17 Dec '03

17 Dec '03

BankAmerica Corp. and First USA Paymentech have bought Verifone Inc.'s payment software for the Internet. They will use VGate and VPos, Verifone's Internet commerce gateway and merchant software. Terms of the deals were not disclosed. A third piece of Verifone's electronic commerce offering, VWallet, will be available once the MasterCard-Visa Secure Electronic Transactions protocol for credit card payments on the Net is adopted. Banks can use the Verifone technology to deliver private-labeled Internet commerce services to merchant customers. BankAmerica and First USA Paymentech join a user list that includes Wells Fargo & Co., Royal Bank of Canada, and Hitechniaga/MBf Group of Malaysia. BankAmerica's merchant services unit, which recently announced an initial public offering as a stand-alone business, processes credit and debit card sales for more than 150,000 merchants. First USA Paymentech ranks third in the merchant business. Its credit card issuing affiliate, First USA Bank, is one of the largest. Roger Bertman, a vice president at Verifone, said the reason these banks "are investing heavily in building the infrastructure" is because "the credit card will be the preeminent [on-line] payment instrument." se7en -------------------------- Majordomo list for Lam3rz: email majordomo(a)edm.net subscribe happyhacker MUWAHAHAHAHAHAHAHAHA! --------------------------

1 0

Fed Ct hrg re Diffie-Hellman & Hellman-Merkle patents
by Greg Broiles 17 Dec '03

17 Dec '03

A hearing is scheduled in federal district court in San Jose for 10/30 at 10:00 AM on _Schlafly v. Public Key Partners_ and _RSA Datasec v. Cylink_. The hearing is on defendant Cylink's motion(s) for summary judgment regarding the validity of the Diffie-Hellman and Hellman-Merkle patents. The district court is located at 280 S. First in San Jose. Judge Williams is in Courtroom 4 on the 5th floor. There are 12 matters scheduled at 10:00 AM so it's unlikely that this matter will be heard at exactly 10:00. (It's listed as fifth in the court calendar in The Register and the Daily Journal, but I've got no clue about their algorithm for calling cases.) I don't know if it will be interesting or boring. The fewer metal things you bring the faster you can get through the metal detectors. More information is available at <http://www.cruzio.com/~schlafly> and <http://www.sec.gov/Archives/edgar/data/1005230/0000950005-96-000312.txt>. -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

4 4

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord post"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The winsock remailer does not accept plaintext messages. The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. When sending messages to AOL accounts, don't use mix, replay, or exon as the last remailer in the chain - testing shows them not to work. Last update: Mon 28 Oct 96 6:45:43 PST remailer email address history latency uptime ----------------------------------------------------------------------- cyber alias(a)alias.cyberpass.net ******++**** 34:37 100.00% jam remailer(a)cypherpunks.ca ************ 16:20 100.00% exon remailer(a)remailer.nl.com **##+##*##*# 1:58 99.98% squirrel mix(a)squirrel.owl.de ++++++++++- 2:45:35 99.91% winsock winsock(a)c2.org --.------.- 8:16:20 99.89% lead mix(a)zifi.genetics.utah.edu ++ +++++++++ 36:39 99.87% lucifer lucifer(a)dhp.com ++++++++ 36:32 99.86% balls remailer(a)huge.cajones.com ************ 5:59 99.67% dustbin dustman(a)athensnet.com +-+++-++-++ 1:13:59 99.58% replay remailer(a)replay.com *****+++**** 8:04 99.52% extropia remail(a)miron.vip.best.com ___.--.-.-- 17:10:17 99.16% haystack haystack(a)holy.cow.net +*#++##+*** 3:58 98.70% middle middleman(a)jpunix.com +--++ + +++ 1:38:10 98.14% death x(a)deathsdoor.com * 3:20 13.75% mix mixmaster(a)remail.obscura.com + 2:07:07 6.67% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Command confirmation request cancelled
by L-Soft list server at EDS (1.8b) 17 Dec '03

17 Dec '03

Your command: SIGNOFF COOL_TRAVELS has remained unconfirmed for more than 48h and is being cancelled. If you did want it executed but were unable to send the confirmation in time, just re-issue the command to get a new confirmation code. The one you were sent before can no longer be used.

1 0