December 2003 - cypherpunks-legacy

PINmail in the SCMP
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: somebody Date: Tue, 15 Oct 1996 15:13:07 +0800 To: rah(a)shipwright.com Subject: PINmail in the SCMP MIME-version: 1.0 (Created by TFS) Front page of the Technology Post section of the 15/10/96 edition of the South China Morning Post, next to a cheesy photo of the two men quoted in the article looking (peering?) through venetian blinds. Headline: Anonymous e-mail site launched. Byline: Keala Francis Highlights: "Hong Kong advertising agency Momentum has created an anonymous e-mail service for Internet users around the world." penet closed down "because it was perceived to be condoning child pornography. [Director] Tobin said PINmail (http://www.PINmail.com) was designed as an offshore address only for legitimate businesses, but the compay could not necessarily control its users." Tobin: "If there is proof of illegal activities, I would give up a name." "Momentum created and owns shares in AsiaFocus International, which owns PINmail." Access via Netscape 3.0. IExplorer due before December. (Uses CGI and Javascript in a way that is incompatible with IE3.0.) Daley (Momentum GM): "There are really no disadvantages to having your e-mail sit on a server rather than your PC." "PINmail can also allow you to maintain an anonymous address." "Momentum has set up three server sites in Hong Kong, California and Amsterdam to enable easier and more efficient access." PINmail = USD19.95/yr. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Camelot PRNG
by inssdl＠dstn21.dct.ac.uk 17 Dec '03

17 Dec '03

In the UK, the National Lottery is run by a company called Camelot (in case anyone didn't know) A while back, they introduced a new option, in that if you checked a certain box on your ticket, 6 numbers would be 'chosen' for you, presumably 'randomly' Does anyone have any info on how this system works? i.e. The PRNG used? Whether the PRNG is in the shop terminal or at the central computer @ Camelot? et cetera. (I am looking at the problems of PRSG for my Masters dissertation - hence the interest) Please reply either to the cypherpunks list or to my e-mail address if you think this doesn't have any crypto-relevance. Thanks in advance... ********************************************************************** David Lucas PGDip Software Engineering @@ BEng(Hons) Civil Engineering Postgraduate Software Engineer, University of Abertay Dundee, SCOTLAND @ E-mail: inssdl(a)dstn21.dct.ac.uk @ 2+2 = 5 for large values of two @ If you're not living on the edge, then you're taking up too much space Organisations can't have opinions, only people can and these are mine. Dave's Doorstep is back!!! - http://river.tay.ac.uk/~inssdl/index.html **********************************************************************

1 0

Re: FLY_not
by wa6ube＠ix.netcom.com 17 Dec '03

17 Dec '03

John Young writes: > >On 10/14/96 09:30:38 you wrote: > > 10-13-96. CoWo: > > "Encryption confusion" > > Reminded of the secret Clipper algorithm, I sought > details from IBM. I asked a spokeswoman why the company > hadn't just put out a nice, snappy white paper > explaining its new approach to key recovery. "We spent > three months trying to do that, quite literally," the > spokeswoman said. "It's pretty confusing stuff, and > whenever we get it on paper, we aren't happy with it." > > 10-12-96. InWe: > > "IBM Coalition May Not Fly" [Thanks, WR] > > "The relaxation on encryption is in many ways an > extortion of industry," said Bob Gargus, president of > the Atalla. "If this starts to happen for export, how > many companies will be able to support two standards? I > think every American should be worried." But Greg Simon, > domestic policy adviser to Vice President Al Gore, said, > "We're not looking for an answer that's universally > popular. We're looking for a solution that's balanced > and fair." > ----remainder snipped----- -----BEGIN PGP SIGNED MESSAGE----- I am curious, if there is this "coalition" of companies that have joined IBM on this new Key Recovery Plan, Has anyone yet found out who the other members of this coalition -----BEGIN PGP SIGNATURE----- Version: 4.0 Personal Edition iQCVAwUBMmOndMDUh3vt7LRPAQEsnQP8Cs9yUdETZjTdZPar236cavjWRspQI/vU 9W7DKgUu0QeknOVmmmfbhQSRx8o6W/NcelVG67hXzIE8Zui5LPBefOpOIr6qHOqc ySzLUXS7l0lq5a7Radc/+WoXM/WoHZXYHX6eU7HsJ7dosn7vZiMG2p75+06BBKA6 MCO5n68h2BU= =jy/0 -----END PGP SIGNATURE----- Patricia Gibbons <wa6ube(a)ix.netcom.com>

2 1

AW: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

On dinsdag 15 oktober 1996 14:09, Roy M. Silvernail[SMTP:roy@sendai.scytale.com] wrote: >-----BEGIN PGP SIGNED MESSAGE----- > >In list.cypherpunks, everheul(a)NGI.NL writes: > >> BTW, some people on the cypherpunks list seem to think that you can't = >> fraude with a *voluntary* system. However, that is possible: when you do = >> not comply with the *agreed* rules of conduct then the phrase "fraude" = >> is appropriate. >If the system is *voluntary* and I do not *agree* to participate, then I >*cannot* be breaking any "rules". That is correct. Sorry that the BTW-statement is so evident. Some people did not understand that if you *do* agree, then you *can* be breaking any rules... >>> Can you imagine what would happen if governments would (help to) set up = >> a system that has no safeguards at all, i.e. that could give criminals = >> all the anonimity and confidentiality they need? Governments can't = >> probably prevent criminals and the like to use encryption to stay out of = >> sight of law enforcement agencies, but they should not facilitate them = >> either. In the next few years all kinds of "standard" commerical = >> software will come on the market with all kinds of standard security in = >> it. I don't want criminals to be happy with Custom of The Shelf products = >> for security, let them work for their security. > >Which they will, and presumably already do. Therefore, your proposal >does not and cannot hamper criminals. Therefore, your proposal only >hampers law abiding citizen-units' access to uncompromised crypto. I do not agree. For instance, the encryption possibilities of wordperfect, and MS-word are weak; my mail-system (ms-exchange) does not have any encryption at all. The security of these important Custom of The Shelf products can and will be enhanced.. >No institution can expect compliance from a sector of society that, >by definition, does not agree to or follow the social contract. >Therefore, any and all such attempts to do so must be for the purpose of >controlling those citizen-units that do abide the social contract. To >claim otherwise is absurd. The point is that public available systems should *aid* not them in their criminal activities, let them search for alternatives. Compare it with the legislation we have here on the sell of guns. You sort of say: hey, that does not help cause criminals will get it somewhere. I say, that is true, but it will make their lifes more difficult, or maybe I should say less easy. > >> The bottom line is that law-abiding citizens = >> always have to give up some of their freedom to stop criminals (that is = >> why you have to have registration plates on your car, a lock on your = >> car, bicycle, house etc.). That is a fact of life; one I hate. > >Registration plates do not "stop criminals". Locks do not "stop >criminals" (although they might slow a criminal down). Neither will >compromised crypto "stop criminals". But all the above impinge on my >liberty. Am I to give up yet another freedom? Our system slows down criminals too, or maybe I'd better say does not speed them up. Locking my house and my car, certainly limits my freedom too because it gives me the risc of losing the key (happened a few times). Finding the middle of losing freedom by law-abiding citizens on the one hand and stopping criminals on the other hand is an important issue in any democracy. We believe our system gives a solution in which every democratic country on his own implement to their middle, without losing connectivity with countries that think otherwise.

1 0

extortion via digital cash
by scottb＠aca.ca 17 Dec '03

17 Dec '03

Hi, I have been reading numerous threads on digital cash, and I have some questions I would like discussed. currently when someone does extortion (kiddnapping too), they have two choices; 1-pick up the cash personally (or via a stooge) 2-transfer the funds via bank Both ideas are bad, in that you stand a good chance at getting caught. I was wondering, what if you demanded payment via Ecash, through nym servers, aliases, etc. From what I understand, it is just like cash, ie: no record of transaction, but you get the added bonus of not having to meet the other party-like a fund transfer. Once you have your 1,000,000 Ecash, you could dump it on a disk, and close your internet account (unless you really really trust your privacy technology). And I also think that you would have the option to cash this into real funds at either the Mark Twain bank, or likely somewhere in the Caymen Islands (maybe through those online gambling houses). I am hoping that this will spark some discussion, and maybe slow down the dlv, TM spam war. Also, I was only wondering about this for mere discussion reasons :) /sb

7 8

Key Exchange Request
by Mike Babcock 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Type Bits/KeyID Date User ID pub 1280/FA4C5DB1 1996/06/13 Michael T. Babcock <mbabcock(a)tyenet.com> Michael T. Babcock <mbabcock(a)cyberbeach.net> - -----BEGIN PGP PUBLIC KEY BLOCK----- Version: 2.6.3i Comment: http://www.cyberbeach.net/~mbabcock/PGP/ mQCtAzHAhC8AAAEFAMG+C+yN8q7KDT5TUSdyQNZlDDlTGuF4vUzPEq52lrqx7NAA YwJuj0dtOnnU2GAAonNutYF7nbbsS5yjWWgENioKOzIdjgDpq+YBZDkX4kFTD/+5 PM5EZhS1kT54zDpbjlZHtu9ViL3xUD/vp5zmp7Mlxqdd5SbkM0bpIBlBIqfpij59 hOVgc837YtAMmAbuRzwzy06/5ne221MLA/pMXbEABRG0KE1pY2hhZWwgVC4gQmFi Y29jayA8bWJhYmNvY2tAdHllbmV0LmNvbT6JAJUDBRAx2dcPTeL4zy9PtLMBAZ0+ A/9T8thIB2MW/0X0H4HTPNQ5TJlXM/56wxEtWNrr0Veku+lJvMdm6JvCDHqIfNC8 lTsWCg1Hot7EyNWhtXPp29A2fgLK/8hVJiFDs55ClWk9E4x3ug2mLZESid3qJO6U 3AnnzbI1ZuAelcX6tzJAYtJlbUz3t2y0pUloDUz7Uj4oGIkAlQMFEDHAhI2lZOCu UMiZpQEBcr0EAJP1lU3gJCidTwyHNlc16kybaTfECQz/TV7W+OqOcdH3mD3HKxUk J5KHRqTL4mS/tiiTmFEuFnwJaa36f+8ARkjq2EgmUX74ItfpcdplU3Sxe04om7Oy 7XNrgqWWpt+dEqQQqOLEVCTfuwNQck96GLLu1hZUXfrgDkpBT0rsl6cMiQC1AwUQ McCEMNtTCwP6TF2xAQGj3AT/VMMu5yZZTychDeLMfxsMse/xQ1/Ioi2UzApBdyiQ 7EVXWWHG0q5GGwGMiIsPeIFcbvF39DwSBX2BsBcnQh90wERdRsCo2BkG7Sw9Pk5a 13FDiXv+5eUDRsc0Z7z874vvpurzV1afuL+LKCAgOlxJhinikKqbR89AVLx4xRzl /BAyE4OBUfZZNIpshmtJdhSO/027WEAd6jXEHu3IkIl4+LQsTWljaGFlbCBULiBC YWJjb2NrIDxtYmFiY29ja0BjeWJlcmJlYWNoLm5ldD6JAJUDBRAxwIpqpWTgrlDI maUBAXnqA/0X+RTykzFUl0IMVVfJeb1JPMTBlq4vMwAdsipYTtHPMNfWNfp7hsUO Sk4/v1IzX0pEysHvQhD/Q56s0MYDd+gxMV17v0JnBI36wTgIEjOITMKUKShlHyWx RGCs0KmCt8NJ958IwRErbCw9EIdObX9JChzXTvGA91kpXYxOwpr6XokAtQMFEDHA ij/bUwsD+kxdsQEBtc4E+wUYFsgqjThhUxpBFBdRc0k1oXKzbVl+itKUtdfqOH1d Wc99PMkdttqVi3ME0xLNOfVLYg0lROyZqR8xZKLfKCGLoFWUE8kOFoL+VuZQ/Nuz VS0bArNMk8+ghbSiC82IFScQkFcvISkuDgMOyaDviNPbeb2QMhjkhP20NDLaX5tW UNSXfjUMJLCp33yNaM9/fwGAs6V21qeViJh9IFxUh04= =OAVt - -----END PGP PUBLIC KEY BLOCK----- This message was sent by Pronto Secure Mail. Above is my public key. Please send your public key by return mail. - --- [This message has been signed by an auto-signing service. A valid signature means only that it has been received at the address corresponding to the signature and forwarded.] -----BEGIN PGP SIGNATURE----- Version: 2.6.2 Comment: Gratis auto-signing service iQBFAwUBMmOzQyoZzwIn1bdtAQFCUQF9E1ggA7yYJ/mwRD98YF5ZFh+5yUz5YJy4 qCA7f+rprv4llxArrYTlZU/fAOwHmQ64 =OFUM -----END PGP SIGNATURE-----

1 0

Re: "Right to Privacy" and Crypto
by Duncan Frissell 17 Dec '03

17 Dec '03

>I'm of course just a layman, not a law professor or scholar. But I feel it >best that we not invoke a "right to privacy" to protect our crypto >abilities, when such a "right" apparently does not exist. > >However, certain things which _look_ like a "right to privacy" do exist: I agree with your analysis. It certainly matches what I was taught in law school. The rhetorical point I was making however is that a *practical* not constitutional right to privacy exists as long as your questioner eschews torture. I think it is useful to point out -- in response to government types who assert that "there's no absolute right to privacy" -- that they have actually set aside a zone of privacy by their rejection of torture as an interrogation technique. What this does is to remind listeners that coerced speech has an unsavory history and it turns the argument from one between absolute positions into one in which we are just arguing which sanctions should be applied when. DCF "Note that many governments have officially given up rape and torture as sanctions. (These were once universal.) All we have to do is get them to give up murder, imprisonment, and robbery as sanctions and we'll have civilized them completely."

3 2

Re: PLEDGES
by Sandy Sandfort 17 Dec '03

17 Dec '03

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ SANDY SANDFORT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Paul, You wrote: > What the hell, I'll spring for $200. It would be the needed > excuse to leave San Diego anyway. Wah whoo! This, plus some other new pledges puts us over the $1000 mark. Now all we need is some show of intestinal fortitude from Dimitri. S a n d y ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

2 1

Re: extortion via digital cash
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Hi, I have been reading numerous threads on digital cash, and I have some >questions I would like discussed. > >currently when someone does extortion (kiddnapping too), they have two >choices; > >1-pick up the cash personally (or via a stooge) >2-transfer the funds via bank > >Both ideas are bad, in that you stand a good chance at getting caught. > >I was wondering, what if you demanded payment via Ecash, through nym >servers, aliases, etc. From what I understand, it is just like cash, ie: no >record of transaction, but you get the added bonus of not having to meet the >other party-like a fund transfer. Once you have your 1,000,000 Ecash, you >could dump it on a disk, and close your internet account (unless you really >really trust your privacy technology). And I also think that you would have >the option to cash this into real funds at either the Mark Twain bank, or >likely somewhere in the Caymen Islands (maybe through those online gambling >houses). > >I am hoping that this will spark some discussion, and maybe slow down the >dlv, TM spam war. > >Also, I was only wondering about this for mere discussion reasons :) > >/sb Although Digicash's ecash offers anonymity to the payor it does not to the payee. The reasons have to do with the way coins are blinded. So LE could, with the bank's cooperation, easily associate the two sides of a transaction. This was intentional on Chaum's part, either for moral or practical political considerations. Its probably only a relatively minor patch to allow one ecash purse (the kidnapper's) to generate the blind token values so that another (similarly patched) purse (the vicitim's) can submit them to the mint and return the minted coins to the kidnapper (e.g., by posting on a popular Usenet group). In this scenario the only reasonable way left to track the money is via linkage (the size and timing of deposits and withdrawls in the kidnapper's account). PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

2 1

Re: Fuck Cyberpromo
by Peter Trei 17 Dec '03

17 Dec '03

> It seems to me that every time I send a message to cypherpunks, I get a 10k > message entitled "RESPONSE FROM CYBERPROMO" from "abusebot(a)savetrees.com > (Mail AutoResponder)" . >[...] > I would expect that if everyone on this list who gets one of these things > -- which I suspect is everyone who posts here lately -- turned right around > and sent it on to this wallace(a)cyberpromo.com address, those, er, > caprophageous cretins, (thanks, DCF; don't sue me for copyright violations > ;-)) would get the hint in a hurry. > > I'm starting with the one I have, and, of course, I'll also do it for the > message I get from sending *this* posting. > > Cheers, > Bob Hettinga Those of us who occasionally dip into that Slough of Despond known as news.admin.net-abuse.misc are *very* familiar with Mr. Wallace. Check out, for example, news:// 32617de2.18341458(a)news.onramp.net, where he is ignoring a court order to stop spamming. Bouncing mail back to him may be emotionally satisfying, but I suspect he filters it. He also has a skin as thick as a rhino's. Peter Trei trei(a)process.com Peter Trei Senior Software Engineer Purveyor Development Team Process Software Corporation http://www.process.com trei(a)process.com

4 3