December 2003 - cypherpunks-legacy

Re: considering internet/privacy periodical
by Adamsc＠io-online.com 17 Dec '03

17 Dec '03

On Sun, 27 Oct 1996 16:36:14 -0800, Greg Broiles wrote: >I'm considering putting together a periodic publication about the technical >and legal aspects of privacy and the Internet. My "business model" would >feature free WWW/email access with a charge for fax or postal delivery. I'm >curious to know if this strikes people as interesting or just Yet Another >Email Newsletter Of No Real Consequence. (no offense taken if it's the >latter.) If you did a real noise-removal job, this could be very useful. Sort of a privacy-RISKs digest, if you will. # Chris Adams <adamsc(a)io-online.com> | http://www.io-online.com/adamsc/adamsc.htp # <cadams(a)acucobol.com> | send mail with subject "send PGPKEY" "That's our advantage at Microsoft; we set the standards and we can change them." --- Karen Hargrove, Microsoft (quoted in the Feb 1993 Unix Review editorial)

2 1

RE: considering internet/privacy periodical
by blanc 17 Dec '03

17 Dec '03

From: Greg Broiles I see it not as a business but more like a way of organizing what I'm thinking about already in a way that might be interesting to others. ................................................................................... Once you create your web newsletter and see how many hits you get, you can better gauge the interest. In any case, you will have your thoughts and references organized and can always use it in your communications to others on mailing lists or newsgroups, etc. Since there's so much info on the net, one of the most valuable elements to introduce into it, besides search engines, is the organization of all that data in ways which make sense and speeds up the time involved in grasping the issues. Plus, of course, if you give it a libertarian/anarchist slant, it would be an added "feature" for certain people. Like Cpunks. .. Blanc

1 0

One-time password logic/code/information?
by Mike 17 Dec '03

17 Dec '03

I am looking to write a sort of password server replacement for NIS, and I am curious as to white papers, or otherwise information on authorization scheme's for this type of application. Regards, - Mike

1 0

Secure Internet-based Electronic Commerce: The View from Outside the US
by pgut001＠cs.auckland.ac.nz 17 Dec '03

17 Dec '03

I've just made a draft copy of this paper available for comment as http://www.cs.auckland.ac.nz/~pgut01/paper.htm, a copy of the introduction is given below. The whole thing is around 170K long (40 A4 pages when printed). If anyone has any comments to make on it, please let me know. Peter. Introduction ------------ The creation of a global electronic commerce system will provide an extremely powerful magnet for hackers, criminals, disgruntled employees, and hostile (but also "friendly") governments intelligence agencies. This problem is magnified by the nature of the Internet, which allows attackers to quickly disseminate technical details on performing attacks and software to exploit vulnerabilities. A single skilled attacker willing to share their knowledge can enable hordes of dilletantes around the world to exploit a security hole in an operating system or application software within a matter of hours. The Internet also enables an attacker to perform an attack over long distances with little chance of detection and even less chance of apprehension. The ability to carry this out more or less anonymously, at low cost, and with little chance of being caught, encourages attackers. Because of well-publicized break-ins there has been a steadily increasing demand for encryption and related security measures to be included in software products. Unfortunately these measures often consist either of "voodoo security" techniques where security is treated as a marketing checkbox only, or are rendered ineffective by the US governments refusal to allow non-americans access to the same security measures which it allows its own citizens. Organisations employing such (in)security systems may make themselves liable for damages or losses incurred when they are compromised. This paper covers the issues of using weak, US government-approved security as well as problems with flawed security measures, examines some of the measures necessary to provide an adequate level of security, and then suggests several possible solutions.

4 3

MASTERCARD TO TEST IBM DIGITAL WALLET;
by amp＠pobox.com 17 Dec '03

17 Dec '03

Date: Mon, 28 Oct 1996 09:35:00 -0500 (EST) MASTERCARD TO TEST IBM DIGITAL WALLET; Software Will Open Market to Electronic Commerce MasterCard International Inc. this week expects to begin testing its digital wallet developed by IBM Corp. and will offer some of its customers incentives to use the product. The move is expected to advance widespread acceptance of electronic commerce and increase opportunities for Internet service providers (ISPs) and software developers looking to capitalize on what analysts say will be a huge market. The digital wallet, containing a digital ID card, should be available to the mass market in the second half to end of 1997, said Steve Mott, senior vice president of electronic commerce/new ventures at MasterCard. After the IBM test, MasterCard will work with another set of vendors and continue testing through the first half of '97, he said. The other vendors probably will be CyberCash Inc., Netscape Communications Corp., VeriFone Inc., Fujitsu, and Open Market, Mott said. In the first quarter of '97, testing will involve five to 10 merchants and 1,000 card holders, he said. The IBM digital wallet, part of IBM's CommercePOINT family of products, is used with Netscape Navigator and incorporates the SET (Secure Electronic Transaction) protocol. Mott said MasterCard wants to seed the market with the IBM product. "They're going to be our guinea pigs," he said. In the next few weeks, Mott said, MasterCard will announce agreements with U.S. banks, but declined to name them. Next month, MasterCard expects to release from its Web site the SET Reference Implementation Code, which will show developers how to build SET applications, he said. The implementation code, being developed by Terisa Systems Inc., offers "an unambiguous application of the code" to be used to build interoperable software, he said. SET will make credit card transactions more secure because it provides confidentiality for payment information, insures integrity for transmitted data and provides authentication. Ken Mohr, product marketing manager at Terisa Systems, said Visa International Inc. and MasterCard are reviewing the first beta version of the implementation code. The company is scheduled to deliver the second beta version next month, he said. Terisa Systems hopes the second beta will be the last version and that Visa and MasterCard will accept the implementation code in the first quarter of '97, Mohr said. Visa Testing in Europe Visa also is moving forward with efforts to implement SET. Last week, it announced a pilot launch in Europe involving 38 Visa members in 16 countries. A number of banks will be able to offer secure electronic commerce within six months; full implementation of the project will begin in the first quarter of 1998. "Electronic commerce will be global in nature, so it is important we begin work on an international basis," Visa EU President Hans van der Velde said in a prepared release. "SET is now robust enough to go to the single worldwide market offered by the Internet and other networks," he said. Some vendors already have SET-ready products available. VeriFone has its Internet Payment Solution that includes vPOS, vGATE and vWallet to cover the three parts of an electronic transaction. Wells Fargo Bank is one of VeriFone's initial customers. The bank is implementing vPOS and expects to launch the service to merchants in mid-November, spokeswoman Janet Otsuki said. CyberCash has a Secure Internet Payment System with a CyberCash Wallet, Secure Merchant Payment System and CyberCash Gateway Servers. The system has been operational since April 1995. GTE has CyberTrust, which provides digital certificates that are issued over the Internet to consumers with credit cards, Internet merchants and institutions processing transactions. Terisa Systems is working on an as-yet-unnamed product to implement SET into its SecureWeb Toolkit. A beta version will be ready by year's end, Mohr said. Michael Goulde, an analyst with the Patricia Seybold Group, predicted that the SET protocol will greatly lessen the perceived risk of doing retail business over the Internet in 12 to 18 months. But, in a report written this month, he cautioned that there are barriers to electronic commerce. "Consumers won't install the software until it is seen as providing benefits, there won't be benefits until merchants support SET, and merchants won't support SET until consumers have the software. "This vicious cycle probably won't be broken unless Microsoft provides SET-compliant software as an integral part of Windows in 1997," Goulde said. James Miller, a research scientist at the World Wide Web Consortium (W3C), predicted SET won't be widely available until Christmas '97. He said consumers will take to electronic commerce when one or two large companies figure out that security isn't such a huge issue for consumers and go ahead with electronic commerce. In the meantime, W3C and CommerceNet have completed specifications for the Joint Electronic Payments Initiative (JEPI). JEPI provides a universal payment platform to allow merchants and consumers to do business over the Internet using different forms of payment. The SET protocol was scheduled to be included in the first phase of JEPI, but work on SET was not completed in time, said Daniel Dardailler, JEPI project manager. A second phase should begin by the end of the year, and several companies, including VeriFone, have agreed to participate, he said. The second phase, which is not publicly available, will set out to validate the Universal Payment Preamble (UPP) logic put forward in the first phase and add more payment systems, such as SET, and micropayments, such as CyberCoin, Ecash and Digital Millicent, Dardailler said. JEPI is a standard mechanism for Web clients and servers to negotiate payment instrument, protocol and transport between one another. It has two parts -- Protocol Extensions Protocol (PEP), an extension layer that sits on top of http, and UPP, which identifies the appropriate payment methodology. More information is available at (http://www.w3.org/pub/WWW/Payments) For more information, contact MasterCard at (914) 249-4606, IBM at (914) 766-1162 or Terisa Systems at (415) 919-1776. =30 30 30= ------------------------ Name: amp E-mail: amp(a)pobox.com Date: 10/28/96 Time: 23:03:26 Visit http://www.public-action.com/SkyWriter/WacoMuseum EARTH FIRST! We'll strip mine the other planets later. ------------------------

1 0

BankAmerica, First USA to Use Net Software From Verifone
by se7en 17 Dec '03

17 Dec '03

BankAmerica Corp. and First USA Paymentech have bought Verifone Inc.'s payment software for the Internet. They will use VGate and VPos, Verifone's Internet commerce gateway and merchant software. Terms of the deals were not disclosed. A third piece of Verifone's electronic commerce offering, VWallet, will be available once the MasterCard-Visa Secure Electronic Transactions protocol for credit card payments on the Net is adopted. Banks can use the Verifone technology to deliver private-labeled Internet commerce services to merchant customers. BankAmerica and First USA Paymentech join a user list that includes Wells Fargo & Co., Royal Bank of Canada, and Hitechniaga/MBf Group of Malaysia. BankAmerica's merchant services unit, which recently announced an initial public offering as a stand-alone business, processes credit and debit card sales for more than 150,000 merchants. First USA Paymentech ranks third in the merchant business. Its credit card issuing affiliate, First USA Bank, is one of the largest. Roger Bertman, a vice president at Verifone, said the reason these banks "are investing heavily in building the infrastructure" is because "the credit card will be the preeminent [on-line] payment instrument." se7en -------------------------- Majordomo list for Lam3rz: email majordomo(a)edm.net subscribe happyhacker MUWAHAHAHAHAHAHAHAHA! --------------------------

1 0

RE: tcmay in favour of redistribution of wealth? NFW/ROTFL
by jbugden＠smtplink.alis.ca 17 Dec '03

17 Dec '03

attila(a)primenet.com wrote: >et tu, Brute? I thought I was the only one who deliberately >stiffed the United Way, I treated it as a generic example, not a specific one. For the record, I have never donated to the United Way either. >Tim redistributing the wealth?!? I'll be ROTFL for days >over the "insult." >Come on, James, get with the program. I liked Zaid Hassan's response better. In general, I try not to "get with the program" (c.f. Two Roads Diverged in a Yellow Wood" by Robert Frost). But in spite of my best efforts, I still find myself in a well defined demographic group. ;-) >in Canada, you call [redistribution of wealth] National Health >Services which supposedly provides cradle to the grave >social services (which is bankrupting Canada). In spite of these services the spread between Canadian and U.S. Bonds is in favour of Canada out as far as ten years. Interest rates this morning for 90 Day T-Bills: Canada 3.23%; U.S. 5.02%. Remember: correlation is not causation. >=There is naivete and then there is complicity. >=jbugden(a)alis.com >so where do you draw the line? Aye, there's the rub. So far I haven't *explicitly* drawn one. And the line I may draw now is probably different from the line I might have drawn 5 years ago or 5 years from now. Ambiguity I can accept, its ambivalence, apathy and agnosticism that annoy me more. Tim's occasional combination of justifiable apathy tends to be the best combination to trigger a response. Ciao, James The rules of the game: learn everything, read everything, inquire into everything... When two texts, or two assertions, or perhaps two ideas are in contradiction, be ready to reconcile them rather than cancel one by the other; regard them as two different facets, or two successive stages, of the same reality, a reality convincingly human just because it is complex. Marguerite Yourcenar quoted in Complexification by John L. Casti. Les regles du jeu: tout apprendre, tout lire, s'informer de tout... Lorsque deux textes, deux affirmations, deux idees s'opposent, se plaire a les concilier plutot qu'a les annuler l'un par l'autre; voir en eux deux facettes differentes, deux etats successifs du meme fait, une realite convaincante parce qu'elle est complexe, humaine parce qu'elle est multiple. Margueite Yourcenar, Memoires d'Hadrien

2 1

List of reliable remailers
by Raph Levien 17 Dec '03

17 Dec '03

I operate a remailer pinging service which collects detailed information about remailer features and reliability. To use it, just finger remailer-list(a)kiwi.cs.berkeley.edu There is also a Web version of the same information, plus lots of interesting links to remailer-related resources, at: http://www.cs.berkeley.edu/~raph/remailer-list.html This information is used by premail, a remailer chaining and PGP encrypting client for outgoing mail. For more information, see: http://www.c2.org/~raph/premail.html For the PGP public keys of the remailers, finger pgpkeys(a)kiwi.cs.berkeley.edu This is the current info: REMAILER LIST This is an automatically generated listing of remailers. The first part of the listing shows the remailers along with configuration options and special features for each of the remailers. The second part shows the 12-day history, and average latency and uptime for each remailer. You can also get this list by fingering remailer-list(a)kiwi.cs.berkeley.edu. $remailer{"extropia"} = "<remail(a)miron.vip.best.com> cpunk pgp special"; $remailer{"mix"} = "<mixmaster(a)remail.obscura.com> cpunk mix pgp hash latent cut ek ksub reord ?"; $remailer{"replay"} = "<remailer(a)replay.com> cpunk mix pgp hash latent cut post ek"; $remailer{'alpha'} = '<alias(a)alpha.c2.org> alpha pgp'; $remailer{'nymrod'} = '<nymrod(a)nym.jpunix.com> alpha pgp'; $remailer{"lead"} = "<mix(a)zifi.genetics.utah.edu> cpunk mix pgp hash latent cut ek"; $remailer{"exon"} = "<remailer(a)remailer.nl.com> cpunk pgp hash latent cut ek"; $remailer{"haystack"} = "<haystack(a)holy.cow.net> cpunk mix pgp hash latent cut ek"; $remailer{"lucifer"} = "<lucifer(a)dhp.com> cpunk mix pgp hash latent cut ek"; $remailer{"jam"} = "<remailer(a)cypherpunks.ca> cpunk mix pgp hash latent cut ek"; $remailer{"winsock"} = "<winsock(a)c2.org> cpunk pgp hash cut ksub reord"; $remailer{'nym'} = '<config(a)nym.alias.net> newnym pgp'; $remailer{"balls"} = "<remailer(a)huge.cajones.com> cpunk pgp hash latent cut ek"; $remailer{"squirrel"} = "<mix(a)squirrel.owl.de> cpunk mix pgp hash latent cut ek"; $remailer{"middle"} = "<middleman(a)jpunix.com> cpunk mix pgp hash middle latent cut ek reord"; $remailer{'cyber'} = '<alias(a)alias.cyberpass.net> alpha pgp'; $remailer{"dustbin"} = "<dustman(a)athensnet.com> cpunk pgp hash latent cut ek mix reord post"; $remailer{'weasel'} = '<config(a)weasel.owl.de> newnym pgp'; $remailer{"death"} = "<x(a)deathsdoor.com> cpunk pgp hash latent post"; catalyst(a)netcom.com is _not_ a remailer. lmccarth(a)ducie.cs.umass.edu is _not_ a remailer. usura(a)replay.com is _not_ a remailer. Groups of remailers sharing a machine or operator: (cyber mix) (weasel squirrel) The winsock remailer does not accept plaintext messages. The alpha and nymrod nymservers are down due to abuse. However, you can use the cyber nymserver. The nym.alias.net server will be listed soon. See http://www.cs.berkeley.edu/~raph/n.a.n.html for details. 403 Permission denied errors have been caused by a flaky disk on the Berkeley WWW server. Hopefully, this is fixed by now. The penet remailer is closed. When sending messages to AOL accounts, don't use mix, replay, or exon as the last remailer in the chain - testing shows them not to work. Last update: Mon 28 Oct 96 6:45:43 PST remailer email address history latency uptime ----------------------------------------------------------------------- cyber alias(a)alias.cyberpass.net ******++**** 34:37 100.00% jam remailer(a)cypherpunks.ca ************ 16:20 100.00% exon remailer(a)remailer.nl.com **##+##*##*# 1:58 99.98% squirrel mix(a)squirrel.owl.de ++++++++++- 2:45:35 99.91% winsock winsock(a)c2.org --.------.- 8:16:20 99.89% lead mix(a)zifi.genetics.utah.edu ++ +++++++++ 36:39 99.87% lucifer lucifer(a)dhp.com ++++++++ 36:32 99.86% balls remailer(a)huge.cajones.com ************ 5:59 99.67% dustbin dustman(a)athensnet.com +-+++-++-++ 1:13:59 99.58% replay remailer(a)replay.com *****+++**** 8:04 99.52% extropia remail(a)miron.vip.best.com ___.--.-.-- 17:10:17 99.16% haystack haystack(a)holy.cow.net +*#++##+*** 3:58 98.70% middle middleman(a)jpunix.com +--++ + +++ 1:38:10 98.14% death x(a)deathsdoor.com * 3:20 13.75% mix mixmaster(a)remail.obscura.com + 2:07:07 6.67% History key * # response in less than 5 minutes. * * response in less than 1 hour. * + response in less than 4 hours. * - response in less than 24 hours. * . response in more than 1 day. * _ response came back too late (more than 2 days). cpunk A major class of remailers. Supports Request-Remailing-To: field. eric A variant of the cpunk style. Uses Anon-Send-To: instead. penet The third class of remailers (at least for right now). Uses X-Anon-To: in the header. pgp Remailer supports encryption with PGP. A period after the keyword means that the short name, rather than the full email address, should be used as the encryption key ID. hash Supports ## pasting, so anything can be put into the headers of outgoing messages. ksub Remailer always kills subject header, even in non-pgp mode. nsub Remailer always preserves subject header, even in pgp mode. latent Supports Matt Ghio's Latent-Time: option. cut Supports Matt Ghio's Cutmarks: option. post Post to Usenet using Post-To: or Anon-Post-To: header. ek Encrypt responses in reply blocks using Encrypt-Key: header. special Accepts only pgp encrypted messages. mix Can accept messages in Mixmaster format. reord Attempts to foil traffic analysis by reordering messages. Note: I'm relying on the word of the remailer operator here, and haven't verified the reord info myself. mon Remailer has been known to monitor contents of private email. filter Remailer has been known to filter messages based on content. If not listed in conjunction with mon, then only messages destined for public forums are subject to filtering. Raph Levien

1 0

Command confirmation request cancelled
by L-Soft list server at EDS (1.8b) 17 Dec '03

17 Dec '03

Your command: SIGNOFF COOL_TRAVELS has remained unconfirmed for more than 48h and is being cancelled. If you did want it executed but were unable to send the confirmation in time, just re-issue the command to get a new confirmation code. The one you were sent before can no longer be used.

1 0

COOL_TRAVELS: UNSUBSCRIBE US
by Mullen Patrick 17 Dec '03

17 Dec '03

This message was received by cypherpunks at toad.com. This is a mailing list. If you look at the To: line in its header, you will see "Cypherpunks Suck". If this isn't a clear sign of a forgery, I don't know what is. Please remove this account, cypherpunks(a)toad.com from your distribution. Thank you for your time and prompt response to this matter. Thank you, Patrick Mullen and other members at cypherpunks(a)toad.com _______________________________________________________________________________ From: COOL_TRAVELS-request(a)plwils00.xweb.eds.com on Sat, Oct 26, 1996 5:47 Subject: You are now subscribed to the COOL_TRAVELS list To: Cypherpunks Suck Sat, 26 Oct 1996 02:03:21 Your subscription to Continental Online (COOL) Travel Specials has been confirmed. Please keep this E-mail as it contains important infomation about the list you've joined. There are two distinct e-mail addresses that you should be aware of. 1. listserv address: LISTSERV(a)LISTSERV.XWEB.EDS.COM. 2. mailing list address: COOL_TRAVELS(a)LISTSERV.XWEB.EDS.COM. The first address: LISTSERV(a)LISTSERV.XWEB.EDS.COM: This is a non-human, administrative, automatic-reply address. This address works similar to a telephone voice response system. You dial a specific number to connect to the voice response system, enter the command/option to complete a specific task. There is not an option to chat with the voice response system. Similarly, the address above does not recognize anything but pre-defined commands. When you send E-mail to LISTSERV(a)LISTSERV.XWEB.EDS.COM, with a command in the message body, LISTSERV(a)LISTSERV.XWEB.EDS.COM will reply to you with a pre-defined response to your command. Commands are not case sensitive, and the "subject:" field does not matter. Here are some useful commands. subscribe cool_travels firstname lastname (To subscribe to the mailing list cool_travels or overwrite your existing account with new information) unsubscribe cool_travels (To unsubscribe the cool_travels list) For security reasons, when you unsubscribe/signoff the list will ask you for a confirmation. When you receive the confirmation, use your mailer's "reply" feature and type OK, and nothing else, in the reply message. This is meant to verify that you really do want to be removed from the list. LISTSERV will notify you once the operation is successful. Please *DO NOT* include the original confirmation message in your OK reply. Again, send commands only to LISTSERV(a)LISTSERV.XWEB.EDS.COM. The second important address is: COOL_TRAVELS(a)LISTSERV.XWEB.EDS.COM: This is the mailing list that will bring you discounts and promotions from Continental Airlines. This is a one-way, announce-only mailing list. It does not accept mail postings from the subscribers. Please do *NOT* reply to the messages sent to you from this mailing list. If you need any assistance, please send an E-mail to: WEBMASTER(a)MAIL1.FLYCONTINENTAL.COM with COOL_TRAVELS in the "subject:" field. We will be happy to assist you. ------------------ RFC822 Header Follows ------------------ Received: by mail.ndhm.gtegsc.com with SMTP;26 Oct 1996 05:47:08 -0400 Received: from toad.com by delphi.ndhm.gtegsc.com with SMTP; Sat, 26 Oct 1996 9:43:28 GMT Received: (from majordom@localhost) by toad.com (8.7.5/8.7.3) id AAA19773 for cypherpunks-outgoing; Sat, 26 Oct 1996 00:03:37 -0700 (PDT) Received: from plwils00.xweb.eds.com (plwils00.xweb.eds.com [205.240.248.140]) by toad.com (8.7.5/8.7.3) with SMTP id AAA19763 for <cypherpunks(a)TOAD.COM>; Sat, 26 Oct 1996 00:03:32 -0700 (PDT) Received: from plwils00 by plwils00.xweb.eds.com via SMTP (950911.SGI.8.6.12.PATCH825/940406.SGI) for <cypherpunks(a)TOAD.COM> id CAA15495; Sat, 26 Oct 1996 02:03:21 -0500 Message-Id: <199610260703.CAA15495(a)plwils00.xweb.eds.com> Date: Sat, 26 Oct 1996 02:03:21 -0500 From: "L-Soft list server at EDS (1.8b)" <LISTSERV(a)plwils00.xweb.eds.com> Subject: You are now subscribed to the COOL_TRAVELS list To: Cypherpunks Suck <cypherpunks(a)toad.com> Reply-To: COOL_TRAVELS-request(a)plwils00.xweb.eds.com X-LSV-ListID: COOL_TRAVELS Sender: owner-cypherpunks(a)toad.com Precedence: bulk

1 0