December 2003 - cypherpunks-legacy

[NEWS] Crypto/privacy related wire clippings (per Bill Stewart's request)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

CITIBANK MINES DATA--MARKETING GOALS WARRANT PARALLEL PROCESSING Citibank wants to do more than track its credit-card holders' buying behavior. Soon, it hopes to know what they'll purchase next, and who's committing fraud. Data-mining techniques and data warehouses, part of a project called the Cards Analytical Model (CAM) slated to be completed by the end of 1997, are the tools Citicorp Credit Services in Long Island City, N.Y., hopes to use to predict future consumer patterns. To make CAM work, Citibank's IS team knew it needed a powerful mainframe-class system to handle the complex formulas and algorithms pounding away on close to 2 terabytes of data. But the mainframe wasn't an option. "We didn't want the data warehouse to impact our OLTP (online transaction processing) production," says Kevin Murphy, VP of IS for Citicorp Credit Services. "We didn't have the luxury to give up cycles and drives." Instead, Citicorp chose the IBM RS/6000 SP MPP (massively parallel processing), consisting of 116 nodes (or processors) and 7 terabytes of storage capacity. The database is DB2 Parallel Edition, also from IBM. More than 50 C++ and C developers, from Citicorp and Lockheed Martin, the systems integrator, are working on the CAM project. -- Information Week, 10/07/96 American Banker: Wednesday, October 9, 1996 Card Frontiers Citi Alumna's Consultancy to Focus on New Technologies By Jeffrey Kutler Catherine Allen, the former Citibank vice president and founding chairman of the Smart Card Forum, announced the formation of a consulting partnership, the Santa Fe Group. She is president and chief executive officer of the firm. Former Citibank technologist Ted Fine and entrepreneur Howard Sherman, who helped develop the Midas and SuperCuts franchise operations, are executive vice presidents. The aim is to help businesses understand and assimilate innovations in management and technology. The firm's base, New Mexico's capital city, is a hotbed of the study of complex adaptive systems, a scientific discipline that is crossing over into business management. Ms. Allen said she hopes to "break new ground by applying complexity theory to practical business challenges." She has scheduled a forum, "Complexity and Technology: Organizing for Innovation," in early November. Mr. Fine, who managed Citibank's global consumer systems, said the firm could help "master the challenge" of emerging technologies like the Internet and smart cards. Ms. Allen had been developing the business since she left Citibank early this year. Santa Fe Group has been working on several consulting assignments, but didn't begin widely advertising its services until mid-September. --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

SURVEY: Encryption in Commercial Enterprises
by 'Mark' M.J. Saarelainen 17 Dec '03

17 Dec '03

Dear Receiver, I am completing a brief survey of encryption technologies and the uses of this technology in commercial enterprises. I have included three questions below. After reviewing these short questions, I would appreciate greatly, if you could provide your input (your responses) to me. My email address is mjsus(a)ix.netcom.com - thanks in advance. Best regards, Mark --------- 1. In your opinion, what are the 5-10 most significant applications of encryption technologies currently in commercial enterprises? 2. In your opinion, what are 5-10 main barriers currently that may prevent the successful implementation and utilization of encryption technologies in commercial enterprises? 3. What are activities and projects that can be initiated and taken to lower and reduce above barriers (see the question 2.)?

1 0

Service pays users (sort of) to read commercial e-mail
by Greg Broiles 17 Dec '03

17 Dec '03

>From time to time we've discussed the economics of paying per-message costs for E-mail, and/or systems where advertisers pay users to read their messages. Someone seems to have set up a system like that. It's at <http://www.aristotle.org>. They seem to be using voter registration as an is-a-real-person credential. (Their idea seems to be that they'll charge commercial (paper) mailers less than it costs to print & mail junk mail, deliver it (and some of the $) to users, and keep the remainder of the $ themselves. They seem to be sensitive about "reading things you're not really interested in", which strikes me as amusing, given all of the crap that people seem to mail me without special regard for whether or not it's interesting. Advertisers seem happy enough to spend $.40 to mail me their stuff, so what's the harm in spending $.30 where I get $.10 of it, regardless of whether or not I ignore it as quickly as I do paper junk mail? They're saving $.10, and I'm making $.10, and we're not wasting paper. Who's being harmed? As I read their terms & conditions, they don't start paying you until Dec 1997, and you need to accumulate $100 worth of credit to get paid. Also, it only seems to be interested in people from California at the moment. (perhaps that's the only state they've got voter info on so far.) -- Greg Broiles | "We pretend to be their friends, gbroiles(a)netbox.com | but they fuck with our heads." http://www.io.com/~gbroiles | |

1 0

RE: binding cryptography
by Eric Verheul 17 Dec '03

17 Dec '03

Ulf Moeller[SMTP:um@c2.net] wrote: >: liberal (Japan) to non-liberal (France). We believe that "binding >: cryptography" is flexible enough to achieve this: a liberal crypto >: policy might use no Trusted Retrieval Parties at all, while a very >: non-liberal country might want one (government controlled) TRP, a >: compliance check on all network traffic and a ban on other crypto. > >I doubt that even French internet providers would want their routers >to perform six modolo exponetiations and four modolo divisions >whenever someone opens a secure socket... They could, however, take random checks which could also be performed off-line (after the connection was established or even already finished again). Remember we called it fraud-*detecting* not fraud-*preventing*. BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. The same holds, for instance, when you make copies of microsoft word and resell them. Then you don't comply to the rules that you voluntarily agreed to when buying it... > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. > >Of course, criminals do get real advantage from this system. They can >use strong encryption for their messages and super-encrypt them using >"binding" cryptography. So their illegal messages look perfectly >inconnous as long as their government trusts in the "binding" property >of this scheme. Only when the GAK key holder tries to decrypt a >message, they notice that they cannot read it. I agree, that is inevitable. > >Can you imagine that anyone would ever create a program that tries to >look like a conforming implementation, but generates invalid "binding" >data -- when it is so much easier to simply use PGP, and (if >necessary) disguise that fact using the government-approved encryption >software? I don't, so in my opinion the verification process is >abolutely useless. Can you imagine what would happen if governments would (help to) set up a system that has no safeguards at all, i.e. that could give criminals all the anonimity and confidentiality they need? Governments can't probably prevent criminals and the like to use encryption to stay out of sight of law enforcement agencies, but they should not facilitate them either. In the next few years all kinds of "standard" commerical software will come on the market with all kinds of standard security in it. I don't want criminals to be happy with Custom of The Shelf products for security, let them work for their security. One might say, binding cryptography, like several >other cryptographic protocols, is a nice 'solution', but one with no >corresponding 'problem' in the real world. :) It doesn't help in >legitimate law enforcement, but it causes trouble to network operators >and it deprives law-abiding citizens of their privacy. We have set up the TRPs in such a flexible way that anybody could find one he can trust, one might even set up his own TRP. Also in the paper we describe how two or more TRPs could be used. Maybe some countries don't want TRP at all. The bottom line is that law-abiding citizens always have to give up some of their freedom to stop criminals (that is why you have to have registration plates on your car, a lock on your car, bicycle, house etc.). That is a fact of life; one I hate. So the point is: where is the middle of giving up freedom and stopping criminals? Well, I think that our concept gives a flexible way of implementing any national middle.. I agree with some of the poster to cypherpunks that governments involves the general public too less in the determination of this middle (some posters said it more strongly). Cryptopolicy is not a binary discussion; although some posters on this list seem to think so. >And criminals don't face "the key-management problem". In any GAK >scheme, the official keys can be used to certify other un-escrowed >encryption keys. Binding cryptography makes it just a little easier, >because there is no need to create any "illegal" key pairs. Everyone >can encrypt messages using the government-certified ElGamal keys, >and then repeat that process, this time including the data required >for goverment access. > that use of other systems will always be possible. Also, the above > discussions already showed that if such a system is voluntary, then > there are lots of way to go around it. > >Criminals will always find ways around these systems -- even if they are >mandatory. Just those who actually "have nothing to fear", will not >go in the risk to use illegal encryption. So governments can wiretap >law-abiding citizens, but not criminals. What useful is a system like >that? > You are absolutely right. However, as said above if governments (help to) set up a security system then they should at least attempt to make criminal abuse difficult. The lock on my bicycle is not really 100% either (as I found out quite to often); if I'd no lock at all I would have a lot more problems. Also, I am *not* for a mandatory system. Best regards, Eric

3 2

RE: binding cryptography
by jim bell 17 Dec '03

17 Dec '03

At 11:16 PM 10/14/96 +-100, Eric Verheul wrote: >BTW, some people on the cypherpunks list seem to think that you can't fraude with a *voluntary* system. However, that is possible: when you do not comply with the *agreed* rules of conduct then the phrase "fraude" is appropriate. No, it probably isn't. I don't know if you're basing your opinions on some Dutch variant of contract law, but as I understand it in order for there to be "fraud" there has to be a contract of some sort. I'm sure a REAL LAWYER (TM) will correct me if I'm wrong, but to have a contract you first must have an agreement, and the parties must either go to an inconvenience or receive a benefit as a consequence of that agreement. Specifically, let's suppose I'm asked to limit myself to sending encrypted messages using some sort of standardized, GAK'd system. Assuming I am willing, I then have to receive some benefit from that agreement (or the other guy must go to some inconvenience) or else there's no contract and no fraud if I cease operating according to that agreement. However, there's a problem: What benefit am I supposed to get sending GAK'd messages? If it's nothing, then there's no contract. (Besides, why should I agree to any "voluntary" agreement if I don't benefit in some way?) If, on the other hand, I get my messages handled by some faster route, or get cheaper Internet service, that constitutes a benefit, but at that point people who don't agree are disadvantaged compared to those who agree. Problem is, this constitutes a subsidy of people who are willing to give up their freedom by people who aren't, and I suggest that there's at least an ethical problem with that, if not a legal or Constitutional problem. And there's a contradiction: You said the system was supposed to be "voluntary." The more government pays (money, service, etc) people to agree, the less "voluntary" it is. To cite an analogy, suppose the government offered money to anyone who agreed to sign away his free-speech rights, to be paid for by taxes collected by the general population. Raise the payments and the taxes high enough, and nobody could afford to NOT sign away those rights. This doesn't sound "voluntary," now does it? >>Can you imagine that anyone would ever create a program that tries to >>look like a conforming implementation, but generates invalid "binding" >>data -- when it is so much easier to simply use PGP, and (if >>necessary) disguise that fact using the government-approved encryption >>software? I don't, so in my opinion the verification process is >>abolutely useless. >Can you imagine what would happen if governments would (help to) set up a >system that has no safeguards at all, i.e. that could give criminals all >the anonimity and confidentiality they need? "all the anonimity and confidentiality they need?" All they need to what? By its very nature, encryption is more easily used to defend oneself against crime, than to commit crime. It's related to the difference between the difficulty of doing an encryption/decryption, compared with the difficulty of decrypting a message by finding the key that you don't already know. This can be a factor of well over a trillion more difficult. This is one reason that most of the people on CP don't fear the widespread development and deployment of good encryption, which I think most of us would acknowledge can't help but "assist criminals" in some proportionately small way. > Governments can't probably prevent criminals and the like to use encryption >to stay out of sight of law enforcement agencies, but they should not >facilitate them either. In the next few years all kinds of "standard" >commerical software will come on the market with all kinds of standard >security in it. I don't want criminals to be happy with Custom of The Shelf >products for security, let them work for their security. "Criminals" are generally happy with off-the-shelf guns, or cars, or many other products. I don't think you have a hope keeping them unhappy with off-the-shelf encryption. >We have set up the TRPs in such a flexible way that anybody could find one >he can trust, one might even set up his own TRP. Also in the paper we >describe how two or more TRPs could be used. Maybe some countries don't want >TRP at all. The bottom line is that law-abiding citizens always have to give >up some of their freedom to stop criminals (that is why you have to have >registration plates on your car, a lock on your car, bicycle, house etc.). I disagree. The very act of using good cryptography can help protect assets without giving up freedom. If it helps me more than it might potentially hurt me, then in fact I've GAINED freedom, not lost it. >Also, I am *not* for a mandatory system. However, given the tendency for governments to redefine the meaning of the terms, it is irrelevant that you claim to oppose a "mandatory" system. In fact, it would be with tricks like your invention that governments would adopt a mandatory system that is called "voluntary." Jim Bell jimbell(a)pacifier.com

1 0

Spook O.T.M.?
by Douglas B. Renner 17 Dec '03

17 Dec '03

1 0

RFC2015 on MIME Security with PGP (fwd)
by P. J. Ponder 17 Dec '03

17 Dec '03

---------- Forwarded message ---------- Date: Mon, 14 Oct 96 14:18:26 PDT From: RFC Editor <rfc-ed(a)ISI.EDU> To: rfc-dist(a)ISI.EDU Cc: rfc-ed(a)ISI.EDU Subject: RFC2015 on MIME Security with PGP A new Request for Comments is now available in online RFC libraries. RFC 2015: Title: MIME Security with Pretty Good Privacy (PGP) Author: M. Elkins Date: October 1996 Mailbox: P.O. Box 92957 - M1/102 Los Angeles, CA 90009-2957 Pages: 8 Characters: 14,223 Updates/Obsoletes: None URL: ftp://ds.internic.net/rfc/rfc2015.txt This document describes how Pretty Good Privacy (PGP) can be used to provide privacy and authentication using the Multipurpose Internet Mail Extensions (MIME) security content types described in RFC1847. This is now a Proposed Standard Protocol. This document specifies an Internet standards track protocol for the Internet community, and requests discussion and suggestions for improvements. Please refer to the current edition of the "Internet Official Protocol Standards" (STD 1) for the standardization state and status of this protocol. Distribution of this memo is unlimited. This announcement is sent to the IETF list and the RFC-DIST list. Requests to be added to or deleted from the IETF distribution list should be sent to IETF-REQUEST(a)CNRI.RESTON.VA.US. Requests to be added to or deleted from the RFC-DIST distribution list should be sent to RFC-DIST-REQUEST(a)ISI.EDU. Details on obtaining RFCs via FTP or EMAIL may be obtained by sending an EMAIL message to rfc-info(a)ISI.EDU with the message body help: ways_to_get_rfcs. For example: To: rfc-info(a)ISI.EDU Subject: getting rfcs help: ways_to_get_rfcs Requests for special distribution should be addressed to either the author of the RFC in question, or to admin(a)DS.INTERNIC.NET. Unless specifically noted otherwise on the RFC itself, all RFCs are for unlimited distribution. Submissions for Requests for Comments should be sent to RFC-EDITOR(a)ISI.EDU. Please consult RFC 1543, Instructions to RFC Authors, for further information. Joyce K. Reynolds and Mary Kennedy USC/Information Sciences Institute ... Below is the data which will enable a MIME compliant Mail Reader implementation to automatically retrieve the ASCII version of the RFCs.

1 0

Re: SPA sues C2, other ISPs and users
by Douglas Barnes 17 Dec '03

17 Dec '03

I just wanted to weigh in on a couple of points that have been raised with respect to the SPA lawsuit against C2Net: 1) I don't think this is some sort of evil plot by SPA members because we hadn't joined or because we're competing with some of their members. A lot of their members compete with other members and non-members and nothing like this has happened before. It's pretty clear that they were oblivous to a great many things, including the fact that we're primarily a software company these days. 2) As obnoxious as the lawsuit is, we don't miss the humor in the fact that we've been grumbling (on-line and off) about folks who pirate Stronghold (our commercial, secure version of the Apache web server). We really were looking into joining the SPA, to see if it would do us any good in dealing with this problem. 3) If you run across any mention of this lawsuit in the media, either on-line or in print, it would be great if you could forward it to me at cman(a)c2.net, or fax it to me at: 510 986 8777. I want to be tracking the press coverage very closely, and our clipping services takes about 5-10 days to read and process clippings for us. Thanks for your help, Douglas Barnes VP Sales & Marketing C2Net

2 1

News_dal_Ragno_Italiano.
by Samuele Landi 17 Dec '03

17 Dec '03

Questo e' un messaggio informativo automatico per un servizio gratuito di pubblico interesse. Viene spedito una sola volta per lo stesso indirizzo e-mail anche se sono presenti piu' pagine. Il "Ragno Italiano" e' lieto di comunicarle che le pagine da lei pubblicate sul WWW sono state catalogate nel nostro motore di ricerca. Saranno visibili a indicizzazione completata di di tutti i siti italiani prevista per il 30/10/96. Il "Ragno Italiano" e' il motore di ricerca per l'italia con oltre 500.000 pagine catalogate e ricercabili subito all'indirizzo: http://ragno.ats.it -------------------------------------------------------- Sponsor permanente: http://www.webspace.it ====================== 50 mb di spazio WWW con dominio proprietario (www.nome_azienda.it/.com) per 150.000 Lire al mese -------------------------------------------------------- Il "Ragno Italiano" e' motore di ricerca anche per: - Indirizzi e-mail in Italia - Newsgroups Italiani - Meta-Interfaccia per tutti i maggiori motori di ricerca mondiali Cordiali Saluti. Samuele Landi - WebMaster ragno.ats.it

1 0

Anybody live in PA?
by Jon Stevens 17 Dec '03

17 Dec '03

> Cyber Promotions Inc (CYBERPROMO-DOM) > 8001 Castor Avenue, Suite 127 > Philadelphia, PA 19152 > USA > Domain Name: CYBERPROMO.COM > > Administrative Contact, Technical Contact, Zone Contact, > Billing Contact: > Wallace, Sanford (SW430) cyberpr(a)ANSWERME.COM (215) 288-9230 a quick look at four11.com produces... http://www.four11.com/cgi-bin/Four11Main?userdetail&FormId=, 201,1E8FCAC,3954100,CA43E71_203,2,3954100,74D46FE0 which then produces... http://www.four11.com/cgi-bin/SledMain?Four11Phone=&Target =Detail&FirstName=SANFORD&LastName=WALLACE&Address=& City=PHILADELPHIA&State=PA&Id=532793131&FormId=203,2,3954100,74D46F E0 which is: Sanford Wallace 1255 Passmore St Philadelphia, Pennsylvania 19111 (215)288-8110 maybe a home address/phone number? someone in PA wanna check it out???? p.s. looks like cyber-promo.com is on hold... Cyber Promotions (CYBER-PROMO-DOM) 8001 Castor Avenue, Suite 127 Philadelphia, PA 19152 Domain Name: CYBER-PROMO.COM Domain Status: On Hold Administrative Contact, Technical Contact, Zone Contact: Wallace, Sanford (SW430) cyberpr(a)ANSWERME.COM (215) 288-9230 -jon

1 0