December 2003 - cypherpunks-legacy

Re: Anatomy of a Hoax
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

Path: perun!news2.panix.com!panix!feed1.news.erols.com!howland.erols.net!news.sprintlink.net!news-peer.sprintlink.net!uunet!news-in2.uu.net!news.callamer.com!news(a)twizzler.callamer.com From: "Brian G. Hughes" <bhughes(a)slonet.org> Newsgroups: alt.shenanigans Subject: Anatomy of a Hoax Message-ID: <3260422F.115654B7(a)slonet.org> Date: Sat, 12 Oct 1996 18:13:19 -0700 Organization: Call America Internet Services +1 (805) 541 6316 Lines: 47 NNTP-Posting-Host: boobs.eorbit.net Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit The press release went out in mid-week. "Arm the Homeless to Donate Firearms, Training to S.L.O Homeless Community." Modeled after a similar ATH hoax done a few years back by some OSU students in Columbus, Ohio, this version had the press jumping. "[F]or someone in the underclass, a firearm works as 'the great equalizer,'" the press-release read. "[A] homeless person with a gun is just as powerful as his wealthy or politically powerful counterpart..." The answering machine I set up to take ATH calls was soon swamped with interview requests from the local newspaper and newsweekly and the local television station. I wrote up a bulletin and schedule of events for our fictitious organization, including fund-raising rallies, interviews with homeless folks, and weapons training. I then called some friends and enlisted their help. Early the next week, we arranged to fake an officers meeting to discuss our interviews with homeless folks and decide which ones to donate guns to. We then invited the press. The first to show was the K--- camera crew. Shortly after they arrived, a confederate dressed somewhat bum-like showed up, rolling a shopping cart full of junk. One of the items was three firearms wrapped in a ragged blanket. The camera crew went nuts, and our confederate explained that he'd managed to pick these up on the cheap and they only had to be doctored a little. The newspaper and newsweekly reporters showed up next. Even though the newspaper reporter had found out about the Columbus hoax on the web, the reporters stuck around and covered our meeting. They so much /wanted/ to believe this great story that they were willing to buy any story I gave them. We were the top story at six and the number two story at eleven. Alas, the police got interested, and we didn't really want to get them upset (you wouldn't like him when he's angry), so we fessed up. But it was good while it lasted.

1 0

fwd: Privacy on the Internet
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: oldbear(a)tiac.net Mime-Version: 1.0 Date: Mon, 14 Oct 1996 08:48:23 -0300 To: dcsb(a)ai.mit.edu (Digital Commerce Society of Boston) From: The Old Bear <oldbear(a)arctos.com> Subject: fwd: Privacy on the Internet Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: The Old Bear <oldbear(a)arctos.com> INTERNET USERS VALUE THEIR PRIVACY The 1996 Equifax/Harris Consumer Privacy Survey for the Internet reveals that Internet users place a high premium on their online privacy, relative to non-Internet users. Sixty percent of the Internet users interviewed said their anonymity shouldn't be compromised when they visit a Web site or use e-mail. Only 45% of non-Internet users were sympathetic to the desire for online anonymity. About half (49%) of the Internet users who participated felt that the federal government should be restricted in its ability to scan Internet messages, compared to only a third (34%) of non-users. Seventy-one percent of Internet users did not want online service providers to track their Web surfing patterns for marketing purposes, while 63% of non-users felt this activity was intrusive. The telephone survey of 36 million people also found that Internet users tended on average to be better educated, earn more money and have a somewhat more liberal outlook than non-users. source: BNA Daily Report for Executives October 10, 1996 - page A24 CONSORTIUM TO DEVELOP NET PRIVACY PRINCIPLES A group of companies involved in electronic commerce via the Internet have banded together to develop a set of privacy principles for doing business over the Net. The Privacy Assured group includes WorldPages, Inc., Four11, I/PRO, Match.Com and NetAngels.Com, and was sparked by recent reports of database services such as Nexis/Lexis providing sensitive information to paying customers. Privacy Assured, which is a pilot program of the Electronic Frontier Foundation's eTrust project, will post its blue PA logo on Web sites that adhere to its standards. These standards include: not knowingly listing information about individuals that has not been volunteered for publication; not allowing reverse searches to determine individuals' names from e-mail addresses, phone numbers or other information; releasing only aggregated usage statistics, not individual information; and giving individuals the option to delete personal information from lists. source: Broadcasting & Cable October 7, 1996 page 87 via edupage ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ To unsubscribe from this list, send a letter to: Majordomo(a)ai.mit.edu In the body of the message, write: unsubscribe dcsb Or, to subscribe, write: subscribe dcsb If you have questions, write to me at Owner-DCSB(a)ai.mit.edu --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Threats from FOTM (Friends of Timmy May)
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

I've been receiving multiples copies of threats of frivolous lawsuits in connection with Sandy Sanford's kind offer to address the San Francisco Gay and Lesbian Cypherpunks Meeting (and Meating). Therefore I'm regrettably forced to postpone taking advantage of said kind offer until Timmy May is actually indicted for possession of controlled substances (to wit, Ritalin) and/or sexually molesting two feline minors and/or practicing cryptography without a licence. (Given Timmy May's total ignorance of cryptography, I find the latter to be the least likely.) Hope to see you all then, Dimitri ]Date: Tue, 15 Oct 1996 06:04:16 -0500 ]From: "Douglas B. Renner" <dougr(a)skypoint-gw.globelle.com> ]Subject: Abuse from Dimitri Vulis ]To: root(a)bwalk.dm.com, postmaster(a)bwalk.dm.com ]Message-Id: <Pine.3.89.9610150547.A858-0100000(a)skypoint-gw.globelle.com> ]Mime-Version: 1.0 ]Content-Type: TEXT/PLAIN; charset=US-ASCII ] ]Attached is a tiny example of the type of uncalled-for slander that Mr. ]Dimitri Vulis has been sending unsolicited to a list of subscribers to a ]cryptography forum. ] ]You are hereby notified of this illegal activity by one of your subscribers. ]If you fail to take corrective measures, the Boardwalk Brighton Beach ]BBS and its sysops may be named in a civil lawsuit. ] ]---------- Forwarded message ---------- ]Date: Thu, 10 Oct 96 21:51:57 EDT ]From: Dr.Dimitri Vulis KOTM <dlv(a)bwalk.dm.com> ]To: cypherpunks(a)toad.com ]Subject: Re: LET'S MEET DIMITRI ] ]Sandy Sandfort <sandfort(a)crl.com> writes: ]> his choice of topic, of course. ] ]"Timmy May and his sexual perversions". Illustrated with slides. ] ]--- ] ]Dr.Dimitri Vulis KOTM ]Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps ]

2 1

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by azur＠netcom.com 17 Dec '03

17 Dec '03

>>> >Steve Shear <azur(a)netcom.com> writes: >>> I've been charged with developing an Internet service which needs to assure >>> its clients of anonymity. However, we fear some clients may abuse the >>> service and we wish to prevent the abusers from re-enrollment if >>> terminated for misbehavior. > >At 04:28 PM 10/13/96 -0400, "Michael Froomkin - U.Miami School of Law" ><froomkin(a)law.miami.edu> wrote: >>Stefan Brands has a protocol that probably does what you want. >.... >>http://www.law.miami.edu/~froomkin/articles/oceanno.htm#ENDNOTE286 > >Looks like a really nice paper on anonymity issues; at 485K, it'll take >a little while to read :-) Yes, it was quite a load, but very good material. > >The fundamental difficulty in this problem is that you need some >demonstrable proof of uniqueness for human users; if you don't have that, >you can't transform it into a unique-but-anonymous identity.* >The issues are similar to privacy-protecting voter registration problems. > >Brands's protocol starts with the user going to the bank with proof of ID, >and getting a numerical ID which can be blinded and signed. >It's a nice approach; you can do cruder approaches by hashing your >universal-citizen-unit-ID-number or whatever, but that can be >dictionary-searched >by feeding all the possible ID numbers through the hash. > >For some applications, mapping back to a unique human isn't necessary; >if you do something like map back to a bank account which has a high >minimum balance for setup, this discourages the type of users who >don't want to spend $100 just to send spam. > >Blinding a Verisign signature isn't enough, though - they support >personna certificates without proof of identity. Is it possible to determine the level of Verisign signature to screen out personna certificates? > >[ * There are non-universal-identifier methods for preventing double-use. >Voter registration in many places just depends on identification and >affidavit, and is often abused (e.g. Chicago graveyard voters and >Nevada absentee ballots), but usually not massively abused. >Some third-world countries don't even require registration or literacy - >they dip your thumb in ink after you vote, using a kind of ink that >won't come off for a couple of days. Attacks against this protocol >include better solvents :-) ] Of course, if elections were very infrequent, they could cut off a finger each time you vote :-) You all have given me much to think about. Thanks.

1 0

Re: FLY_not
by jim bell 17 Dec '03

17 Dec '03

At 09:30 AM 10/14/96 -0400, John Young wrote: > 10-13-96. CoWo: > > "Encryption confusion" > > Reminded of the secret Clipper algorithm, I sought > details from IBM. I asked a spokeswoman why the company > hadn't just put out a nice, snappy white paper > explaining its new approach to key recovery. "We spent > three months trying to do that, quite literally," the > spokeswoman said. "It's pretty confusing stuff, and > whenever we get it on paper, we aren't happy with it." That's interesting...whenever they get it on paper, _we_ aren't happy with it either! Jim Bell jimbell(a)pacifier.com

1 0

COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT
by sameer＠c2.net 17 Dec '03

17 Dec '03

COMMUNITY CONNEXION SUED IN FRIVOLOUS LAWSUIT For release: October 14, 1996 Contact: Sameer Parekh 510-986-8770 Oakland, CA - Community ConneXion, Inc, dba C2Net, condemns the lawsuit served by Adobe Systems, Inc., Claris Corporation, and Traveling Software, Inc. as a frivolous lawsuit. "As near as we can tell," said C2Net President Sameer Parekh, "we are being sued for being an Internet Service Provider." C2Net is an ISP, providing shell accounts and web hosting services. But the company is primarily a software vendor, selling Stronghold, one of the most popular secure web servers on the market. "We were looking into joining the Software Publisher's Association, who filed the suit on behalf of the plaintiffs," said Parekh, "but it's not very likely to happen at this point." The lawsuit appears to charge C2Net with liability based upon allegations that C2Net's customers provide links to pirated software on other machines and "cracker tools" that allow users to beat copy-protection mechanisms like software serial numbers. "It's completely outrageous that the SPA has nothing better to do than to file frivolous lawsuits against hard-working Internet Service Providers," said Parekh. "We are not aware of any such links on our pages or our customer's pages, and if our customers are breaking any laws, we want to know about it so we can terminate their accounts." (The lawsuit provides no specific examples.) The lawsuit was apparently filed after a single attempt to contact the company with a form-letter e-mail. The copy of the alleged e-mail included as an attachment to the suit shows the SPA's real motive. "They want us to sign a 'Code of Conduct'," said Parekh. "Among other things, we'd have to agree to routinely monitor our customer's web pages, which we won't do. We deal with complaints about our customers on a case by case basis, and we have a firm and clear policy against illegal activity of any sort. We've shut down accounts for less than what they're alleging in this lawsuit." "This is clearly a frivolous lawsuit," said Terry Gross, counsel for C2Net. "The plaintiffs know that an ISP can only be liable if it participates in and has knowledge of the improper activity, and it is clear that they have no such basis." Although the lawsuit does not mention the "Code of Conduct", it appears that most ISPs who received the e-mail ended up signing it, largely to avoid legal action from the much-feared SPA. Those that didn't kowtow got sued. "The terms of the 'Code of Conduct' are completely unacceptable," said Parekh. "It basically gives the SPA the right to go on an ongoing fishing expedition through our customer's files, and requires us to do the same as their agent on a regular basis. The Code would classify us as 'publishers', and we would become responsible for everything our customers do. We've built this business on a solid foundation of respect for our customer's privacy. Monitoring their activities without grounds for suspicion is completely inconsistent with maintaining their privacy." "This lawsuit is grossly unfair, and it's going to cost us a lot of time and money, but we don't have any choice but to fight it," said Parekh. "What we have here is three giant software companies and their well-funded bag of lawyers trying to bully a smaller software company into adopting costly policies that invade customers' privacy." A coalition is currently being formed to fight this case and make sure that this form of legal terrorism does not occur in the future against internet providers. The coalition will probably include the three companies that have been served in the suit and other organizations with a stake in creating a rational legal enviroment for ISPs and their customers. C2Net provides high-security encryption solutions for the Internet worldwide. More information about C2Net's products are available at https://stronghold.c2.net/. Information about the forming coalition may be found at https://www.c2.net/ispdc/.

4 3

RE: RE: Binding cryptography - a fraud-detectible alternative to
by Hal Finney 17 Dec '03

17 Dec '03

From: everheul(a)mail.rijnhaave.nl > Hal Finney[SMTP:hal@rain.org] wrote: > >Another flaw with schemes of this time (in terms of failing to meet > >their goals) is that they cannot detect superencryption and other > >forms of non-standard encryption of the message body proper. All > >they can really do is verify from the outside that the same session > >key is encrypted for the two recipients (the intended recipient and > >the Government Access to Keys Party - let's not abuse the term by > >calling him a Trusted Third Party). But they can't be sure that the > >session key is sufficient information to decrypt the message. > We offered a solution for the *first* task not for the *second*; the > point is that criminals(!) do not gain any real advantage from using > the system in that way as they - among other things - still face the > key-management problem. The above dicussions are only relevant in > countries where the use of crypto outside the structure would be > prohibited. BTW, it is by such discussions that I believe such a ban > is ineffective and in fact counterproductive. I have not read your paper, but let me illustrate via what may be a similar scheme how criminals can use the key management infrastructure, create messages which look good from outside, yet which still cannot be read by the GAK (government access to keys) people. In ElGamal encryption we start with a message session key M which we want to send across. We have the public key y1 = g^x1 of the recipient (^ is exponentiation). We choose a random blinding factor xm, and calculate ym = g^xm. We send ym and M * (y1^xm). y1^xm equals g^(x1*xm), and the recipient can recover this by ym^x1. Now with two recipients, if we choose the same blinding factor xm for both, we send ym = g^xm, and both M * (y1^xm) and M * (y2^xm). We use the two different recipients' public keys y1 and y2. I believe this can be checked from outside by taking the ratios of these two factors (y1/y2)^xm and using known methods to prove that this is of the proper form. This can be circumvented though simply by replacing M, the true session key, with M' = M*(y1^xm), where y1 is the intended recipient (and y2 is the GAK party). We send M'*(y1^xm) and M'*(y2^xm). Outsiders still verify that this is of the proper form. And the intended recipient can calculate the true M by dividing twice by y1^xm instead of once (in effect M' is the El Gamal encryption of M for party 1). But the GAK party, who gets M'*(y2^xm) and recovers M', finds it useless in trying to decrypt the message. This shows how keys from a standard infrastructure can be used in a slightly non-standard way to confound your scheme. Granted, the parties involved have to share knowledge about using the keys in this non- standard way, but that is only one bit of information and not at all hard to distribute. Hal

1 0

Re: Blinded Identities [was Re: exporting signatures only/CAPI]
by jim bell 17 Dec '03

17 Dec '03

At 04:01 AM 10/14/96 -0400, Black Unicorn wrote: >On Sun, 13 Oct 1996, jim bell wrote: > >> At 04:28 PM 10/13/96 -0400, Michael Froomkin - U.Miami School of Law wrote: >> >It is unpublished, but he kindly allowed to me describe it in a paper I >> >wrote that discussed whether a bank would ever want to take the risk of >> >allowing bank accounts where it did not know the identity of the customer. > >> And I don't think that a bank can ever be embarrassed (assuming bank >> accounts are anonymous) by it being revealed that some particular bad guy >> kept his money there, any more than other cash-based (anonymous) businesses >> are embarrassed if it is revealed that some bad guy used their services. > >I would refer you to Union Bank of Switzerland in the late 80's >(kidnapping), BCCI (drug and intelligence money), BMI (drug >money/offshore insurance fraud), PNC Bank (accounting fraud), and a host >of others I won't bother to list. Banks do suffer from these disclosures, >in many cases quite severely. (PNC bank was nearly ruined by their fraud >harboring disclosures). Are you talking about ANONYMOUS accounts, or merely CONFIDENTIAL ones? (Anonymous accounts, as I use the term, are ones in which even the bank doesn't know the owner.) I think you're lumping these two things together; I was not. Jim Bell jimbell(a)pacifier.com

2 1

RE: LET'S MEET DIMITRI (WHO CARES?)
by Alex Filacchione 17 Dec '03

17 Dec '03

<FLAME> Hmm. Maybe I am missing something. Can someone please explain to me exactly WHAT relevance this has to the list? People, I really DON'T CARE what your opinions are of Tim May, or anyone else for that matter!!! Can you please stop acting like children in a playground name-calling contest and move on to something else? Something of relevance to the list please? If you absolutely *HAVE* to continue to act like children then take it to private email. If for nothing else, then to save YOURSELVES from embarrassment. </FLAME> Thank you, AlexF(a)iss.net ---------- From: Dr.Dimitri Vulis KOTM[SMTP:dlv@bwalk.dm.com] Sent: Friday, October 11, 1996 8:55 AM To: cypherpunks(a)toad.com Subject: Re: LET'S MEET DIMITRI [snip] No deal, then. I suggest that for your next meeting you book Timmy May to perform live sex acts on stage with his two cats, as Ray and Zach do the Macarena circle-jerk. > How about you and Tim sit down and *NICELY* talk about your differences?

3 2

(no subject)
by Jim Alexander 17 Dec '03

17 Dec '03

1 0