December 2003 - cypherpunks-legacy

PUBLIC: Citibank Visa & the FBI
by pjb＠ny.ubs.com 17 Dec '03

17 Dec '03

sometime ago, i saw a thread about citibank giving someone, i think it was the fbi, some visa account information to use in a sting opereation. will someone please give me a pointer to this thread? cheers, -paul

1 0

RE: Securing ActiveX.
by Blake Coverett 17 Dec '03

17 Dec '03

This thread branch seems to be based on bad assumption. Why would one want to run ActiveX controls in a sandbox? If you need a sandbox, use a Java applet, if you need native code level access to the system use ActiveX. Running code in a sandbox, a la Java applets, is one approach to allowing safe execution of downloaded code. If one has a perfect implementation of the sandbox, which doesn't appear to be the case for Java thus far, this can be a useful solution. There is however a severe limit to the types of applications you can run from inside a sandbox unless you subscribe completely to the 'Network Computer'-type model. Digitally signed code, a la ActiveX, is another approach to the same problem. If the digital signatures and infrastructure around them are sound, which they appear to be for ActiveX, this is also a useful solution. The built-in gotcha with this model is the all or nothing nature, either I trust the software publisher to run arbitrary native code on my machine or I don't run it at all. Specify technical issues follow: > It can be done under 95 but Microsoft will have to write a Sandbox > Virtual Machine (a Virtual x86 session whose API's are filtered to > prevent access to certain things like the file system, and disables > direct I/O.) Not that easy under '95, but it already exists for NT. But of course it's not enough to filter out filesystem calls. The entire windowing system would have to be separated as well. For example a rogue control might watching all edit controls for ones that have the ES_PASSWORD style and grabbing the contents. An equivalent Unix problem would be to allow an open-access guest account with the ability to transfer in and execute arbitrary binaries. While doing this securely may be possible in theory I don't think the state of the art is up to it today. (I sure wouldn't allow it on my system.) > The problem is how to deal with DLL's. You don't know all > features/functions of all DLL's. It may be possible to write a DLL that > runs outside the sandbox and can act as a proxy to the file system, so > it's iffy unless you limit the DLL's and services that ActiveX apps talk > to, and make them all live inside the sandbox. DLL's are by definition mapped into the processes address space, they would have to be inside the sandbox too. It's not a call gate type of thing. regards, -Blake

4 3

unsubscirbe
by Andrew Fairbanks 17 Dec '03

17 Dec '03

would someone please take me off the list apf(a)ma.ultranet.com Thankyou

2 1

Re: Van Eck articles, reply..
by John Young 17 Dec '03

17 Dec '03

Aaron wrote: >I went to the library and found an article on Van Eck. I posted it at my >site. It was a little long to e-mail. Check it out at: > > http://members.aol.com/aaronh4321/vaneck.html > >If anyone has more current information please e-mail me. Christopher Seline wrote a well-known critique in 1989 of TEMPEST: "Eavesdropping On the Electromagnetic Emanations of Digital Equipment: The Laws of Canada, England and the United States." It includes numerous citations, including those mentioned by Joel and the one you found. He claims that the Van Eck article was "purposely misleading." We've put his article at: http://jya.com/tempest.htm Seline promised a later version of what he called a rough draft. Does anyone know of a successor to the 1989 article?

1 0

Army Cryptanalysis manual online
by Joel McNamara 17 Dec '03

17 Dec '03

The US Army's Field Manual on Basic Cryptanalysis (FM 34-40-2), dated September 1990 is available for downloading as an Acrobat PDF file from: http://www.atsc-army.org/cgi-win/$atdl.exe/fm/34-40-2/default.htm Fairly classic in nature (substitution, transposition, and code systems). Huge files (so far, at 28.8, after about an hour and a half, I've only been able to grab the table of contents and a couple of appendices - some kind-hearted person with a T1 or greater may want to get everything, then zip and mirror to save us bandwidth challenged folks the pain). Also, for the complete listings of almost 300 downloadable FMs through the Army's Digital Training Library (ATDL), check out: http://www.atsc-army.org/cgi-win/$atdl.exe?type=fm&header=%2Fatdl%2Fbrowse%2 Ffm.htm Have fun! Joel Note: This site isn't wholly reliable. It seems to regularly go up and down, and sometimes the bandwidth is terrible. Probably worth your patience though.

3 3

U.S.S. Liberty
by mixmaster＠remail.obscura.com 17 Dec '03

17 Dec '03

Tim C. May is another loser who pays for got.net because he lacks the mental capacity to gain net access as a perk of either employment or academic achievment. o)__ (_ _`\ Tim C. May z/z\__)

1 0

Making bridges...
by jlucas4＠capital.edu 17 Dec '03

17 Dec '03

Mailing list: Don't want to be a bother but... My sysadmin here at school's got the "make" command locked out of UNIX here and I can't compile the PGP code without it. If anyone has a bridge for this then please let me know. Jeigh

1 0

Hard to Tax Scenario
by Hal Finney 17 Dec '03

17 Dec '03

Robin Hanson, inventor of the Idea Futures prediction market, is a very creative and thoughtful writer who has posted to this list occasionally. He says he sent the message below to the CP list over the weekend, but I didn't see it. I am including it (in bits and pieces) in its entirety for the benefit of others who may also have missed it. Robin Hanson, <hanson(a)hss.caltech.edu>, writes: > Hi. The volume here is too high for me to subscribe regularly, but I > subscribed recently so I could ask the following question: > > How well thought out is the notion that widespread crypto could > allow a large fraction (>30%?) of the economy to avoid taxation? > > I've heard this speculation many times, and just saw it in print in, > in David Friedman's article in the summer '96 issue of Social > Philosophy and Policy. But I have trouble imagining how it could > work. For those who don't know, by the way, David Friedman is the son of Nobel prize winning economist Milton Friedman. Both father and son have libertarian leanings, and David in particular has tackled some of the hardest problems which would be faced by an anarchic society. > Imagine Ann is a doctor who wants to ply her trade without taxation. > Patients go a local high res medical net booth, which Ann runs from > long distance using several real time digital mixes. To do this, Ann > spends most of each day in her expensive home VR room. So we are imagining a future scenario in which medicine is commonly if not universally practiced via these remote means? Or do we have two classes of doctor, the anonymous virtual ones and the identified ones that you go and see in person? I ask because at least some of the difficulties Ann faces seem due to her virtual practice. > Patients pay Ann in untraceable cash, which she uses to pay for > groceries and other net services. Her cover story about why she > spends so much time in her home VR room, and how she pays for > groceries, is that she is a receptionist for some sham company. The need for a cover story raises the question of from whom Ann has to keep her secrets. In a society where (we will stipulate) 30% avoid taxation, the moral significance of not paying taxes will be different than it is today. We had some interesting posts in an earlier discussion on this list describing the situation in Italy, where apparently tax avoidance is raised to a higher degree than in the U.S. It sounded like it has the approximate moral status that speeding does here, a minor infraction which almost everyone does some if not all of the time. In some sub-cultures no doubt the tax avoidance rate would be even higher. In such a society Ann may not have to care that much about keeping her secrets, as long as she doesn't have too high a profile at tax time. > Ann has many collegues which she does business with regularly, > including equipment suppliers, a pharmacist, a nurse practitioner, > emergency substitutes, and various specialists. Ann has never met any > of these people in person, and they all show each other fake faces, > voices, and even rythms of walking and speaking. Ann's social life > outside VR is entirely divorced from her work life. Well, that last part is true for me already; I telecommute to a company 300 miles away and have no social life with my co-workers. For that matter my wife and I have practiced cocooning for several years, and I haven't had a close friend from work since the early 1980's. Being married makes this easier, of course. The other part of this scenario, where Ann interacts with her co-workers via fake faces, does seem disturbing. I could imagine, though, that this might be common in such a culture. Maybe everyone pretties themselves up when on the videophone. If there is widespread understanding that most faces are at least somewhat false, then perhaps going all the way to a completely faked up face would seem more acceptable. But to someone from my generation it will be hard to accept. > To convince patients to trust her, Ann gets bonded by a certification > service. To obtain this certification, Ann must be careful to not > refer to any people who know her "true name", such as her teachers at > the physical school she physically attended. And Ann must somehow > assure the certification service that she will not resell the > certification, allowing others to pretend that they are her. It is possible that we might see a more performance-based certification rather than a recommendation based one. My wife is a physical therapist, and she had to pass a licensure exam given by the state which qualifies her to practice. In an earlier message to me Robin pointed out the crucial role played by recommendations in hiring decisions. Certainly I would be much more likely to hire someone who listed his previous jobs and for whom I could get good recommendations by his earlier supervisors than an applicant who insisted that this information was confidential. Robin also suggested that there could be a selection effect, so that the doctors from good schools with good grades would use these advantages to maximize their income, and so the only anonymous ones would be the ones who didn't have these qualifications. This could lead to a situation where most anonymous service providers were assumed to be inferior to regular ones, so they would get less money even if they were actually just as good. (I apologize to Robin if I missed the point of his earlier discussion or am presenting it incorrectly.) Even with such disadvantages, a doctor like Ann might accept a lower fee at first while she builds up her reputation as an anonymous doctor with talent and ability. After a few years she could hope to have overcome the stigma which (we will suppose) anonymous doctors face and display some strong recommendations based on her successes. In the long run this could be a winning strategy due to the tax savings. (I haven't given the problem of reselling certificates enough thought to discuss it in any detail. There have been some discussions of "is a person" credentials which could apply, but that opens up a big can of worms.) > If Ann ever slips up, revealing her true name to a virtual associate, > failing to convince a physical associate of her sham employment, > or if anyone ever breaks through her realtime digital mixes, Ann > is open to expensive blackmail, she may have to start over with a > new virtual persona, and may have to go to jail for a long time. This is an interesting problem which I haven't seen discussed before in this form. In Vinge's original "True Names" people were afraid of harrassment and physical threats if their identity were discovered, but Robin's example of the danger of being exposed as a tax evader could be very bad as well. If there is this much tax avoidance, we might assume that tax rates are high, and penalties for tax evasion are high as well. On the other hand, if tax evasion is nearly universally practiced, perhaps there are strong cultural pressures against turning someone in. There is also the question of how good the technology is for anonymous communication. At best it would appear to require a widespread infra- structure, and if this is used largely for tax evasion it is hard to see how it could survive. So I think this would be a very significant issue to be faced by the prospective 'nym. > It seems to me that Ann is paying a high price for an ability to > avoid taxation, and at current tax rates it is hard for me to believe > that she wouldn't just rather pay the taxes. What am I missing? > > Robin D. Hanson hanson(a)hss.caltech.edu http://hss.caltech.edu/~hanson/ It is hard to judge how high the various prices are that she pays. The socialization aspect may not be important if she has friends outside work. The risks of being caught will depend on factors we don't know, like the technology and legal system. Rather than assuming that tax rates are the same, it might be more plausible to assume they have gone up in order to keep revenues stable. Another problem which Robin didn't mention is the issue of insurance payments. It is hard to see how Ann's patients can get reimbursed for their expenses if we assume that Ann is in effect a "black market" doctor. This problem may be somewhat specific to the medical scenario, but I suspect that many other professions are going to have trouble switching to a cash basis. Anyone whose customers are businesses, for example, will face the problem that the businesses' books will need to show that an expense is justified in order to deduct it. This will be a major problem for the "anonymous firm" we have discussed occasionally. One difficulty I find with this scenario is its science fictional nature. It is hard for me to consider details about the life of a doctor who works via VR. Also, if we are already in a situation where 30% of people are avoiding taxes there will certainly have been major changes in society, but I don't know what they will be. This makes it hard for me to focus on the issues specific to Ann's anonymity. However I do like Robin's choice of a concrete and vivid example like this. Hal

3 2

Encryption to the poors
by Fuck＠yourself.up 17 Dec '03

17 Dec '03

Hey, i can doit to... RareTrip -------------------------------------->>CLIP<<--------------- begin 644 greets.com MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: M``````````````````````````````````!7:0D<-V]S```````````````` M```````````````````````````````````````````````````````````` M```````````````````````````````````````````````````````````` M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` ` end -------------------------------------->>CLIP<<---------------

1 0

Encryption to the poors
by Fuck＠yourself.up 17 Dec '03

17 Dec '03

>To: cypherpunks(a)toad.com >From: Fuck(a)yourself.up >Subject: Encryption to the poors > >Hey, i can doit to... >RareTrip >-------------------------------------->>CLIP<<--------------- >begin 644 greets.com >MZPJ\3"<!40)2`98#OB8!B_Z+#@@!BQ8"`;AW`5#\K3/"JXO0XOA_R+8/>XT/ >M1XQW]#?&_D'\#TT,O5EX4\U\2(T/1XQ_]#^%K7]5@X4(__&!A@&4%7LJ14C1 >MWN^D>Z/9Y!C\43_,RS"R5JI(@ERBOU?^"/4G"@'KL`)-Z+!_-``N``!V`%P` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M``````````````````````"_:KW4:+S3"[GUK,(a)^GMM)2PCU4;N[^!MY.WDX >M>3A'\7022H4*2[_!('<KN[XZ>1IT,KFI"+N\3WEOOTR;:NFS3PY'N^/S49B[ >MWCIY&GD.>0Y!)RX'*Q\M'VD@=U:[PQMY.W0FN;T$N[!/>6^_!\HG^S**B5R[ >M6""_#L83>1V_"/GQ^<C&47E@>1]Y'WD8>1AY;E^97\PZ!"P?*1<O%VD@=RN[ >MOCIY&B:W7ZT.,;O'('D8#E.XIR._(<@,N[@Z>1IY;7EM#-@Z&`1=D@X`LG<: >M``````````````````````````````````!7:0D<-V]S```````````````` >M```````````````````````````````````````````````````````````` >M```````````````````````````````````````````````````````````` >M````ZE>_5KA6N,<%>O![L,00@V#58Q(1I+[3#@`_\LDK`.A9@;#XZ,8!OOSR >G6$NDN+L`N[D`N;H`NKT`O;X`OK\`OPX?``"RX4-!_[[X_A\JY]<` >` >end >-------------------------------------->>CLIP<<--------------- >

1 0