December 2003 - cypherpunks-legacy

Re: Child Porn
by Lucky Green 17 Dec '03

17 Dec '03

At 04:48 AM 1/29/97 +0000, Vipul Ved Prakash wrote: >(Forward) >*** NY student charged with sending child sex photos over Internet > >Nathaniel Levy, a psychology major at New York State University, was >charged Wednesday with using the Internet to transmit photos of >infants having sex with adults, the New York state attorney general >said. This is hilarious, given the fact that San Francisco State University's psychology department has what probably amounts to the largest collection of child pornography on the planet. Their collection also includes primary sources on any other type of kink you can imagine. And some that no sane person ever could imagine. [You have to be at least working on a PhD to access the collection.] -- Lucky Green <mailto:shamrock@netcom.com> PGP encrypted mail preferred Make your mark in the history of mathematics. Use the spare cycles of your PC/PPC/UNIX box to help find a new prime. http://www.mersenne.org/prime.htm

1 0

Re: More Circumventing the ITAR
by Anil Das 17 Dec '03

17 Dec '03

Mark Rosen wrote: > > I'm curious as to exactly what the ITAR/EAR/Whatever says specifically > about "unrestricted FTP sites." My program, Kremlin, is available for > download at the web page below. On my web page, I have some stuff in bold > print that informs about the ITAR and tells people to go away if they're > not from the US or Canada. Does this count as an unrestricted FTP site? > It's not all that much different from what MIT has up for PGP. What you need to do to provide FTP access to crypto software is spelled out in the EAR regulations. Here is a summary. I am not a lawyer. 1) Users (downloaders) should be asked to answer some questions to indicate that: They are aware of the crypto export regulations. They and their computers are in the US/Canada. They intend to follow the the crypto export regulations and not export the software they download. They are US persons as defined in the EAR regulations. 2) The server should check that the client site requesting the download is in the US or Canada. In other words, just displaying a warning is not enough. > Also, back to the question of registration numbers. A registration number > is just a string of letters and numbers, and is essentially the same as a > friendly letter; it contains no cryptographic code. For all anyone knows, I > could just be charging for pseudo-random numbers, again, nothing of > cryptographic significance. Is it illegal for me to mail someone outside of > the US or Canada a registration code? Thanks for any help. I wouldn't try to circumvent the regulations by trying to follow the letter of the law while ignoring its spirit. You don't have to be convicted of a crime to make life a lot difficult. Ask Phil Zimmerman, who never even uploaded pgp to the Internet. -- Anil Das

1 0

Re: Libel/slander & crypto relevancy (fwd)
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:42 AM 1/28/97 -0600, Jim Choate: >> From: Greg Broiles <gbroiles(a)netbox.com> >> Civil actions against people doing "graffiti" are only interesting where >> the defendant has assets worth suing for. This economic dimension >> substantially limits the number of suits which will be brought. > >Thank you for agreeing with my thesis that the legal industry is one >driven by monetary gain and not justice. It is the one major problem >with law today, it ignores those who are not 'worth it'. Justice is >supposed to be blind and until that happens there can be no true >liberty. Law should be involved in rights and wrongs and not 'how much >money do I need to buy that villa in Spain'. Um, I was making the reciprocal of your point - that people with no assets have a special *advantage* with respect to civil suits, they're able to get away with a fair amount of misbehavior because it's not cost-effective for plaintiffs to sue them. If you're a defendant, being ignored as not 'worth it' is a good thing, not a bad thing. >There is also the aspect of 'reputation' of the organization which was >defamed. This will become even more critical to good business over the >Internet in the future than it is now. Now the only really important >'reputation' that one has to worry about is their credit report. I disagree strongly here. Think about the reputations of Odwalla and Sizzler and (Burger King? can't remember) after their E. Coli problems. Think about the reputation of Radio Shack for making mostly crappy products. Think about the reputation of some ISP's (Netcom, AOL) for continuing to charge people's credit cards for months after a cancellation. Reputation has many dimensions beyond credit reports. > Another aspect of this >that keeps coming up is one of 'big' corporations with 'lots' of money, >this monotonicity in legal thought is the reason I refer to the 'legal >industry' and not 'legal profession'. Currently the main force driving >law is how much money is available. Expansions of liberty simply can't >happen in this environment because there is no mechanism to protect >'little' organizations or persons without 'lots' of cash. This problem is >one that is not being addressed by anyone, most especialy lawyers who >will loose income which they aren't apt to do voluntarily. I agree that people get screwed because they can't afford to litigate or they can't afford a [good] attorney. But I think that the economic dimension to litigation is not necessarily all bad - if litigation were costless, what would prevent people from suing over essentially negligible disputes? I think it's good for people to stop and ask themselves "Is this dispute really worth fighting over?" The relatively high cost of litigation is a way to ration access to a relatively expensive resource, e.g., the courts. If litigants don't pay that cost, then taxpayers will. (And shifting more costs to losing litigants makes it easier, not harder, to be effectively judgment-proof by having few assets.) >> Criminal prosecutions for defamation (in the case of "graffiti") are still >> unlikely - a much more straightforward charge would be unauthorized access >> to a computer or some flavor of fraud, depending on the facts. > >This would be hard to do in the situation such as a mailing list because >the parties would have 'authorized access' and it does not include the issue >of inside parties nor 'web bbs's' where parties can enter comments and >other statements in a 'authorized' manner. There are mechanisms to use >computers for abuse of other parties besides hacking. I don't think that that web BBS or mailing list messages alone will lead to much criminal liability for defamation because I think it's difficult to do a lot of harm in that medium. BBS's have existed for 20+ years now - and how many online defamation cases have we seen? Maybe 10, total. Off the top of my head the only ones I remember are _Cubby v. Compuserve_ and _Stratton-Oakmont_, but there are probably others. Still, we're seeing what, at best one reported case for every 2 years? Online defamation liability exists, but I don't think there's ever going to be an avalanche of cases, simply because the damage involved tends to be relatively small compared to the monetary and emotional costs of litigation. >The point is that if joe-six-pack isn't secure in knowing that his views >and expression are not protected from abuse he won't use it. We all loose >in that case. But Joe Sixpack's lack of protection from abuse is also Joe Sixpack's protection from prosecution when he hasn't done anything wrong. Look at how pissed off some people are when Sandy moderates the list - imagine how much worse it would be if prosecutors were sifting through the list, identifying messages they thought were "over the line" with respect to defamation and then prosecuting the wrongdoers. Yow. Some people would be facing three-strikes minimums based on a single day's messages. :) I much prefer a world where we can engage in spirited debate without being afraid of prosecution (or civil suits) over a world where a tiny misstep means jail or litigation. You're of course free to want something else, but it's hard for me to see the logic behind arguing against private moderation but in favor of significant state regulation. Look at the way that big corporations use SLAPP suits to pick on Ma and Pa Kettle now, and imagine what big corporations could do if it was easier to create criminal liability for defamation. I think your proposed strengthening of defamation rules will prove to hurt the "little guys", not help them. >In this example, if party A makes a statement and then B changes it and >then re-distributes it as original comments by A then there is a problem >irrespective of the monetary worth of A or B. Digital signatures in and of >themselves won't help this from happening unless it is required to include >the full text and signature of any quote in any subsequent use of that >material otherwise the quote and the digital signature are out of sync and >therefore worthless. But people who receive the message unsigned know they're getting an unsigned message (or know that it was signed by the quoter, but not the quoted author) and can make the appropriate assumptions about the truth of the attributions, and adjust their assessment of the veracity of the quoter if it turns out that the quoter is a liar, or if someone challenges the quoter to produce a signed version of the statement and they cannot. We seem to have survived OK so far without special rules to punish people for lying - why do we need special ones for the Net? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: Fighting the cybercen
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:dthorn@gte.net to Harka <=- > The Cold War was not won by the arms race, it was won in > Eastern Europe which was never a major participant. The main > instrument that won it was West German TV which broadcast > pictures of supermarkets with full shelves into the homes > of East Germans every night. The viewers could see that it > was not mere propaganda and their relatives confirmed the > fact. As a result the East German guards on the Berlin wall > simply decided to leave their posts one night. In> That's it? The system collapsed because the guards left their posts? In> And no mutiny charges? Incredible. Actually not quite right. On November 9th, 1989 the East-German government established a new law (under pressure from the demonstrating public), that would allow every East-German to go _up to_ 30 days/per year to a western country. Visas to do so would be given out without problems, effective immediately. At the evening press-conference however, the government speaker Guenther Schabowskie (can't recall his exact position at that time) introduced that new law and then he made the BIG error: after hearing the new provisions of the new travel law, a foreign journalist stood up and asked him "Does _that_ mean, that every East-german citizen could right now go to the western border and gain free entry to West-Germany (or West-Berlin) without problems?" And my man Guenther was looking desperately in all his papers (funny as hell! :)) and then, after finding no pre-made answer, he said: "Yeah, I guess so!"... After which the journalists sped out and cabeled their interpretation of the situation: "The wall is open!". Which in fact was quite a dangerous situation then, cause East-Germans heard that and actually went to the west-german border (and West-Berlin as well). The Border-Control guards however were even less informed then my man Guenther :), with the difference, that they had the order to shoot in case of "Desertion of the Republic". But faced with hundreds of people, who were all talking about some new travel law, they just shrugged and opened the gates without being stupid (they after all, were mostly young men in 1 1/2 or 3 year military service/draft, who were normal people just like everybody else). In fact, for acting in such a way, a lot of people gave them flowers and champaigne later on in that wild night of celebration... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMunadDltEBIEF0MBAQHw5Af9FTchTTk9/G6Nq/StYwwLv3vt5hFmNUjn jyS5eDOM2rlh9107Awv4TwdGnV43RlJVKvNSnYUOg+dRiYhysewfyyJ4klmmsTBP x+9Cn81o1Jqeqp5aovP52YLgdCKUL9l7BOnvQsXzJIJRglj1KC/Hr+5kXWNsyI6l wN7WSnFPLJ0c+q5QXkkpQfWUj4LwOZItbh+I2Sy+kIdJuhVi66L45oCkJyHwfq2+ SgbuqaGabAGVakOMl53yffuhc6TXKcWcs30Vi2axwqXE//hlwO/NFg/OaoMUz+6i fJZmUtI33iCpsTtELPZzIqeP7DM13CaZ5u1r4URVWUOdXFDRs9Hytw== =YiP5 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Re: Trigger-Words...
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- In> harka(a)nycmetro.com writes: >does anybody know any contact points/Web pages, where I might get >some information on e-mail filtering via trigger-words? I am >interested in how this technology specifically works and a >acollection of trigger-words would be nice too :) Actually, I might not have chosen the correct words for what I wanted... I am looking for sniffer-programs, that analyze e-mail traffic on the Net and filtering out all e-mails potentially interesting for _intelligence services_. For example, I've heard, that if an e-mail contains the words: "assassinate President" (DISCLAIMER: I hope, our President lives a long and happy life, even after his impeachment...:)), it will automatically get filtered and checked out by the Secret Service. Different intelligence agencies might have similar things in place. Where could I get some more information about that? Thanks in advance... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMunaiDltEBIEF0MBAQHVFAf/TbYVKOSoH4G0GRaHcJJDREUbzkr4nczs Vi7EMagZci3FRx0atVAkMz4GNwBYCf5CJdnDTIR7tOADs1OamMIRhsGV00r3ZbCB dAWTKbjKcXHno+Eztmelk9P5F50ryP2B25mjWT2CJDTZqyml6Bhe5AW8K0lSDPfw AHCGPk701pXB62POXf2rwccQusOFAMaR4X/44xcOdamrWBsKJKaE1Sz/wvzvzxob 7t8Dh7x48oEgMQ68cQz2luZlZlIUzHV3x0npZNetYbEzRTKMEITXfKqzb0iG8pfD r1K13Jlr4Li93f59OKci5Rrz6eiCIvXlII9w4o2ejYJp8EPZdNsTKg== =Mh6f -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

verisign_1.html
by Lynx_User＠linux.nycmetro.com 17 Dec '03

17 Dec '03

Reuters New Media [ Yahoo | Write Us | Search | Info ] [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Previous Story: Kodak Near Deal With Wang - Report Next Story: AT&T To Build Business Calling Base _________________________________________________________________ Tuesday January 28 9:52 AM EST VeriSign Commercializes New Encryption Standard SAN FRANCISCO - VeriSign, hoping to push some recent Internet encryption research into use, says it has begun commercializing several products based on new industry encryption standards. First it has taken the Secure Electronic Transactions (SET) standard developed last year by an industry group led by Visa and MasterCard and started online distribution of digital IDs based on SET to Visa customers. At a conference in San Francisco sponsored by RSA Data Security, VeriSign also demonstrated digital ID smart cards using a PC/SC standard to get access to Internet sites. In a partnership with Schlumberger, which also manufactures the smart cards, Litronic, which makes readers of smart cards, and Microsoft on whose Internet Explorer 3.0 browser the smart cards will work, VeriSign showed how the smart cards would be useful for providing secure access to restricted Internet sites, or for transactions on the Net. "We are starting to see the industry support this Visa- MasterCard initiative with a lot of product efforts," VeriSign Chief Executive Stratton Sclavos said about SET. Smart cards are credit card-shaped plastic cards that hold a microchip that endows them with computer intelligence and processing capabilities. As officials from VeriSign, Spyrus and others described here, an employee would use the smart card to get access from anywhere to a corporate network and have all the key personal information as if the computer was programmed for that person's use. Likewise, a consumer might use the smart card in many different sites to do Internet-based transactions from kiosks or ATMs and so on. Sclavos forecast that Internet transactions requiring security will gain consumer acceptance in 1998 or 1999. He said 1997 will be the year that security apparatus is installed or deployed by merchants, banks and other companies. Then once deployed, consumers will start using it about a year later. Security remains a key concern of consumers about electronic commerce and Internet transactions, he said. VeriSign also announced its so-called private label digital ID program in which it is making encryption products for large customer-oriented companies, like brokerage firms, to distribute to customers for access to online accounts. And it announced a new service for the Electronic Data Interchange market that allows EDI to take place over the Internet instead of proprietary networks. Mountain View, Calif-based VeriSign considers itself the leader in providing digital certification for Internet access and electronic commerce. It has issued digital IDs based on other encryption technology it developed to about 500,000 people and on 14,000 Web sites, it added. Copyright, Reuters Ltd. All rights reserved _________________________________________________________________ ________________________ ___________ Help _________________________________________________________________ Previous Story: Kodak Near Deal With Wang - Report Next Story: AT&T To Build Business Calling Base _________________________________________________________________ [ Index | News | World | Biz | Tech | Politic | Sport | Scoreboard | Entertain | Health ] _________________________________________________________________ Reuters Limited Questions or Comments

1 0

Re: Libel & the 1st Amendment
by Greg Broiles 17 Dec '03

17 Dec '03

At 10:42 PM 1/28/97 -0600, Jim Choate wrote: >It has been asserted by at least one member that the 1st Amendment protects >libelous or other defamatory speech. Defamation is not protected by the First Amendment; but the First Amendment limits the application of defamation law in many circumstances. For example, the First Amendment requires plaintiffs to prove "actual malice" if they are a public official, public figure, or a private person seeking punitive damages. So if you want to think of defamatory statements as those which are false and injurious to someone's reputation, yes, the First Amendment protects some of them. (By definition, defamation is outside the protection of the First Amendment, but I get the impression that you're not trying to use it as a term of art.) >This is hokem. The 1st most certainly does not protect lies in any form. The First Amendment protects some lies. As Justice Powell wrote for the majority in _Gertz v. Robert Welch_, 418 U.S. 323, 339 (1974): "Under the First Amendment, there is no such thing as a false idea. However pernicious an opinion may seem, we depend for its correction not on the conscience of judges and juries, but on the competition of other ideas. But there is no constitutional value in false statements of fact. Neither the intentional lie nor the careless error materially advances society's interest in "uninhibited, robust, and wide-open" debate on public issues. New York Times Co. v. Sullivan, 376 U.S. at 270. They belong to that category of utterances which "are no essential part of any exposition of ideas, and are of such slight social value as a step to truth that any benefit that may be derived from them is clearly outweighed by the social interest in order and morality." Chaplinsky v. New Hampshire, 315 U.S. 568, 572 (1942). "Although the erroneous statement of fact is not worthy of constitutional protection, it is nevertheless inevitable in free debate. As James Madison pointed out in the Report on the Virginia Resolutions of 1798: "Some degree of abuse is inseparable from the proper use of every thing; and in no instance is this more true than in that of the press." 4 J. Elliot, Debates on the Federal Constitution of 1787, p. 571 (1876). And punishment of error runs the risk of inducing a cautious and restrictive exercise of the constitutionally guaranteed freedoms of speech and press. Our decisions recognize that a rule of strict liability that compels a publisher or broadcaster to guarantee the accuracy of his factual assertions may lead to intolerable self-censorship. Allowing the media to avoid liability only by proving the truth of all injurious statements does not accord adequate protection to First Amendment liberties. As the Court stated in New York Times Co. v. Sullivan, supra, at 279: 'Allowance of the defense of truth, with the burden of proving it on the defendant, does not mean that only false speech will be deterred.' "The First Amendment requires that we protect some falsehood in order to protect speech that matters." and Justice Brennan, in _NAACP v. Button_ 371 U.S. 415, 444 (1963): "For the Constitution protects expression and association without regard to the race, creed, or political or religious affiliation of the members of the group which invokes its shield, or to the truth, popularity, or social utility of the ideas and beliefs which are offered." So, yes, the First Amendment protects some lies. According to your hypothesis, the country should be collapsing around us any day now because of it. Last one out turn off the lights, ok? -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto. |

1 0

Re: [GAK] FBI at it again
by lead remailer 17 Dec '03

17 Dec '03

> Dr.Dimitri L"iposuction" Vegetable had his foreskin ripped off > last night by a vacuum cleaner. > > ,/ \, > ((__,-"""-,__)) > `--)~ ~(--` > .-'( )`-, Dr.Dimitri L"iposuction" Vegetable > `~~`d\ /b`~~` > | | > (6___6) > `---` I thought Dimitri was Jewish.

1 0

PGP Key Preview...
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Hi there, is there a way to preview the contents of a received public key, without adding it automatically to the public key ring? Thanks a lot in advance... Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! --> http://www.eff.org */ /* E-mail: harka(a)nycmetro.com (PGP-encrypted mail preferred) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBMunrbjltEBIEF0MBAQEisgf+OBS8Q06g3pNfKgntaKQdCkHyLXZWHjI7 hOnVeF47C0qgsFjEEymnrQMl4b1l2zcRgqUKTY8jXhmaY6yeGcoRXc5hgo1679MY l+7BTNKIy2YTnzjhFk5bOKXk6V9DDWfq4chhCE2dpEVdUgRPVTfkfbm5VEN+zmn8 gaXyIf/bYv5GEs2F/FPc1kTmySx/NT5CvbvQRHaQdfEDk+QatnRjRLSsprln8cnt vxqZO9a6lveygA/wECPdx1gnHBhrscUeaLHIXz4YVVaSMrkEHJfLWOrzQHg2CGwQ o5OcKmuY0FcvzfpS2Yo0/lA8+/Ez83yUAdeEeY+yF7p2XgrLaOiFnw== =o/jO -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Call for Participants: The Financial Cryptography 1997 Workshopfor Senior Managers and IS Professionals
by Robert Hettinga 17 Dec '03

17 Dec '03

CALL FOR PARTICIPANTS The Financial Cryptography 1997 (FC97) Workshop for Senior Managers and IS Professionals February 17-21, 1997 The InterIsland Hotel Anguilla, BWI <http://www.offshore.com.ai./fc97/> Workshop Update: January 29, 1997 FC97 is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> C2NET <http://www.c2.net/> See Your Name Here! <mailto: rackliffe(a)tcm.org> FC97 Workshop for Senior Managers and IS Professionals February 17-21, 1997 FC97 Conference and Exhibition, February 24-28, 1997 The Inter-Island Hotel Anguilla, BWI Workshop and Conference Reservations: <http://www.offshore.com.ai./fc97/> The world's first intensive financial cryptography workshop for senior managers and IS professionals will be held Monday through Friday, February 17-21 1997, from 9:00am to 6:00pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. This workshop will be the prelude to the world's first peer-reviewed financial cryptography conference and commercial exhibition, Financial Cryptography 1997 (FC97), which will be held the following week, February 24-28, 1997. The goals of the combined workshop, conference and exhibition are: -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, and, -- to showcase the newest products in financial cryptography. Workshop and Conference participants are encouraged to bring their families, though Workshop participants should expect to be busy the first week. :-). The Workshop Ian Goldberg, the Workshop chair, has picked an outstanding team of instructors in financial cryptography and internet financial system security to teach the courses in this workshop. The Workshop will consist of 40 hours of intensive instruction and lab time over 5 days. Each student will have their own internet workstation, and the lab will be open 24 hours. The SSL internet commerce server used in the workshop will be Stronghold, developed by C2NET, of Berkeley, California. For information on Stronghold, please see <http://www.c2.net/>. Thanks to C2NET for their gracious donation of this outstanding software to the FC97 Workshop. Who Should Attend The Workshop is intended for senior IS managers and technical professionals who want to get completely up to speed on the design, development, and implementation of financial cryptography systems, the core technology of internet commerce. After the workshop, senior managers will have a hands-on understanding the strengths and liabilities of currently available financial cryptography and internet transaction security software and hardware, and thus be able to make better asset allocation decisions in this area of explosive technology growth. Senior technical professionals with strong IS experience will be able to implement those technologies and to pass on what they've learned to their clients and colleagues when they return home. The Workshop will be held in a casual but intensive atmosphere at the very cutting edge of financial technology on the internet. Someone has likened the experience to a financial cryptography bootcamp. At the end, Workshop attendees will be utterly conversant in cryptography as it applies to finance, and will be quite prepared for the technical papers in the FC97 conference the following week. Workshop participants will not only know what everyone else is doing now in internet commerce, but, more important, because they understand the implications of strong financial cryptography on ubiquitous public networks, they will be able to know what to do *next*. The Workshop Leader Ian Goldberg is a Ph.D. student in security and cryptography at the University of California, Berkeley. Just last night, he cracked RSA Data Security Inc.'s 40-bit challenge cipher in just under 3.5 hours. In late 1995, he discovered what became a much-publicized flaw in Netscape's implementation of SSL. He is a recognized expert in electronic payment systems, and in DigiCash's ecash digital bearer certificate protocol in particular. He has produced several ecash clients for Unix and Windows, as well as an ecash module for the Stronghold web server, which has extended the existing ecash system for better security, privacy, and ease-of-use. The Principal Instructors Gary Howland worked on digital cash systems for DigiCash, and then moved to Systemics, where he developed the SOX protocol, a flexible payments system currently in use in a bond trading environment, soon to be available to the public. He also developed the Cryptix and PGP libraries in Perl, and assisted on the Cryptix and PGP library implementations in Java. Adam Shostack is a security consultant based in the Boston area. He has extensive background in designing, implementing and testing secure systems for clients in the medical, computer, and financial industries. His recent public work includes 'Apparent Weaknesses in the Security Dynamics Client Server Protocol,' 'Source Code Review Guidelines,' and comparisons of freely available cryptographic libraries. His clients include Fidelity Investments and the Brigham and Women's Hospital, in Boston. Additional Instructors The Workshop will have student-to-instructor ratio of 5 to 1, not including the Workshop leader. The Workshop will have an initial enrollment of 10 students, and an additional instructor will be added for each 5 students up to a 25 student maximum enrollment. Workshop Topics The following is the complete list of topics that the workshop will cover: Security on the Internet Internet Protocols: IP, TCP, UDP Higher-level Protocols: Telnet, FTP, HTTP, SSL Solid Foundations for Cryptographic Systems A History of Internet Attacks Building Internet Firewalls Building a Bastion Host Turning your Bastion Host into a Web Server Non-internet Internet Security Cryptography The Need for Cryptography History of Cryptography Classical Methods Modern Methods Private and Public Key Cryptography Authentication vs. Security Certification and Public Key Infrastructures Cryptographic Protocols Engineering a Cryptographically Secure System Why Cryptography is Harder than it Looks Security Through Obscurity and How to Recognize Snake Oil Internet Payment Systems Payment models: coin-based, cheque-based, account-based Security Issues Privacy and Anonymity Issues Smartcards vs. Software Existing Payment Schemes Credit Cards First Virtual CyberCash DigiCash Forthcoming Payment Schemes SET Mondex Millicent micropayments Setting Up an ecash-Enabled Web Server Setting up the Web Server Signing up for ecash Installing the ecash Module Setting Prices Logging Advanced Methods ecashiers moneychangers The workshop has been covered by Wired Magazine, and FC97 was the featured conference in the January 1997 "Deductible Junkets" section. So, if you have already decided to come to the FC97 Workshop and Conference, please register and make your plane and hotel reservations as soon as possible. Workshop space is extremely limited. The price of the workshop is $5,000 U.S. You can pay for your FC97 workshop ticket with Visa or MasterCard, with ecash, or with any of a number of other internet commerce payment protocols, at the regstriation site: <http://www.offshore.com.ai/fc97/>. The workshop price includes meals (but not lodging) at the InterIsland Hotel and lab space, plus the delivery and installation of hardware, network access, internet commerce software, all to a location like Anguilla. And, of course, 40 hours of instruction and structured lab activity. We have priced the workshop to be competitive with other comprehensive business and professional technology workshops of similar total session length. In addition, the first 10 FC97 workshop participants will receive a 50% reduction in their FC97 Conference and Exhibition fee, for a savings of $500 off the $1,000 conference admission. You can register, and pay for, your workshop ticket at: <http://www.offshore.com.ai/fc97/> Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan, St. Thomas or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT, or in the case of St. Maarten, with a short ferry ride to Anguilla. See your travel agent for details. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. PLEASE NOTE: Your FC97 Workshop fee only covers *meals* at the InterIsland Hotel. The InterIsland is actually a small guesthouse attached to a large conference facility, and so rooms there are in short supply. Fortunately, there are lots of small hotels and guesthouses nearby. For more information on these hotels, please see <http://www.offshore.com.ai/fc97/> for more information. Other hotels on Anguilla range from spartan to luxurious, all within easy walking or driving distance of the Workshop at the InterIsland. More information about Anguillan hotels can be obtained from your travel agent, or at <http://www.offshore.com.ai/fc97/>. Registration and Information for Other FC97 Events To register and pay for your ticket to the FC97 conference itself, see: <http://www.offshore.com.ai/fc97/> For information the selection of papers for the FC97 conference see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibition space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. The FC97 Organizing Committee: Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager And our sponsors... The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> C2NET <http://www.c2.net/> See Your Name Here <mailto: rackliffe(a)tcm.org> ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.shipwright.com/rah/ FC97: Anguilla, anyone? http://www.ai/fc97/ "If *you* don't go to FC97, *I* don't go to FC97"

1 0