December 2003 - cypherpunks-legacy

new ,CRIPT password
by Sebastia Lancho 17 Dec '03

17 Dec '03

Hi ! I'm Sebastian from Barcelona. I'm new on internet. I'm a developer.In my first project I did a homebanking but I don't know how cript the password of the users. If somebody has a little C function that can do this please send me! and report me information! many thanks Sebastian tan(a)mss.es

1 0

Re: Sweden Netscape Intra
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- -=> Quoting In:tcmay@got.net to Harka <=- In> The Swedish plan is something to be avoided. Consider just a few In> quotes: Actually, I was just flying over the text before forwarding it. But after reading it in depth, I agree with you. In> The government gives out the mailboxes. Wanna bet they give out the In> keys, too? Not only that but it would create the e-mail monopoly, that would be the destruction of the de-centralized nature of the Internet (e-mail being part of it). Just imagine, how easy it would be to have a few well publicized cases of remailer-abuse and the Swedish Postal Office therefore decides to automatically block all mail coming from (and maybe even to) remailers. With the majority of people having no clue about remailers in the first place (except what the press will feed them) the protest will be small enough to be ignored. That could even be extended to crypto, as you indicate. If Sweden ever outlaws cryptography, the monopoly would provide a perfect setting of enforcing such (with the few exceptions of where stego is used). The same applies to content and traceability of e-mails. In> (Yes, I understand that the system is being presented as "voluntary." In> For how long? And what happens to non-PTT ISPs when the PTT is a state In> monopoly? (Imagine what would happen if the U.S. Postal Service made a In> deal wherein AOL became the favored provider.) Market-driven "voluntary" measurements tend to be rather forced upon people than anything else. If something is standard then you'll have to use it because most other people do too. That is the danger with monopolies of any kind. This, I am afraid, will happen with crypto-issues in the US itself. I am almost certain, that Windows 97 will adress cryptography in one way or the other. If they put in means to encrypt e-mails for example right from the operating system and independent of the provider, then this would be the death-blow to PGP. And considering the talk about "key-management-infrastructure", then this will be probably the best means to achieve it. In fact, it might not even be a GAK-enabled system, but one that's easy to crack (propriatory algorithm or whatever). The civil-liberty groups have no GAK-issue to talk about anymore and few will understand, why "security through obscurity" is not good. The majority however, who doesn't care anyway much about crypto, will use that slick Windows interface and not worry any further. That would be cause for celebration at the TLA's and the end to wide-spread strong crypto. Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM0oCzzltEBIEF0MBAQEf4gf/ZINVtWwqyIzYXbi7uDxmTKCdfMS1Xujj /AlYGsmjUeh7UduN2q8YmRqzfuUhA6SNOaT0La+QuqzIOImmY3MfbH9tWc+xWqNQ 4cUC/aPFAl/7SxbXA4lsL4QD8Vnf3Tf2bxt5XUC7TO6lfEW91hblnz1WV2OVimgt pBGhv8b0td+CIAPnGd8WoscbH1NtgZMz+bLaF9zTl22KZerd8tfUbDhPQjWHOzgv Ck0mXTuOPpRXYTO+U9tua1U/Nz2dJN/+VXJO3nUfJOJ8C5eAHimji+IbsoWt1jur O27KvFuIhPtDaQIenv62G8ClmVxvd+XzIJ+43XnEU4r3PmFHgDJLjg== =wREG -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

Cipher newsletter
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- == Forwarded Message Follows ========================================= Vance Bell wrote: From: vbell(a)dept.english.upenn.edu (Vance Bell) Subject: Cipher Date: Sun, 6 Apr 1997 16:46:08 -0400 (EDT) Cipher http://www.itd.nrl.navy.mil/ITD/5540/ieee/cipher/ Cipher is the electronic newsletter of the Technical Committee on Security and Privacy, IEEE featuring Security and Privacy News Briefs, Conference Reports, Commentary and Opinion on computer security and privacy issues. Recent articles: Security and Privacy News Briefs * LISTWATCH: Items from security-related mailing lists by Mary * UK Policy on Licensing TTPs Proposed, Criticised * Two New Sources of Random Numbers * Attack Reports and Responses * U.S. Computer Security Breach During Desert Shield? * New IETF Working Group Formed to Standardize SSH * News items from past Cipher issues Conference Reports * Report on 1st Annual Workshop on Education in Computer Security (WECS '97) * Report on ISOC Symposium on Network and Distributed System Security '97 Commentary and Opinion * Practical Experimentation in Information Security Education (A brief report from a survey) *Summary of Comments on "A Serious Problem for Key Escrow Systems?" Contact: Carl Landwehr, landwehr(a)itd.nrl.navy.mil - ------------------------------ == End Forwarded Message ============================================== Ciao Harka /*************************************************************/ /* This user supports FREE SPEECH ONLINE ...more info at */ /* and PRIVATE ONLINE COMMUNICATIONS! -> http://www.epic.org */ /* E-mail: harka(at)nycmetro.com (PGP-encrypted mail pref'd) */ /* PGP public key available upon request. [KeyID: 04174301] */ /* F-print: FD E4 F8 6D C1 6A 44 F5 28 9C 40 6E B8 94 78 E8 */ /*<<<<<<<<<<<<<<<<<<<<<<<<<<<<<>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>*/ /* May there be peace in this world, may all anger dissolve */ /* and may all living beings find the way to happiness... */ /*************************************************************/ -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAgUBM0oDDjltEBIEF0MBAQGisAf+LYkc1Pn7UGdkW5TyjR+Lz1gZ2/Qn1izJ m8aIydx1bHkkRTarV432i69l+SPV8BeWjHIELBNSDfTQ+rci2AFRvxBHdBquyl0A KLjdvhek2fJNn9vC8eifDpE0wM4VR+Fn7RfHFwMMr4CxocZlMxkXseebQ4hsviVk eJb8dbz4oFYtE4AXhNCzCsAx9LQNojJgxq+xGzMnBreTGNDZtRdKhi7MMhiWCmFp u2FQ9lpNs2I8wdlAuHIYAUg11gylkKk7iwUJ1fVLgaeCBww7da2TFcl7ybLvMx0Z m9GYeo9bsWpRFJuJcZxa2mLo0DksDPfHytqcxyGNyb7ebPkZJ4lLww== =6Ly2 -----END PGP SIGNATURE----- If encryption is outlawed, only outlaws will have encryption...

1 0

EPIC Alert 4.05
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

== Forwarded Message Follows ========================================= * Originally By: In:epic-news@epic.org * Originally Re: EPIC Alert 4.05 * Original Date: 04-08-97 18:08 ============================================================== @@@@ @@@@ @@@ @@@@ @ @ @@@@ @@@@ @@@@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @@@ @ @ @@@@@ @ @@@ @@@ @ @ @ @ @ @ @ @ @ @ @ @ @@@@ @ @@@ @@@@ @ @ @@@@ @@@@ @ @ @ ============================================================== Volume 4.05 April 8, 1997 -------------------------------------------------------------- Published by the Electronic Privacy Information Center (EPIC) Washington, D.C. http://www.epic.org/ ======================================================================= Table of Contents ======================================================================= [1] OECD Releases Crypto Guidelines [2] White House Floats Draft Crypto Bill [3] FAA Calls for Collecting SSNs of all Air Travelers [4] Groups Urge IETF to Fix Cookies [5] National Research Council Reports on Privacy of Medical Systems [6] FTC To Conduct Hearings on Privacy, Investigate Databases [7] NTIA Files Comments on Privacy of Telephone Calling Information [8] Upcoming Conferences and Events ======================================================================= [1] OECD Releases Crypto Guidelines ======================================================================= The Organization for Economic Cooperation and Development (OECD), a 29 country international organization, released on March 27 its long anticipated Guidelines for Cryptography Policy. The Guidelines are intended to promote the use of cryptography, to develop electronic commerce through a variety of commercial applications, to bolster user confidence in networks, and to provide for data security and privacy protection. The Cryptography Policy Guidelines are a non-binding agreement that identifies the basic issues that countries should consider in drawing up cryptography policies at the national and international level. The Recommendation culminates one year of intensive talks to draft the Guidelines. They are designed to assist decision-makers in the public and private sectors in developing and implementing coherent national and international policies for the effective use of cryptography. Member countries are encouraged to establish new, or amend existing, policies to reflect them. The Guidelines set out eight basic Principles for cryptography policy in the areas of trust, user choice, market development, technical standards, privacy, lawful access, liability and international cooperation. The key recommendations of the OECD include: -- Recognition of commercial importance of cryptography. The Guidelines recognize that cryptography is an effective tool for the secure use of information technology by ensuring confidentiality, integrity and availability of data and providing authentication and non-repudiation mechanisms. -- Rejection of key escrow encryption. The U.S. sought endorsement for government access to private keys. Initial drafts of the guidelines included this recommendation. The final draft does not. OECD countries rejected this approach. -- Endorsement of voluntary, market-driven development of crypto products. The OECD emphasized open, competitive markets to promote trade and commerce in new cryptographic methods. -- Need for critical assessment of key escrow. The OECD Guidelines recommend that countries which are considering key escrow techniques to consider also "the risks of misuse, the additional expense of any supporting infrastructure, the prospects of technical failure, and other costs." -- Endorsement of strong privacy safeguards. The OECD adopted one of strongest privacy principles found in any international agreement, including the obligation to apply the OECD privacy principles to crypto products and services. The OECD also noted favorably the development of anonymous payment schemes which would minimize the collection of personal data. -- Removal of Restrictions on Cryptography. The OECD urged member countries to remove, and avoid creating, obstacles to trade based on cryptography policy. This guideline should lead to further liberalization of export control policies among the OECD member countries. Drafting of the Guidelines for Cryptography Policy began in early 1996. More than 100 representatives from OECD Member countries participated, including government officials from commerce, industry, telecommunications and foreign ministries, law enforcement and security agencies, privacy and data protection commissions, as well as representatives of private sector and privacy advocates. The Global Internet Liberty Campaign (http://www.gilc.org/) an international coalition of civil liberties and human rights organizations, organized a conference for the OECD delegates in Paris in September 1996. The conference contributed significantly to the OECD's final recommendations. The Guidelines, the OECD press announcement and additional commentary are available at: http://www.epic.org/crypto/oecd/ ======================================================================= [2] White House Floats Draft Crypto Bill ======================================================================= The White House has released a new draft proposal on key escrow encryption to the Congress. The draft (dated March 12) is entitled the "Electronic Data Security Act of 1997." The legislation is the latest attempt to push forward the result the Administration sought to achieve with the failed Clipper Chip initiative -- ensuring government access to all encrypted communications through government-escrowed keys. To achieve this goal, the bill would create incentives for all persons and organizations to use a government-certified Certificate Authority (CA) to establish their identities for any electronic transactions. The CA would ensure that there was an escrow system in place before it would issue an identification certificate to the user. Government agencies would likely refuse to communicate with persons and entities not using a government certified CA. Agencies would also likely pressure others over whom they have substantial regulatory or economic power, such as banks, state agencies, and government contractors, to require that government-certified CA's are used to communicate with them. Another provision would require any person who "manufactures, imports, packages, distributes or labels" encryption products to state whether they use a key recovery agent. The draft bill also provides that if non-escrowed cryptography is used during the commission of a crime, an additional five year prison sentence could be imposed. Another provision, apparently intended to gain industry support, would limit the potential civil liability of any "Certification Authority" or "Key Recovery Agent" who obtains a government certification. More information on cryptography policy is available at: http://www.epic.org/crypto/ ================================================================== [3] FAA Calls for Collecting SSNs of all Air Travelers ================================================================== On March 13, the FAA issued a call for comments on a FAA proposal to require airlines to collect substantial personal information on each passenger, including full name, address, next of kin, Social Security Number and date of birth. The purpose of this collection would be to facilitate identification of victims of airplane crashes. The proposal anticipates that passengers would have to provide this information in order to board an aircraft. The proposal raises a number of substantive threats to personal privacy. One major problem is that it appears to violate the Privacy Act of 1974, which limits the ability of government agencies to collect the SSN. There also appear to be no limitations on the use of the collected information, creating a risk that the data could be put to a wide variety of unrelated uses by both the airlines and government agencies. One potential use of this information would be in connection with the controversial "profiling" proposals recently recommended by the Gore Commission. The use of the Social Security Number would simplify the comparison of passenger records with other databases. It appears likely that the FAA is using this proposal as a less controversial rationale to demand the collection of personal information rather than specifically including it in the profiling proposal, which has already generated considerable public and editorial opposition. More information on the proposal and other FAA activities is available at the EPIC Airline Security Page: http://www.epic.org/privacy/faa/ ======================================================================= [4] Groups Urge IETF to Fix Cookies ======================================================================= Several leading consumer, civil liberties, and children's advocacy organizations have urged an Internet standards organization to fix a problem with web browser software that allows companies and government agencies operating web sites to track the activities of Internet users. The groups say that there is a problem with the so-called "cookies" technology. Cookies make it possible to read information on users' computers and find out where they go on the Internet. Some companies in the on-line advertising industry use cookies data to collect personal information for advertising and marketing. The Internet Engineering Task Force, a loose coalition of technical experts responsible for the development of standards for the Internet is meeting this week in Memphis to consider a wide range of technical issues concerning the Internet, including a proposal to limit the ability of companies to use cookies. The proposed safeguard has come under attack by several companies engaged in interactive advertising and marketing. According to a March 31, 1997 article in Ad Age, these groups are now drafting a "counter-proposal" to head-off the IETF recommendation. In the letter, the groups express support for RFC 2109, the proposal for an HTTP State Management Mechanism. The letter further says that "transparency" -- the ability of users to see and exercise control over the disclosure of personally identifiable information -- is a critical guideline for the development of sensible privacy practices on the Internet" The letter was signed by the Center for Media Education, Computer Professionals for Social Responsibility, the Consumer Federation of American, the Consumer Project on Technology, the Electronic Frontier Foundation, the Electronic Privacy Information Center, National Association of Elementary School Principals, NetAction, Privacy International, the United States Privacy Council, and more than one hundred Internet users. The coalition letter, and more information about cookies, is available at: http://www.epic.org/privacy/internet/cookies/ ======================================================================= [5] National Research Council Reports on Privacy of Medical Systems ======================================================================= The National Research Council has released a report on the privacy of medical systems. The report, entitled "For the Record: Protecting Electronic Health Information," calls for measures by government, companies and consumers to better protect the privacy of medical records. The NRC recommended a two-prong approach to dealing with medical privacy, involving the revision of organizational practices to deter unauthorized access to and/or misuse of electronic medical records, and implemention of more stringent technical measures as a safeguard in case the first prong proves ineffective. The NRC also proposes that health-related organizations adopt fair information practices similar to those contained in the federal Privacy Act of 1974. Consumers should have access to a privacy ombudsman that not only provides such information, but could also address patient grievances over violations of privacy. The NRC waffled on fundamental issues such as the desirability of national databases of medical information and the creation of a unique national patient identifier, but expressed concerns over the ramifications for privacy entailed in such a system. Also proposed by the NRC, although admittedly difficult to implement, is the identification of parties which may inappropriately link patient information. Using the Social Security Number, the NRC states, is in its current form insufficient to protect the privacy of individuals. More information on medical privacy is available at: http://www.epic.org/privacy/medical/ ======================================================================= [6] FTC To Conduct Hearings on Privacy, Investigate Databases ======================================================================= The Federal Trade Commission has announced that it will convene a public workshop devoted to consumer information privacy on June 10-13, 1997. This is a follow-up to FTC workshops held last summer. The workshop is intended to gather information on the collection, compilation, sale and use of computerized data bases that contain sensitive identifying information, as well as self-regulatory efforts, technological innovations and unsolicited e-mail. The workshop will also address these developments as they pertain to children's personal information. The workshop will gather information for a new computer data base study that the FTC has also announced. However, this study will be limited to "look up services" which contain personal identifying information, such as the Lexis-Nexis P-TRAK service. Importantly, the FTC will not address computer databases used primarily for direct marketing purposes, medical and student records or the use of computer credit reports for employment purposes. Interested participants must submit written comments by April 15, 1997. More information is available at the FCC web page: http://www.ftc.gov/ ======================================================================= [7] NTIA Files Comments on Privacy of Telephone Calling Information ======================================================================= The Commerce Department's National Telecommunications and Information Administration (NTIA) recommended on March 27 that the Federal Communications Commission (FCC) establish more specific policies to protect <<< Continued to next message >>> ====================================================================== If encryption is outlawed, only outlaws will have encryption...

1 0

Re: IRS raids a cypherpunk
by rlpowell＠calum.csclub.uwaterloo.ca 17 Dec '03

17 Dec '03

The followiing is an article that didn't even brng a hiccup to cypherpunks. WHERE IS EVERYBODY?? -Robin, sniff :-( In article <v03007807af6a270a11d5(a)[168.161.105.191]> Declan McCullagh <declan(a)well.com> writes: Path: news.csclub.uwaterloo.ca!not-for-mail From: Declan McCullagh <declan(a)well.com> Newsgroups: csc.lists.coderpunks Date: 3 Apr 1997 23:41:04 -0500 Organization: University of Waterloo Computer Science Club Lines: 79 Sender: daemon(a)calum.csclub.uwaterloo.ca Approved: mail2news(a)csclub.uwaterloo.ca Distribution: csc NNTP-Posting-Host: calum.csclub.uwaterloo.ca Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" X-Sender: declan(a)mail.pathfinder.com Precedence: bulk Xref: news.csclub.uwaterloo.ca csc.lists.coderpunks:1207 [I've attached some excerpts from the article. Check out the URL below for the whole thing. --Declan] ******** http://cgi.pathfinder.com/netly/editorial/0,1012,800,00.html The Netly News Network April 3, 1997 IRS raids a cypherpunk by Declan McCullagh (declan(a)well.com) Jim Bell's first mistake was publishing an essay describing how disgruntled citizens could kill off Federal government agents by using anonymous betting pools and digital cash. His second mistake was informing the IRS that the agency had no legal authority to tax him. About twenty armed IRS agents and other Federal police swarmed into Bell's home in Washington state on Tuesday morning, hunting for evidence that Bell's "Assassination Politics" essay had come to fruition. They expropriated Bell's three computer systems, two guns and even a solitary mouse cable. The Feds were taking no chances: Since Bell's voluminous Net postings mentioned tax collectors, agents from the BATF, FBI, DEA, and local police forces joined the raid. [...] The raid stemmed from a six-month tussle between Bell and the IRS, which began in November 1996 when the 38-year old computer engineer demanded a hefty tax refund and threatened to convene his own "common-law court" if it was refused. That grabbed the Feds' attention. (So did the actions of the "Multnomah County Common Law Court," which apparently met in January to convict IRS agents and Attorney General Janet Reno of "theft by deception.") In February, IRS agents seized Bell's 1986 Honda as payment for back taxes -- and found inside it a printout of his "Assassination Politics" essay. " [...] And it was, ultimately, a Federal magistrate who signed the search warrant on 9:02 am on March 28 at the request of the IRS. Jeffrey Gordon, an inspector in the IRS' Internal Security Division, details in an 10-page affidavit how he traced Bell's use of allegedly fraudulent Social Security Numbers, how he learned that Bell had been arrested in 1989 for "manufacturing a controlled substance," how he found out that Bell possessed the home addresses of a handful of IRS agents. Gordon's conclusion: Bell planned "to overthrow the government." The IRS investigator says in his affidavit that Bell's "essay details an illegal scheme by Bell which involves plans to assassinate IRS and other government officals... I believe that Bell has begun taking steps to carry out his Assassination Politics plan." [...] ------------------------- Time Inc. The Netly News Network Washington Correspondent http://netlynews.com/

2 1

Cryptoanalyze to make $$$ fast! [was Re: congressman wants review of online banking system]
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

On Tue, Apr 8 1997, Robert Hettinga wrote- > >--- begin forwarded text > > >X-Sender: oldbear(a)pop.tiac.net >Date: Tue, 08 Apr 1997 17:58:51 -0400 >To: Digital Commerce Society of Boston <dcsb(a)ai.mit.edu> >From: The Old Bear <oldbear(a)arctos.com> >Subject: congressman wants review of online banking system >Mime-Version: 1.0 >Sender: bounce-dcsb(a)ai.mit.edu >Precedence: bulk >Reply-To: The Old Bear <oldbear(a)arctos.com> > >CONGRESSMAN CALLS FOR REVIEW OF ONLINE BANKING > >House Banking Committee Chairman James Leach (R-Iowa) has >asked the General Accounting Office to review whether the >Federal Reserve has sufficiently protected its Fedwire >funds transfer and security transfer system from electronic >trespassing. > >Fedwire processes around 380,000 securities and funds >transfers totaling $1.6 trillion each day. ********************** > >source: BNA Daily Report for Executives > April 7, 1997 I bet a crack team of encryption experts from the cypherpunks list could make a pretty penny by exploiting holes in Fedwire or related systems.

1 0

Re: Anti-Spambot: what algorithm should be used?
by ichudov＠algebra.com 17 Dec '03

17 Dec '03

Another problem: what would prevent an anti-spam zealot from posting the following: From: antispammer(a)usenet.cabal.com Newsgroups: rec.sports.phishing,alt.fan.alice Message-ID: <123(a)bob.server> <something phishing-related> -- Alice's ID# 123456 Drink Kaka Kola -- Kaka Cola is full of shit, do not drink it, I am just collecting $$ from stupid Alice, Hahaha!!! Igor Chudov @ home wrote: > > i think that it is a good idea. > > remember though that it will not be hard to modify newsreader clients to > automatically killfile all articles matching Alice's regexps, or even to > grab them automatically from her website. So Alice may discover that her > business is not as effective. > > igor > > Dr.Dimitri Vulis KOTM wrote: > > > > owner-cypherpunks(a)manifold.algebra.com writes: > > > > > As we all know, there exist certain programs, called "spambots", whose > > > task is to post various messages to many newsgroups simultaneously. > > > > > > Besides their posting functionality, certain spambot programs take > > > special care to make their spams undetectable by anti-spambots. In > > > particular, they can be programmed to modify certain fields or the > > > message text itself in such a way that these messages would not look > > > unique, but would still carry the same content. > > > > I just came up with yet another brilliant idea how to combine Usenet > > marketing with e-cash. Suppose Alice runs an advertizing agency and gets > > paid to publicize certain messages of commercial or political nature. > > > > She sets up a Web page listing the catalog of regexps that she wishes to > > publicize. Something like: > > > > 1. Visit.*teens.*http://www.xxxfoo.bar > > 2. Elect.*John M. Grubor.*sheriff > > 4. For a drooling good time.*900-555-5555 > > 3. Drink Kaka Cola > > > > and a price list for each regexp - say, $2 for posting this regexp in a > > moderated newsgroup, 50c for the Big 8, 25c for alt and regionals. I'm > > not sure if cross-posts should be discounted. Assuming there are several > > such Alices, the prices will be set by supply and demand. > > > > Suppose Bob, in search of a few quick bucks, comes across Alice's site. > > We'd have to think of a protocol, but Alice assigns Bob an id which he > > must mention together with the regexps in order to get credit. Alice and > > Bob enter a contract. Bob puts one or more of Alice's regexps in his > > Usenet articles - most likely in the .signature. For example: > > > > From: bob > > Newsgroups: rec.sports.phishing,alt.fan.alice > > Message-ID: <123(a)bob.server> > > <something phishing-related> > > -- > > Elect John M. Grubor sheriff!!! Alice's ID# 123456 > > I am Bob! I am Bob! I am Bob the Poster! Drink Kaka Kola > > > > Alice's bot searches the Usenet feed (like K*bo and S*rd*r) for the > > regexps that she is paid to promote. When she encounters Bob's article, > > it extracts Bob's ID and the Message-Id, counts the distinct regexps, and > > the newsgroups, and credits Bob's account. > > > > If Carol follows up on Bob's article and quotes Bob's regexps and ID#, > > then Bob gets paid again. If somehow an article contains the ID# of two > > or more of Alice's agents, they split the fee. > > > > Alice's contract can also specify that if a third party forges a cancel > > within a week for Bob's Usenet article containing the regexp, then Alice > > will pay nothing and let Bob sue the forger for the lost income. (This > > may become moot as more and more ISPs ignore forged cancels.) This gives > > Bob the insentive to spam intelligently - not to trigger any cancelbots > > and not to have his plug pulled by his ISP. > > > > Alice can also put some reasonable caps on the number of repetitions > > because if Bob posts the same regexp 10,000 times, the marginal exposure > > is less from Bob than from a newbie Carol. Again, if there are several > > such Alices, the market will take care of negotiating such details. > > > > Actually, this doesn't even need e-cash - Alice can pay regular $$$. > > Hi Ross - if you're still on these lists, I think you'll like this. > > > > --- > > > > Dr.Dimitri Vulis KOTM > > Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps > > > > > > - Igor. > - Igor.

4 7

EPIC Alert 4.05
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

== Forwarded Message Follows ========================================= * Originally By: In:epic-news@epic.org * Originally Re: EPIC Alert 4.05 * Original Date: 04-08-97 18:08 <<< This message is part 2 of a previous message >>> the privacy of information gathered about consumers by telephone companies. The recommendations cover Customer Proprietary Network Information (CPNI). CPNI is the information that is gathered by phone companies in the process of delivering services, such as numbers called, length of calls, and times calls were made. The FCC is currently conducting a rulemaking on CPNI under the Telecommunications Act of 1996. The law limits the use and disclosure of CPNI information: a telecommunications carrier that receives or obtains customer proprietary network information by virtue of its provision of a telecommunications service shall only use, disclose, or permit access to individually identifiable customer proprietary network information in its provision of (A) the telecommunications service from which such information is derived, or (B) services necessary to, or used in, the provision of such telecommunications service, including the publishing of directories. NTIA recommended that phone companies provide a list of uses for the information and provide consumers with an opportunity to opt-out of those disclosures. However, this appears to contradict the text of Section 702 of the Act, which requires that phone companies obtain prior written consent before they can share the information and use the information for marketing purposes. Telephone companies have been pressing the FCC to relax that requirement and to require customers to contact them before the telcos stop selling the information. Public interest groups such as Computer Professionals for Social Responsibility and NetAction are arguing for more consumer protection. The NTIA comments are available at: http://www.ntia.doc.gov/ntiahome/fccfilings/cc96-115.htm ======================================================================= [8] Upcoming Conferences and Events ======================================================================= Culture and Democracy revisited in the Global Information Society. May 8 - 10, 1997. Corfu, Greece. Sponsored by IFIP-WG9.2/9.5. Contact: http://www.math.aegean.gr/english/events/econf/ecnew/ewc97.htm Can Trusted Third Parties Be Trusted?: A Public Debate on The UK DTI Crypto Proposal. May 19, 1997. London, UK. Sponsored by Privacy International and the London School of Economics. Contact: pi(a)privacy.org CYBER://CON.97: Rules for Cyberspace?:Governance, Standards and Control. June 4 - 7, 1997. Chicago, Illinois. Sponsored by the John Marshall Law School. Contact: cyber97(a)jmls.edu. Ethics in the Computer Society: The Second Annual Ethics and Technology Conference. June 6 - 7, 1997. Chicago, Ill. Sponsored by Loyola University Chicago. http://www.math.luc.edu/ethics97 Public Workshop on Consumer Privacy. June 10-13, 1997. Washington, DC. Sponsored by the Federal Trade Commission. Contact: http://www.ftc.gov/os/9703/privacy.htm INET 97 -- The Internet: The Global Frontiers. June 24-27, 1997. Kuala Lumpur, Malaysia. Sponsored by the Internet Society. Contact: inet97(a)isoc.org or http://www.isoc.org/inet97 Privacy Laws & Business 10th Anniversary Conference. July 1-3, 1997. St. John's College, Cambridge, England. Contact: info(a)privacylaws.co.uk. Communities, Culture, Communication, and Computers (C**5): On the Role of Professionals in the Information Age. August 20-22, 1997, Paderborn, Germany. Sponsored by FIFF. Contact: c5(a)uni-paderborn.de AST3: Cryptography and Internet Privacy. Sept. 15, 1997. Brussels, Belgium. Sponsored by Privacy International. Contact: pi(a)privacy.org. http://www.privacy.org/pi/conference/brussels/ 19th Annual International Privacy and Data Protection Conference. Sept. 17-18, 1997. Brussels, Belgium. Sponsored by Belgium Data Protection and Privacy Commission. International Conference on Privacy. September 23-26, 1997. Montreal, Canada. Sponsored by the Commission d'Acces a l'information du Quebec. http://www.confpriv.qc.ca/ Managing the Privacy Revolution '97. October 21-23, 1997. Washington, DC. Sponsored by Privacy and American Business. Contact: http://shell.idt.net/~pab/conf97.html (Send calendar submissions to alert(a)epic.org) ======================================================================= The EPIC Alert is a free biweekly publication of the Electronic Privacy Information Center. To subscribe, send email to epic-news(a)epic.org with the subject: "subscribe" (no quotes) or use the subscription form at: http://www.epic.org/alert/subscribe.html Back issues are available at: http://www.epic.org/alert/ ======================================================================= The Electronic Privacy Information Center is a public interest research center in Washington, DC. It was established in 1994 to focus public attention on emerging privacy issues such as the Clipper Chip, the Digital Telephony proposal, national ID cards, medical record privacy, and the collection and sale of personal information. EPIC is sponsored by the Fund for Constitutional Government, a non-profit organization established in 1974 to protect civil liberties and constitutional rights. EPIC publishes the EPIC Alert, pursues Freedom of Information Act litigation, and conducts policy research. For more information, email info(a)epic.org, HTTP://www.epic.org or write EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington, DC 20003. +1 202 544 9240 (tel), +1 202 547 5482 (fax). If you'd like to support the work of the Electronic Privacy Information Center, contributions are welcome and fully tax-deductible. Checks should be made out to "The Fund for Constitutional Government" and sent to EPIC, 666 Pennsylvania Ave., SE, Suite 301, Washington DC 20003. Individuals with First Virtual accounts can donate at http://www.epic.org/epic/support.html Your contributions will help support Freedom of Information Act and First Amendment litigation, strong and effective advocacy for the right of privacy and efforts to oppose government regulation of encryption and funding of the National Wiretap Plan. Thank you for your support. == End Forwarded Message ============================================== If encryption is outlawed, only outlaws will have encryption...

2 1

Re: FCPUNX:Passphrase entropy
by jamesd＠echeque.com 17 Dec '03

17 Dec '03

At 12:04 PM 4/18/97 -0700, Steve Schear wrote: > If this is true then how much passphrase entropy is enough to thwart, > for example, an NSA crack attempt? Seems to me it needs to be equal > to or greater than the encryption key. What are some good, practical > ways of achieving this? Long keys or random keys. Suppose you need 80 bits of entropy. If your passphrase is truly random, for example 9kDt3fagWxglr You have about six bits a character, so you only need thirteen characters. If, however, your pass phrase is an intelligible english sentence, for example Wandering past Saint Ives, I saw many fine buildings covered in ivy across the road. You only have about one bit per character, so you need an eighty character sentence. If your passphrase is a short intelligible english phrase, as most of them are, it will succumb to a dictionary attack. --------------------------------------------------------------------- | We have the right to defend ourselves | http://www.jim.com/jamesd/ and our property, because of the kind | of animals that we are. True law | James A. Donald derives from this right, not from the | arbitrary power of the state. | jamesd(a)echeque.com

1 0

commercial web remailer myemail.net
by null＠myemail.net 17 Dec '03

17 Dec '03

www.myemail.net is a commercial remailer service; you can get an account for $5/month for some services, and use their web form free to send email and post news. Some parts of it are still under construction. Email has a nice attention-getting footer that gets put on each message to indicate that it's anonymous mail (so if you want to chain through other remailers, you'll need cutmarks), which says there's no sender identity logging. On the other hand, there's an interesting pixel in the web form that you use to send the email: <img src="/stats/makelog.cgi" height=1 width=1> Blocking is available both for email addresses and newsgroups. For email, just fill in your address in a form; it's not verified (my attempted mail to testme(a)bogus.com was rejected). The blocking works immediately, and since you submit email via a web form, reject messages get presented directly rather than being emailed to the bit bucket at some remailer. For news, the policy is that newsgroups will be blocked if there are requests from 12 different people (as distinguished somehow from 12 different requests by the same person forging headers.) Encryption: If you connect to https://www.myemail.net/, the button for anonymous email will fetch the form using https: ; if not, then not. So you'll have to remember to use it correctly. It's 128-bit RC4, which may affect some non-US users who haven't gotten SafePassage yet. It's a good start. Bill Stewart, stewarts(a)ix.netcom.com ************************************************************************ This Anonymous email has been relayed by http://www.MyEmail.net/ MyEmail.Net is a free anonymous mailing service. No records indicating the identity of person(s) who originated this message are retrieved electronically, or as a requirement to submit. Your email address can be blocked to prevent further contact from this service, please refer to the URL above for instructions on how to do so. ************************************************************************

2 1