December 2003 - cypherpunks-legacy

[ADMINISTRATIVIUM] Zero-knowledge interactive proofs
by nobody＠huge.cajones.com 17 Dec '03

17 Dec '03

Tim Mayflower's 16Kb brain's single convolution is directly wired to his rectum for input and his T1 mouth for output. That's 16K bits, not bytes. Anal intercourse has caused extensive brain damage. \|||/ (o o) -ooO-(_)-Ooo- Tim Mayflower

2 1

[Fwd: ITAR / S 1726 / Civil Disobedience] (fwd)
by cpunks＠algebra.com 17 Dec '03

17 Dec '03

----- Forwarded message from Toto ----- >From cpunks(a)manifold.algebra.com Fri May 16 06:20:38 1997 Message-ID: <337C3D50.1B50(a)sk.sympatico.ca> Date: Fri, 16 May 1997 04:56:16 -0600 From: Toto <toto(a)sk.sympatico.ca> Reply-To: toto(a)sk.sympatico.ca Organization: TOTO Enterprises X-Mailer: Mozilla 3.01C-SYMPA (Win95; U) MIME-Version: 1.0 To: gomez(a)BASISinc.com Subject: [Fwd: ITAR / S 1726 / Civil Disobedience] Content-Type: multipart/mixed; boundary="------------62391A621C0B" Sender: owner-cypherpunks(a)toad.com Precedence: bulk This is a multi-part message in MIME format. --------------62391A621C0B Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: 7bit -- Toto "The Xenix Chainsaw Massacre" http://bureau42.base.org/public/xenix/ "WebWorld & the Mythical Circle of Eunuchs" http://bureau42.base.org/public/webworld "The Final Frontier" http://www3.sk.sympatico.ca/carljohn/ --------------62391A621C0B Content-Type: message/rfc822 Content-Transfer-Encoding: 7bit Content-Disposition: inline Received: from online.offshore.com.ai (online.offshore.com.ai [206.48.59.106]) by orion.sk.sympatico.ca with ESMTP (8.7.5/8.7.3) id DAA18333 for <toto(a)sk.sympatico.ca>; Fri, 16 May 1997 03:31:04 -0600 (CST) Received: (from httpd@localhost) by online.offshore.com.ai (8.8.5/8.8.5) id FAA02624; Fri, 16 May 1997 05:42:14 -0400 Message-Id: <199705160942.FAA02624(a)online.offshore.com.ai> X-Authentication-Warning: online.offshore.com.ai: httpd set sender to toto(a)sk.sympatico.ca using -f From: "C.J. Parker" <toto(a)sk.sympatico.ca> To: president(a)whitehouse.gov, toto(a)sk.sympatico.ca Date: Fri May 16 5:42:13 1997 Subject: ITAR / S 1726 / Civil Disobedience Dear Mr. President, I am writing to express my disapproval of the Clinton Administration's position on the ITAR restrictions for encryption software. This is an important issue to me. 1) Software is writing, so it is protected by the first amendment, so the ITAR is unconstitutional. The idea that only paper books are first amendment protected, and electronic books are not, is just plain wrong. 2) The ITAR does not help National Security, but in fact greatly reduces our nations security because the Internet, and the computers and information connected to it, are kept from using good Encryption. 3) I feel that encryption is very important for doing commerce on the Internet, and that commerce on the Internet is important for our economy (Internet is the fastest growing sizable segment). You say you like the "Information Super Highway" and you are "going to focus on the economy like a laser". You should be removing the ITAR restrictions on American businesses. Otherwise the business for commerce software will go to companies in other countries. 4) The Clinton Clipper III proposal to have government key escrow is not acceptable. Also, it will never work, since people will always be able to buy and use software from the rest of the world. This proposal is just slowing down Internet progress. Please cancel Clipper III. 5) Please support Senator Burns Pro-CODE bill S 1726 that would end this foolishness. Or better yet, just take software off the list of "munitions". The current law, (see http://www.law.cornell.edu/uscode/22/2778.html) says that "The President shall periodically review the items on the United States Munitions List to determine what items, if any, no longer warrant export controls under this section. The results of such reviews shall be reported to the Speaker of the House [...] at least 30 days before any item is removed from the Munitions List [...]." 5) As an act of civil disobedience I have personally exported an encryption program (it is 3 lines of writing) using the web page at http://online.offshore.com.ai/arms-trafficker/ Yours sincerely, C.J. Parker toto(a)sk.sympatico.ca Sent from host lohner20.sk.sympatico.ca with IP 142.165.98.20 --------------62391A621C0B-- ----- End of forwarded message from Toto -----

1 0

Re: Distributing cryptographic code
by Greg Broiles 17 Dec '03

17 Dec '03

This thread was booted from coderpunks, perhaps the interested parties will continue it here. At 02:36 PM 5/16/97 EDT, Yoav Yerushalmi wrote: [...] > I'm part of a research group here at MIT, and several groups here >have written implementations of concepts and protocols that involve >cryptography in one way or another (encryption/signing/voting, etc). > > We would like to put this code up for distribution (within the US >of course), but don't actually know what is a 'reasonable' amount of >protection that one need apply to prevent people from exporting >it to the rest of the world. If I were you, I'd talk to the other folks at MIT distributing strong crypto code, they've certainly had to think about/work on this problem. Might as well ride on their coattails. Having said that, you might take a look at 15 CFR 734.2(b)(9)(ii) if you're really feeling masochistic, which says that making software available via the Internet such that it is available for transfer outside of the United States is an export unless the person making the software available takes certain precautions. The precautions are: >>>> (A) Ensuring that the facility from which the software is available controls the access to and transfers of such software through such measures as: (1) The access control system, either through automated means or human intervention, checks the address of every system requesting or receiving a transfer and verifies that such systems are located within the United States; (2) The access control system, provides every requesting or receiving party with notice that the transfer includes or would include cryptographic software subject to export controls under the Export Administration Act, and that anyone receiving such a transfer cannot export the software without a license; and (3) Every party requesting or receiving a transfer of such software must acknowledge affirmatively that he or she understands that the cryptographic software is subject to export controls under the Export Administration Act and that anyone receiving the transfer cannot export the software without a license; or (B) Taking other precautions, approved in writing by the Bureau of Export Administration, to prevent transfer of such software outside the U.S. without a license. <<<< The software publishers I'm familiar with who make strong crypto available via the Internet in a commercial setting (Microsoft, Netscape, C2Net) do reverse-DNS lookups on the requester to try to figure out whether or not they're inside the United States. This is *not* an "official" answer, nor is it legal advice. The regulations discussed above have been public for less than five months. I've spoken with several attorneys who specialize in export control and they've all commented that the regs were drafted quickly, without good attention to detail, and are not necessarily models of clarity or precision. Nobody's 100% sure what they mean. Also, one person commented within the coderpunks thread: >>>> A disclaimer would be adeqate protection if I remember correctly. I don`t recall what the situation is in the US, is it the case that the provider of the information is guilty of export, or the person that actually downloads it, if it is available via anonymous FTP??? <<<< A disclaimer is not good enough. Both are potentially liable under US law (modulo arguments about constitutionality, vagueness, etc). The downloader is guilty of an illegal export, and the person who made the software available is (using the definition in 15 CFR 734.2) guilty of an export, and also has potential liability for conspiracy and/or aiding and abetting, depending on the facts of the particular case. But a clerk in Egghead who sells a copy of 128-bit Netscape to a "foreign person" is also guilty of an export violation. The interesting question is whether or not the feds will choose to prosecute violators .. and which ones. Internet crypto distribution sites have a much higher profile than random minimum-wage clerks who wouldn't have violated the law if they'd had any clue it existed. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

3 3

MULTOS announcement from MasterCard --- FYI
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: davidk(a)air.com X-Sender: saguaro(a)pop.tiac.net (Unverified) Date: Sat, 17 May 1997 16:56:13 -0400 To: Robert Hettinga <rah(a)shipwright.com> Subject: MULTOS announcement from MasterCard --- FYI Mime-Version: 1.0 MasterCard launches global smart card platform Date: 97-05-15 16:38:28 EDT From: AOL News NEW YORK--(BUSINESS WIRE)--May 15, 1997-- Platform provides MasterCard member financial institutions with complete solution in migrating to chip-based payment products MasterCard International today became the first payments brand to begin implementing a complete solution for making the widespread use of smart cards a marketplace reality by the new millennium. By embracing a new open-platform technology called MULTOS as its smart card operating platform, MasterCard member banks will now have access to an unprecedented technology that will enable a single smart card to support a number of different products, securely and independently. The MULTOS (multi-application operating system) technology, which was announced today by eight of the leading silicon manufacturers and smart card companies from the United States, Europe, Asia and Australia uses the proven Mondex security architecture which allows applications to be dynamically and securely loaded onto a smart card. With MULTOS, not only can members load applications when the card is issued, but cardholders will be able to load or change applications after the card has been issued by going on-line to the card issuer, via telephone, the ATM or across the Internet. This allows applications and security upgrades to be introduced without reissuing cards, and for cardholders to "customize" their card with the applications they choose. Paired with the MULTOS technology is a MasterCard migration plan that gives financial institutions around the world the flexibility to enter into the smart card arena when it's right for their markets and their businesses. Together, MULTOS and the MasterCard migration plan support a wide range of implementation schemes -- from the most comprehensive to the most modest -- ensuring that member banks can bring smart cards to market in a way that is useful for the cardholder and profitable for the bank. "The business case for smart cards varies among markets and countries, and so the key to a successful migration from magnetic stripe cards to smart cards is flexibility," said MasterCard President and CEO Robert W. Selander. "In our migration strategy we have a flexible approach that lets every member move to smart cards at a time and pace that is best for their business. And in MULTOS we have a superior technology that is `future-friendly.' MULTOS will enable our members to embrace smart card technology, and at the same time, give them the confidence that today's investment will not be obsolete tomorrow. By incorporating MULTOS technology into our smart card migration strategy, we are offering our members the only complete smart card solution available today," he said. "As an open-technology platform, we support the flexibility MULTOS offers, and realize that by investing in MULTOS, we are investing in the future of the industry," said Dudley Nigg, executive vice president, Online Financial Services for Wells Fargo Bank. "It also enables us to truly differentiate ourselves by the types of services we provide our cardholders." G. Henry Mundt III, MasterCard executive vice president, Global Deposit Access, said the MULTOS technology offers distinct benefits to members that other operating systems cannot. "Unlike other chip delivery platforms in the marketplace today, MULTOS provides our members with multiple sources of interoperable cards - eliminating any risk associated with being locked into a single silicon supplier or card manufacturer." Mundt, who oversees MasterCard's smart card business, also explained how members can use MULTOS to differentiate their services to their cardholders. "What a MULTOS-based card becomes to the cardholder is a lifestyle card, allowing the consumer to include the standard applications of credit and debit, along with other personally selected applications such as Mondex electronic cash, an airline loyalty program and a transit pass. The ability for our members to meet their cardholders' changing needs by adding or deleting card applications that can be tailored in real time, through the telephone, an ATM or across the Internet, is bringing the future of money to life for the consumer, now," he added. MasterCard's global smart card strategy incorporates the following features and deliverables: -- A set of product specifications and associated applications, which will include MasterCard credit and debit, and Mondex electronic cash, that can be combined with member proprietary programs. Specifications will be available in the third quarter of this year, and applications will be available in the first quarter of 1998. The MULTOS API (application program interface) specifications will be available in the third quarter of 1997. -- The most advanced open-technology platform, introduced on a non-proprietary "open systems" basis to enable it to be used as a standard across various industries interested in using smart cards, such as finance, retail, travel and telecommunications. MULTOS technology will enable a single smart card to support a number of different products, securely and independently. MULTOS applications will need to be written only once and are compatible with any MULTOS card, regardless of which company has manufactured the card or which silicon chip is used. Applications on the card are kept totally separate and independent by highly secure "firewalls." -- A support infrastructure to ensure global acceptance of smart cards. Revised rules and operating procedures for MasterCard members will be available later this year. -- A range of application development tools and protocols will be provided in the third quarter 1997, to enable application developers to produce products for MULTOS. -- Compliance with industry standards: MULTOS is entirely compatible with the EMV '96 standards related to integrated circuit cards for payment systems created by Europay, MasterCard and Visa. MasterCard credit and debit products implemented on MULTOS for the first quarter 1998 will be fully EMV compliant. "MULTOS allows MasterCard and Mondex members to combine, for example, the Mondex purse with their own products and services on a single card - while being assured that the security and integrity of each product or application is guaranteed by the firewalls that are a unique feature of MULTOS," said Mondex President Michael Keegan. "This is a great step forward for the financial services industry. This means that, for the first time, card issuers can use the security, reliability and flexibility of the smart card to deliver a range of products and services to their customers - securely and economically, allowing the consumer to carry fewer, more useful cards." MasterCard International, a payments company with one of the world's most recognized brands, is dedicated to helping more than 23,000 financial institutions around the world offer consumers a variety of payment options. MasterCard remains focused on helping shape the future of money by expanding acceptance of its global brands (MasterCard(R), Maestro(R) and Cirrus(R), the world's largest ATM network; MasterCard also owns 51 per cent of electronic cash leader Mondex International) and maintaining reliable, secure networks facilitating global value exchange. MasterCard has 400 million credit and debit cards that are accepted at more than 13 million acceptance locations worldwide. In 1996, gross dollar volume generated exceeded $550 billion. MasterCard can be reached through its World Wide Web site at http://www.mastercard.com . -0- Note: On Thursday, May 15 at 9 a.m. EST, MasterCard's long-term chip card strategy and the MULTOS technology will be announced during a teleconference call. Participants can join the call by dialing 800-553-0272 in the U.S. and 612- 332-0523 outside the U.S. MasterCard Launches Global Smart Card Platform May 15, 1997 CONTACT: MasterCard International Marianne Fulgenzi, 914/249-5443 Julie Jacobs, Shandwick, 212/309-0620 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Hacked, Trashed and Out of Beer
by se7en 17 Dec '03

17 Dec '03

Well, I finally managed to catch up on all the email from this list, and managed to also get all of the hacked web sites thus far up on my web page at http://www.dis.org/se7en which includes: Amnesty International Central Intelligence Agency East Timor, Indonesia Kriegsman Fur NASA U.K. Labour Party U.S. Air Force U.S. Department of Justice se7en

1 0

referers and W3 (fwd)
by Rich Graves 17 Dec '03

17 Dec '03

A friend who webmasters a large site that is implementing referer-specific content sent me this when I mentioned the cpunks/cryptography thread of a few months back. I basically agree with the W3C. While user education on the potential privacy threat is essential, I do not believe that Netscape should violate published technical standards. There are also privacy and property issues from the server's perspective. ---------- Forwarded message ---------- Subject: referers and W3 The following text was added to W3's page on HTML on May 8. If nobody else has noticed this, you might wish to share it with the cypherpunks, I don't know. HTML, Hypertext Links and Referer URLs In a vacuum, semantically neutral technology attracts meaning. If neutral technology is useful, commerce -- abhorring a vacuum -- uses technology in often-unforeseen ways to build new markets. Over the past year we have seen attempts to create meaning for HTML references where none existed before. Links have been argued to mean revenue streams, approval, a source of liability, endorsement, and ownership. The Web depends on hypertext links between resources. Links can act as references, or to embed material, both of which are concepts that have been around for a long long time. Whats new with the Web is the ability to follow links quickly. When a user clicks on a link, the URL of the page containing the link is passed to the server along with the requested URL. This gives Web sites the opportunity to customize the response according to the page the user clicked on. If someone jumps into a Web site without entering via the home page, a content provider may choose to turn them away or to redirect them to the home page. A smarter Web site could use partial string matches on the Referer and Requested URLs to customize the page it returns. One reason for doing this is to ensure visitors see the banner ads and promotions, a site is using to create revenue; another is to avoid broken links when people (or indexing engines) bookmark transitory Web pages. The Referer URL can also be used to determine how to honor requests for images or applets. For instance, you might decide to only provide images to sites which have signed a license agreement with you. http://www.w3.org/pub/WWW/MarkUp/

2 2

Re: dhp.com is blocked by CyberSitter
by Rich Graves 17 Dec '03

17 Dec '03

Um... Who worth talking to isn't? I have repeatedly requested that they block comp.os.ms-windows.announce and stanford.edu because we allow content they might find objectionable, but Milburn has REFUSED to do so. "We don't block sites just because some guy say so." He's bouncing all subsequent requet from me to block my own web site to my postmaster, i.e., me. I still think a counter-blocking approach is appropriate. If you run a popular web site, make it inaccessible to CyberSitter users. It's easy: <META NAME="Voluntary Content Rating" CONTENT="adult"> CyberSitter is the only program that understands "the VCR standard." -rich http://www.stanford.edu/~llurch/

1 0

Do You Accept Credit Cards?
by Tony Glavin 17 Dec '03

17 Dec '03

Hi, I was boing a search of web sites that were selling a product or service, and your web site popped up. If this message has been sent to you by mistake, I apologize. If you are selling a product or service and would like to accept credit cards inexpensively, we have a complete program for you: Application Fee: $75, refundable if declined Discount Rate: Around 2% Transaction Fee: 30 cents Monthly Minimum Billing Fee: NONE Monthly Statement Fee: NONE Processing Software: $395 This software lets you submit the transactions to the credit card processor. It is the same product that others are charging $995 for or leasing for $39 per month on a 48 month lease. You will be able to accept all major credit cards, even if you are selling over the Internet. You will experience an increase of sales as prospects see you as more credible if you accept credit cards. If you have any questions about accepting credit cards, please send them via email to: mailto:glavin@best-solutions.com Thanks for your time.

1 0

Re: PGP 5.0 beta is out at PGP.com
by nobody＠hidden.net 17 Dec '03

17 Dec '03

Tim May wrote: > > More than that, did they decide to release the source code? > Last I heard, the answer was "of course not!!!!" I recently heard from a PGP employee that they plan to release ALL source code, including non-crypto code.

8 13

WOW! Internet Business Classified Advertising!!!
by Service＠iBase.net 17 Dec '03

17 Dec '03

WOW! Internet Business Classified Advertising!!! (Serving a List of Over 20,000 unique Addresses and Growing!) <---------Maximize your Email Window & Turn on Word Wrap---------------> ************************************************************************* WELCOME TO BUSINESS CLASSIFIEDS INTERACTIVE(sm) BCI's THE NEW WAY TO ADVERTISE YOUR PRODUCTS OR SERVICES!!! ---> Directions For Classified Ad Placement <--- Create a maximum 5 line Ad of your choosing (text only). Include your URL, E-Mail, or Autoresponder Address within the 5 lines. In order to make your Ad INTERACTIVE, use "http://" for your URL and "mailto:" for your Email. This allows anyone to simply click and go to your site. To submit your Business Ad Order for inclusion, simply go to the VirtualCheck(sm) site: http://iBase.net/0emailpay.htm , process for only $20.00 per inclusion (that's only $1/1000 true recipients), and copy and paste your Ad in the Description Field, and send it to us. It's E-Z! <NEWEST ADs (Support other Advertisers by reviewing their Offers)> ------------------------------------------------------------------------- CONGRATLATIONS TO LAST WEEK'S 13 WINNERS !! Who participated in the Exciting CyberArcade Games. Try it Yourself! http://iBase.net/InternetCasino ------------------------------------------------------------------------- TEAM UP WITH PRIMESTAR! Through TPN's FREE Web Page at http://www.theduplicator.com/entrepreneur ------------------------------------------------------------------------- Free To You! A trial copy of Debt Free! todays answers to help YOU eliminate your debts and start to build a solid income! for instant information that can help you, Send a blank email message to mailto:helpme@answerme.com ------------------------------------------------------------------------- 100% PROFIT OPPORTUNITY!!! Self-Help Legal Forms are now available for your use AND Profit for as little as $5.00! NO Franschise or License Fees! Buy once and SELL as many times as you want!! You can't afford to miss this! http://iBase.net/Legalfm.htm ------------------------------------------------------------------------- Hot, Hot Home-Based Businesses! Frustrated at Work? Afraid of Layoffs? Need more Money? Start Getting Paid What Your Are Worth? Start Your Own Home-Based Business! Why Wait? I Can Help! Visit- http://www.freedomstarr.com/MY1316206 ------------------------------------------------------------------------- TOTALLY ELIMINATE YOUR PHONE BILL!!! That's right. With a $100 one time only investment, and the sponsoring of only two people, I'll show YOU how you can ELIMINATE you phone bill AND make $500 a day or more. For more information, email to 102562.520(a)compuserve.com Also, visit my sight at http://ourworld.compuserve.com/homepages/DTII ------------------------------------------------------------------------- NEW! Take Orders by E-Mail with VirtualCheck!!! Get Your Orders Paid FAST with this NEW Service! Review the Site linked at: http://iBase.net/0emailpay.htm You can't afford to miss this if you take Orders! ------------------------------------------------------------------------- 1 SPECIAL ANNOUNCEMENT Visit us at http://iBase.net/1DIRECT.htm the New AL9000 Internet Base's 1 DIRECTORY, the Internet Entrepreneurs' Preferred Directory! Could YOU be the next Winner? A must-see!!! ------------------------------------------------------------------------- Now, it's up to YOU! Try it; it's E-Z. Watch your responses GROW! /////////////////////////////////////////////////////////////////////////////// If you wish to be removed from this advertiser's future mailings, please reply with the subject "Remove" and this software will automatically block you from their future mailings. ////////////////////////////////////////////////////////////////////////////////

1 0