December 2003 - cypherpunks-legacy

Totally breakable V(aporware) M(oney-making) E(ncryption)
by semprini＠theschool.com 17 Dec '03

17 Dec '03

I just finished reading the contents of the VME web-site. I have a few things to say. :) First of all the web-site blows elephant cock. You would think with guys smart enough to come up with "unbreakable encryption", they would at least be able to design a good site. Second, they make a big deal about how fast it is and how it can encrypt *ONE WHOLE FAT MEGABYTE A MINUTE*! Big whoop. Hope nobody wants to encrypt anything useful besides teensy weensy e-mails, 'cause you're gonna grow old before it finishes encrypting. Third, what the hell good is it if nobody can see the source code? It's well known that a trademark of bad cryptographic systems are the ones that rely on secrecy of the algorithm. Some happy little geek in his college computer lab is going to spend the time needed to reverse engineer the program, which they claim is "impossible to reverse engineer". Well, they didn't say it was "impossible", but they did say that the code is so complicated that nobody would be able to understand it if they ever did reverse engineer it. Bullshit. I know a 15 year old kid who actually has the patience to go through a few thousand lines of assembly code just to see what a program really does. Fourth, as someone else pointed out, the description of the algorithm is filled with words like "revolutionary" and "super-fast", etc. The descriptions of how the program works are so vague and general that it hards to believe they even have a running program. The description of the encryption sounds all very pretty, but I seriously wonder if that's the extent of the security. Almost like having a gold plated sign on your door saying "Keep out!" and then leaving your door unlocked. Fifth, their "challenge" to these major corportions merely states that they gave IBM, MS, and Netscape this big challenge to crack the system, but it never actually says the companies took up the offer and are actively trying to crack it. How's this one? "Microsoft, Netscape, and IBM!! I challenge you to crack my version of the Caesar Cipher!" There. I can now claim that I have challenged all the big corps to crack my crypto scheme. Challenging a big company doesn't prove a thing. Anyway, that's my rant and rave. Just as a small side note, if you would like to see some good examples of Madison Avenue at work then just visit this web-site: http://www.meganet.com > News report Nov 7, 97: > > AT&T, Hewlett Packard, Intel Corporation, Dell Computers, and > many other leading computer corporations have been added to the > challenge list by Meganet Corporation. The challenge started > last week with Bill Gates, now some of his peers have an opportunity > to validate or discredit the bold claim that Meganet's VME > (Virtual Matrix Encryption) is totally unbreakable. > > Unbreakable encryption is the only answer to security > in our electronic world. This is graphically illustrated > by the recent report from the National Security Agency > reporting the open market availability of a $10 chip that > can test up to 200 million keys per second. The 56-bit key, > government and banking standard, can be compromised in > twelve (12) seconds with brute force using ASIC > (Application-specific Integrated Circuits) chips. > > Meganet has the answer with its new VME (Virtual Matrix > Encryption). The impenetrable VME also has extreme speed, > much faster than any existing program available today. > > Major computer companies are already starting discussions > to acquire the rights to market this incredible new data > encryption system. More information about this > exciting new technology can be found at: www.meganet.com > > ---------- > > Hmm, wonder if it has impenetrable GAK and CAK options. > >

1 0

Free Wallpaper Tip!!
by 62789105＠06090.com 17 Dec '03

17 Dec '03

Free Wallpaper Tip!!!! A lot of people have had dark wallpaper installed or have installed it themselves, over a light colored wall, and over time the wall shows through because the seams have expanded. _____________________________________________________ Here is how to remedy this problem. Take a latex (eggshell finish) paint tinted to the color of the wallpaper background. Paint seam about 3ft down the wall with a small paint brush. (1inch) Wipe off immediately, and continue on down to finish off the seam. Repeat on every seam that needs it. Move the brush up and down to color the wall in between seams. ______________________________________________________ You just saved yourself a new wallpaper job. Now the room is like new, and just in time for the holidays! Want to save more money with great tips like this? Of course you do, everybody would. Well I have ALL of the tips and tricks that the pros use to hang paper. Not because I collected them..no, because I used them every day. I am a retired paperhanger with over 25 years experience. I have written an in depth guide for hanging wallpaper. This guide cuts through all the clutter and gets down to the one thing you need to know...how to hang successfully. This guide will teach you lots of tips and tricks, my way. That's not all, I have also put together a report on all the tricks and tips that paperhangers use! Including devious things unscrupulous contractors use to cheat you. These are the tricks that cost you money. The tricks that homeowners just never know, but the paperhangers do! Now you can too!! You can have both reports for the one low price of just $14.95 Print out form below , fill in and mail with check or m/o to: ImagePro Press 2018 Electric Rd SW, Suite 227 Roanoke,VA 24018 NAME______________________________________________ ADDRESS___________________________________________ APPT#________ CITY__________________ STATE________ ZIP____________ EMAIL ______________________________________________ HOME PHONE___ (____) ______ _______

1 0

CHALLENGE to Meganet VME: million dollar hype?
by Attila T. Hun 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- Meganet Corporation (818) 757-3890 19528 Ventura Blvd. Suite 317 Tarzana, CA 91356 OPEN CHALLENGE TO YOU over the last 30 years I have seen hundreds of new "unbreakable" encryption programs; all of them have the same claims, the same challenges, and the same secrecy. but, with several notable exceptions, each has contained a fatal flaw. and I have seen even my own "perfect" algorithms fall apart when I awake... therefore, if you want any serious encryption experts to endorse your product as having a factor of "unbreakability" by forcing the level of brute force necessary to do so, provide the algorithm and the associated source code to a few of us who enjoy breaking algorithms as much as we enjoy trying to create them. I dont have time, any more than my colleagues will have time, to waste on foolishness represented by your amateur challenge. until you are willing to submit to an open review by your peers, your supposed encryption product is YAP. secondly, until your methodology is reviewed, we will consider the product a schill to Louis Freeh and other GAK and trap door mandated system advocates. if you wish to be considered a serious contender to replace RSA, it's time to put your cards on the table; we see your nickel and call. in the matter of public encryption, there is no secrecy, or there is no use. your move. attila out... cc: cypherpunks(a)cyberpass.net -----BEGIN PGP SIGNATURE----- Version: 2.6.3i Charset: latin1 Comment: No safety this side of the grave. Never was; never will be iQBVAwUBNGRf3LR8UA6T6u61AQGbHgH8CRQZShIUzW0wr1ib7cQGSfMcUbJTygx9 ckzuU/NB4W4u11rEjSQzC5ozybWWxHcjSQel+CZ79wPAP0vM+HM7Jg== =zTyp -----END PGP SIGNATURE-----

2 1

Major security flaw in Cybercash 2.1.2 (fwd)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: Bob Antia <antia(a)leftbank.com> Subject: Major security flaw in Cybercash 2.1.2 (fwd) To: mjbauer(a)leftbank.com (Michael Bauer), rah(a)shipwright.com Date: Sat, 8 Nov 1997 10:04:14 -0500 (EST) MIME-Version: 1.0 Approved-By: aleph1(a)UNDERGROUND.ORG Message-ID: <f58bccfc52aba91d0973f9bf33160ddd(a)anon.efga.org> Date: Fri, 7 Nov 1997 22:54:16 -0500 Reply-To: Anonymous <anon(a)ANON.EFGA.ORG> Sender: Bugtraq List <BUGTRAQ(a)NETSPACE.ORG> Comments: This message was remailed by a FREE automated remailing service. For additional information on this service, send a message with the subject "remailer-help" to remailer(a)anon.efga.org. The body of the message will be discarded. To report abuse, contact the operator at admin(a)anon.efga.org. Headers below this point were inserted by the original sender. From: Anonymous <anon(a)ANON.EFGA.ORG> Subject: Major security flaw in Cybercash 2.1.2 To: BUGTRAQ(a)NETSPACE.ORG CyberCash v. 2.1.2 has a major security flaw that causes all credit card information processed by the server to be logged in a file with world-readable permissions. This security flaw exists in the default CyberCash installation and configuration. The flaw is a result of not being able to turn off debugging. Setting the "DEBUG" flag to "0" in the configuration files simply has no effect on the operation of the server. In CyberCash's server, when the "DEBUG" flag is on, the contents of all credit card transactions are written to a log file (named "Debug.log" by default). The easiest workaround I've found is to simply delete the existing Debug.log file. In my experience with the Solaris release, the CyberCash software does not create this file at start time when the DEBUG flag is set to 0. The inability to turn off debugging is noted on CyberCash's web site under "Known Limitations". The fact that credit card numbers are stored in the clear, in a world readable file, is not. --jet -b Bob Antia antia(a)leftbank.com The Left Bank Operation, Inc. http://www.leftbank.com TCP/IP Internetworking LAN/WAN/NT/UNIX Admin PGP fingerprint 9B 70 FF 2D 03 CC 5F C1 3E 29 6E D4 16 79 44 A8 --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Bay Area Cypherpunks meeting announcement
by Colin Plumb 17 Dec '03

17 Dec '03

Additionally, there will be a release of the PGP 5.0 Unix Specific Source Code Update at the public meeting. -- -Colin

1 0

DO YOU WAGER / GAMBLE ON SPORTS ?
by 99001680＠msn.com 17 Dec '03

17 Dec '03

MR ACTION HAS THE WINNERS FOR SUNDAY & MONDAY NFL & BASKETBALL GUARANTEED TO WIN !!! UP NOW AT 1-900-484-7777 $18.00 per call Under 18 years of age ?? Don't Call!!! This is a guaranteed pick line. If you do not have a winning day with these selections we will replace the selections or make a refund!!

1 0

E-Peso's for tractors - McCaffrey on banking
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Blair Anderson" <blair(a)technologist.com> To: "dcsb(a)ai.mit.edu" <dcsb(a)ai.mit.edu> Date: Sun, 09 Nov 97 01:53:59 +1300 Priority: Normal MIME-Version: 1.0 Subject: E-Peso's for tractors - McCaffrey on banking Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Blair Anderson" <blair(a)technologist.com> 06:24 p.m Nov 05, 1997 Eastern U.S. drug czar appeals to banks to track laundering By Anthony Boadle WASHINGTON (Reuters) - Bankers, watch those ``smurf'' accounts. That was the message drug enforcement authorities gave the American Bankers Association and the American Bar Association at their annual money laundering conference Wednesday. Any innocent-looking person could be depositing a drug baron's cash parceled into amounts smaller that the $10,000 reporting threshhold to avoid suspicion, so get to know your customer, they warned. Traffickers hire individuals or ``smurfs'' who open small accounts at U.S. banks in their own or fictitious names. Once in the system, drug money becomes very hard to trace, White House drug policy director Gen. Barry McCaffrey said. Americans spend $49 billion a year on illegal drugs and much of that cash has to go through banks and corporations to get back to the Colombian cartels that ship cocaine and heroin to the the United States, he said. McCaffrey said drug traffickers were becoming increasingly sophisticated in laundering their proceeds, resorting to high tech communication encryption and ``cybercash'' transactions over the Internet. ``We are not going to find dumb guys stumbling into bank branches in New York City with cardboard boxes full of $20 bills that test positive for cocaine,'' he said. ``We are losing contact with the enemy,'' the general said. ''The government cannot follow laundering by itself. You are going to have to help.'' McCaffrey said the drug trade was moving into new areas such as the securities industry to launder its profits. Treasury Department Undersecretary for Enforcement, Raymond Kelly, said Colombian cartels were using a black market peso brokering system to send home their profits. Cartels sell their dollars at a discount to Colombian businessmen who need to buy goods in the United States. The dollars go to pay the U.S. manufacturer or exporter. The pesos never leave Colombia and end up in the drug baron's account. A hooded Colombian woman testified in Congress last month that she had laundered money through large U.S. banks and corporations unwittingly used by black market peso brokers. She cited the case of drug dollars going to pay for a tractor for a Colombian farmer. Keely, a former New York City police commissioner, warned that money laudering was corroding financial institutions. ``It is the source and the product of a burgeoning global parallel trading system that serves the emerging criminal holding companies,'' he told the bankers and lawyers. Kelly said the Clinton administration has worked to lessen the burden of the Suspicious Activity Reports that banks are obliged to file under the Banking Secrecy Act. The banking industry complained it had to file 12 million such reports in 1996, a time consuming and costly activity. New regulations exempts banks from reporting on certain customers, such as corporations listed on stock markets and their subsidiaries. But a new set of rules exempting additional businesses has caused an uproar among bankers because they would have to track the daily currency operations of these businesses for one year and project their annual currency needs. Copyright 1997 Reuters Limited. All rights reserved. Blair Anderson (Blair(a)technologist.com) International Consultant in Electronic Commerce, Encryption and Electronic Rights Management "Techno Junk and Grey Matter" (HTTP://WWW.NOW.CO.NZ [moving servers, currently inactive]) 50 Wainoni Road, Christchurch, New Zealand phone 64 3 3894065 fax 64 3 3894065 Member Digital Commerce Society of Boston ---------------------------- Caught in the Net for 25 years ---------------------------- For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Content controls
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:29:04 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Content controls Cc: whgiii(a)invweb.net, dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) >>>A whole bunch of people are now talking about these cash-settled recursive >>>auction processes, and they're a direct, and now obvious, consequence of >>>bearer (or at least instant) settlement markets for information on geodesic >>>networks. When you add anonymity to the transaction, you pretty much have >>>the final straw for "rights" tracking. Watermarks just tell you who the >>>information was stolen from, for instance. So, one more industrial >>>information process bites the dust. > >>Whoa! Hang on here. Sure, watermarks will tell you who information was >>stolen from, but they're just a stalking horse... a weak second cousin to >>*persistent* content control technologies (such as IBM's Cryptolopes and >>Intertrust's Digiboxes). These allow rightsholders to manage a wide >>range of parameters (including price, usage context, and any other >>variable for which you can imagine having a certificate). Whats >>fundamentally different about what are generically referred to as secure >>envelopes, is that they can maintain controls *indefinitely* >>(persistence), across an un- >>known, ad hoc, web of distribution over which one otherwise has no >>control. And yes, this can all work even in a completely disconnected >>environment (laptop at 35,000 feet). > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new >>ways, based on entirely new (or old) business models, that take advantage >>of rich/elaborate conditions for usage (e.g. you can view this picture >>anonymously, but it will cost you 2X as much, and you can only get it at >>low resolution, and you can't view it at all unless you can prove that >>you don't live in the Middle East). No certificate for these conditions? >>Sorry, no content. > >>They are based the same basic stuff (public key cryptography of course) >>that *can* fuel wild anarchic visions of anonymous exchange. ;) > >>But they aren't at all deterministic of any particular economic model. > >Well how exactly does one prevent data from being stolen once it has been >unlocked? I pay my 2X to view the picture anonymously and now I copy it >save it and distribute it worldwide. I fail to see how any >encryption/watermark scheme can prevent me from doing so. The control technologies to which I referred earlier turn the lock/unlock idea into far more than a binary choice. This is what I meant by "persistence". The content cannot be used without its accompanying control set (which again, *might* include payment). Part of the control set I may impose on anonymous viewers could include preventing them from copying or saving the content directly in digital form. This is counter-intuitive to those of us who are used to having cut/paste available at our fingertips in most applications, but its relatively trivial to disable these functions on a file by file basis. Alternatively, I might impose controls that permit anonymous users to see *only* lower reso- lution versions. (by analogy, if you're going to wear a ski mask into a jewelry store, you aren't likely to be shown the expensive stuff - if they let you in the door in the first place). If you were really determined, you could always take a photo of the screen, re-scan it, do some image enhancement to get rid of the graini- ness, re-save it and post it on your web page for all to see, (the so-called digital-to-analog-to-digital work-around), but this is darned inconvenient. Also, try doing that with music or movies.... while avoiding the roving automated net 'bots that will be out looking for illegal copies of content (these are already common). Not worth it. For most people. If it were, we'd already have massive illegal scanning operations in third-world countries, and plenty of demand for their wares. Sure, this exists, and may even grow a bit around the fringes, but this hardly proves the case for a single vision of an anarchic Robin Hood future for all content (Sell today else I rip you off tomorrow!!) As a non-disclosed third party, I'm not at liberty to discuss the 'guts' of either the Crytolope or Digibox technologies (though I have seen them) Both are covered, as you might imagine, by a fairly extensive array of active and pending patents. If you want to learn more, I'd recommend contacting them directly: www.intertrust.com (or their partner, Softbank NetSolutions) www.infomkt.ibm.com Cheers. - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0

Re: Hughes Markets? (finally some stimulating debate on dcsb)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Sat, 8 Nov 1997 09:28:21 -0500 To: "R. Jason Cronk" <listmanager(a)orange.redmans.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Re: Hughes Markets? (finally some stimulating debate on dcsb) Cc: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) I wrote: >>Whoa! Hang on here. Sure, watermarks will tell you who information >>was stolen from, but they're just a stalking horse... a weak second cousin >>to *persistent* content control technologies (such as IBM's Cryptolopes >>and Intertrust's Digiboxes). These allow rightsholders to manage a wide > ><SNIP> > >>They allow rightsholders, if they so choose, to *continue* being rights- >>holders in a highly networked, digital world, and in a wide range of new To which R. Jason Cronk replied: >"if they so choose" and here is where I submit the two camps divide. Yep. I couldn't agree more. There will be at *least* two, (and probably more like 2000) 'camps'. And here is where I think we diverge.... >Sure, you can decide to try to hold on to the rights, but it is going to be >market suicide. Your best bet is to sell it all off, get what you can for >it and do it again. In other words, a recursive auction market. With more sophisticated tools for rights management, the market contest can move to another level, with content business models *themselves* vying for attention. Recursive auctions are merely one of these models. They may make perfect sense for the kind of content that is going to decline in value over time anyway (news, for example). Not all content works this way though. Recursive auction markets are exciting because for the most part, they haven't been possible in 'copyright' industries until recently. Its easy to say that they will be more important than they are today. They will. But to say that they are fore-ordained as the only way for creators to get compensated is much too narrow. This view would only make sense if detaching copies from usage controls were easy. Today it is, and there is a common misconception that this will continue. But it won't. Cryptographers especially should understand this. The same base technology that makes it extremely difficult to mint one's own digital coins in someone else's currency will make it extremely difficult to use someone else's digital content without complying with their controls (including payment). It is inconsistent to say that digital money can have persistent value and digital content cannot. Both are information. Both based on a common faith in a 'brand': either the U.S. Treasury or Disney. Same idea. Best, - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

New GAO y2k reports
by Steve Schear 17 Dec '03

17 Dec '03

The following General Accounting Reports recently became available: - Year 2000 Computing Crisis: National Credit Union Administration's Efforts to Ensure Credit Union Systems Are Year 2000 Compliant. T-AIMD-98-20. 14 pp. October 22, 1997. http://www.gao.gov/new.items/ai98020t.pdf NCUA admits that they are in deep do-do. "... (1) current agency efforts to determine industrywide compliance are behind the generally accepted schedule for achieving Year 2000 compliance, and, consequently, NCUA does not yet have a complete picture of where credit unions stand individually or as an industry, (2) the agency lacks a formal, documented contingency plan in case credit unions do not become compliant in time or have other problems, (3) credit union internal auditors may not be thoroughly addressing Year 2000 issues as part of their work, and (4) NCUA does not have enough technical capability to conduct Year 2000 and other examinations in complex systems areas." "... the problem could lead to numerous problems when calculations requiring the use of dates are performed, such as calculating interest, calculating truth-in-lending or truth-in-savings disclosures, and determining amortization schedules. Moreover, automated teller machines may also assume that all bank cards are expired due to this problem. In addition, errors caused by Year 2000 miscalculations may expose institutions and data centers to financial liability and risk of damage to customer confidence. Other systems important to the day-to-day business of credit unions may be affected as well. For example, telephone systems could shut down as can vaults, security and alarm systems, elevators, and fax machines." - Social Security Administration: Significant Progress Made In Year 2000 Effort, But Key Risks Remain. AIMD-98-6. 17 pp. plus 2 appendices (6 pp.) October 22, 1997. http://www.gao.gov/new.items/ai98006.pdf The SSA reports that about 80% of its core code has been converted and tested and is confident of completion by January 1999, but that significant y2k exposure remains due to possible contamination from non-compliant sources of information (e.g., state disability and other federal agencies). --Steve

1 0