December 2003 - cypherpunks-legacy

Re: [SURVEY try again] pgp5.x / pgp2.x users
by ulf＠fitug.de 17 Dec '03

17 Dec '03

20 % of the users who have posted digitally signed messages that are available in my news spool (international and local newsgroups and mailing lists) use PGP 5. The sample contains 545 unique e-mail addresses. YMMV. S/MIME Cryptographic Signature 10 Version: 2.3a 1 Version: 2.6.1 1 Version: 2.6.2 68 Version: 2.6.2, by FileCrypt 1.0 2 Version: 2.6.2i 5 Version: 2.6.3 4 Version: 2.6.3a 8 Version: 2.6.3i 37 Version: 2.6.3ia 278 Version: 2.6.3ig 1 Version: 2.6.3in 9 Version: 2.7.1 2 Version: 4.5 6 Version: Cryptix 2.2.2 2 Version: Cryptix 2.21 3 Version: Cryptix 2.3.0 1 Version: PGP 5.0i 1 Version: PGP for Business Security 5.5 12 Version: PGP for Personal Privacy 5.0 86 Version: PGPfreeware 5.0 Charset: noconv 1 Version: PGPfreeware 5.0i for non-commercial use 7

1 0

Ooops....!
by Dirko 17 Dec '03

17 Dec '03

That should have been cypherpunks-request(a)toad.com ... SH** sorry ... It's coffee buzz... *shake* ---------------------------------- Dirko van Schalkwyk Dead Engineers Society E-Mail: meddle(a)adept.co.za Date: 11/07/97 Time: 01:28:37 ----------------------- Movie Quotes for Willow (1988) ----------------------- Sorsha: What are you looking at? Madmartigan: Your leg. I'd like to break it. ------------- All of the following stolen from selected poeple mailing to the AfterStep mailing list ----------------------- Contrary to popular belief, Unix is user friendly.It just happens to be very selective about who it decides to make friends with. ----------------------- Windows95 (noun): 32 bit extensions and a graphical shell for a 16 bit patch to an 8 bit operating system originally coded for a 4 bit microprocessor, written by a 2 bit company, that can't stand 1 bit of competition

2 1

plugin to sell digital files in cyberspace announced!!
by Vladimir Z. Nuri 17 Dec '03

17 Dec '03

wow, I have been thinking that netscape/microsoft would put something like this in their browser and that this would kickstart the microcurrency market. however, it sounds like someone has preempted them for the moment and built a plugin. this is an extremely significant development imho. I don't know how credible they are (the notice was spam) but it's a step in the right direction, and the creation of a whole new market I predict. Date: Thu, 06 Nov 97 06:28:47 EST To: InternetUser(a)The.Net Subject: Turn your web-site into a pay-per-view site free in 10min! Reply-To: powerit(a)venus.t-1net.com I-vendor is offering a freeware version of a software plug-in that allows anyone to sell digital files such as photos, programs, text based information etc. from any web site. You don't have to be a company, you don't have to have credit card facilities, you don't have to do anything fancy with your web site - just convert your files, put them on your site and wait for the monthly checks. The software works with Window 3.x & 95 and current versions of Netscape and Internet Explorer - full instructions for use are provided. - - --- Visit http://members.aol.com/ivendor/index.htm to download the freeware plug-in and information pack. - ------- End of Forwarded Message ------- End of Forwarded Message

1 0

Re: [Fwd: Re: [RePol] Donations Received]
by nobody＠REPLAY.COM 17 Dec '03

17 Dec '03

Six wrote: > This was sent through EFGA's Georgia Cracker Remailer, but seems to > have gotten 'lost' in the remail. > Go figure... Perhaps they objected to you not using your Government approved 'Prisoner of Citizenship' name.

1 0

new lanl patent?
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Authentication-Warning: blacklodge.c2.net: majordom set sender to owner-cryptography(a)c2.org using -f From: proff(a)iq.org Date: 6 Nov 1997 06:35:37 -0000 To: cryptography(a)c2.net Subject: new lanl patent? Sender: owner-cryptography(a)c2.net From: "Jongsma, Ken (NM75)" <ken.jongsma(a)das.honeywell.com> Date: 24 Oct 1997 10:32:24 -0600 Subject: Hiding In Plain Sight from the Oct 20 Aviation Week: "Researchers at Los ALimos National Laboratory have patented a new software technique that can hide secret information in the electronic "noise" associated with the transmission of data and electronic images. Called "data embedding," the method allows classified data to be stored and transferred in open transmissions and can serve as an "electronic watermark" to prevent unauthorized manipulation of digital images and other information, according to Ted Handel, project leader. The software can be used on a desktop personal computer and consumes only 512 kilobytes of memory, less than most word processing programs. It is written in "C" computer language which conforms to virtually any digital storage medium. Overall document length can remain the same." Aside from the obvious errors in the story, do you suppose that someone ought to clue the patent office in that steganography has existed for quite a while now? If anyone would like to research the patent and report back, it would be interesting to see what is so unique that the could get a patent on it. -- ken.jongsma(a)das.honeywell.com 505 828-5876 Voice 505 828-5500 Fax --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Re: Hughes Markets? (Was Re: Copyright commerce and the street musician protocol)
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text X-Sender: hutchinson(a)click.ncri.com Mime-Version: 1.0 Date: Thu, 6 Nov 1997 14:52:30 -0500 To: Robert Hettinga <rah(a)shipwright.com> From: hutchinson(a)ncri.com (Art Hutchinson) Subject: Re: Hughes Markets? (Was Re: Copyright commerce and the street musician protocol) Cc: dcsb(a)ai.mit.edu Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: hutchinson(a)ncri.com (Art Hutchinson) Robert Hettinga wrote: >A whole bunch of people are now talking about these cash-settled recursive >auction processes, and they're a direct, and now obvious, consequence of >bearer (or at least instant) settlement markets for information on geodesic >networks. When you add anonymity to the transaction, you pretty much have >the final straw for "rights" tracking. Watermarks just tell you who the >information was stolen from, for instance. So, one more industrial >information process bites the dust. Whoa! Hang on here. Sure, watermarks will tell you who information was stolen from, but they're just a stalking horse... a weak second cousin to *persistent* content control technologies (such as IBM's Cryptolopes and Intertrust's Digiboxes). These allow rightsholders to manage a wide range of parameters (including price, usage context, and any other variable for which you can imagine having a certificate). Whats fundamentally different about what are generically referred to as secure envelopes, is that they can maintain controls *indefinitely* (persistence), across an un- known, ad hoc, web of distribution over which one otherwise has no control. And yes, this can all work even in a completely disconnected environment (laptop at 35,000 feet). They allow rightsholders, if they so choose, to *continue* being rights- holders in a highly networked, digital world, and in a wide range of new ways, based on entirely new (or old) business models, that take advantage of rich/elaborate conditions for usage (e.g. you can view this picture anonymously, but it will cost you 2X as much, and you can only get it at low resolution, and you can't view it at all unless you can prove that you don't live in the Middle East). No certificate for these conditions? Sorry, no content. They are based the same basic stuff (public key cryptography of course) that *can* fuel wild anarchic visions of anonymous exchange. ;) But they aren't at all deterministic of any particular economic model. Regards, - Art Art Hutchinson hutchinson(a)ncri.com Northeast Consulting Resources, Inc. phone: (617) 654-0635 One Liberty Square fax: (617) 654-0654 Boston, MA 02160 www.ncri.com ------------------------------------------------------------------------------ "Working at the intersection of business and IT strategy to help organizations embrace electronic commerce opportunities" For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

2 1

Jam Six
by Anonymous 17 Dec '03

17 Dec '03

Jam Six Six

1 0

FEMA site using cookies
by Attila T. Hun 17 Dec '03

17 Dec '03

1 0

plugin to sell digital files in cyberspace announced!! (fwd)
by Lindsay Haisley 17 Dec '03

17 Dec '03

>wow, I have been thinking that netscape/microsoft would put >something like this in their browser and that this would >kickstart the microcurrency market. however, it sounds like >someone has preempted them for the moment and >built a plugin. this is an extremely significant development >imho. I don't know how credible they are (the notice was >spam) but it's a step in the right direction, and the >creation of a whole new market I predict. I looked at their website and it looks rather fishy to me. Several issues and questions are obvious, not the least being the observation that this is an absolutely fabulous way to collect a bunch of credit card numbers. There is no information on the website to say where I-Vendor is located, or any way to judge whether it's even a legit company. The website is on AOL, so it's real ownership is effectivley concealed, and the owners could be over the border into Mexico with a hard drive full of stolen CC numbers and no one would be the wiser until it was too late :-( A legit domain name and website to use it on are pretty cheap, and make obvious business sense for a legit business - likewise for a phone number, which is also absent from the web pages. Both provide business points of contact and both provide trackability. Maybe I-Vendor doesn't want trackability. Hmmmm. So I download an exe file from a nearly anonymous site on AOL and run it to find out more about it? No thanks!!! It looks too much like a juicy worm on a hook to this fish. Lindsay Haisley (______) FMP Computer Services (oo) "The bull fmouse(a)fmp.com /------\/ stops here!" Austin, Texas, USA / | || 512-259-1190 * ||---|| * * * * * * ~~ ~~ http://www.fmp.com

1 0

From Our Friends at the Fed
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Mime-Version: 1.0 Date: Thu, 6 Nov 1997 20:23:25 -0800 From: jmuller(a)brobeck.com (John D. Muller) Subject: From Our Friends at the Fed To: rah(a)shipwright.com X-MIME-Autoconverted: from quoted-printable to 8bit by pop.sneaker.net id XAA28997 Thought this missive from the Federal Reserve (SR Letter 97-28 for those who insist on a formal citation) might be of interest. Not sure if it's e$ or dcsb or cypherpunk-type material or none of the above, so I punt and let you decide. Cheers. John Muller mailto:jmuller@brobeck.com ---------------------------------------------------------------------- -- Suggested Cover Letter To the Chief Executive Officer or General Manager of Each State Member Bank, Bank Holding Company, State Chartered, Non-Insured U.S. Branch or Agency of a Foreign Bank, and Edge and Agreement Corporation in Your District Dear ______________________: The Federal Bureau of Investigation, working with Federal Reserve staff and representatives from the other federal banking agencies as well as other federal law enforcement agencies, developed the attached guidance concerning the reporting of violations of the federal criminal statute relating to computer crimes, 18 U.S.C. ß 1030 (Fraud and Related Activity in Connection with Computers) in Suspicious Activity Reports (SARs). The guidance is intended to facilitate the timely and accurate reporting of apparent violations of this law to law enforcement and bank supervisory agencies. The guidance describes the provisions of 18 U.S.C. ß 1030 and gives some examples of conduct that may violate the law. It also tells you how to report violations in a SAR. We would appreciate you bringing this matter to the immediate attention of all personnel in your organization responsible for reporting suspicious activity. In the event you have any questions concerning this matter, please contact __________________________. Sincerely, [Reserve Bank Official] Attachment ---------------------------------------------------------------------- -- GUIDANCE CONCERNING THE REPORTING OF COMPUTER-RELATED CRIMES BY FINANCIAL INSTITUTIONS This guidance is provided in order to explain the federal criminal statute relating to computer crimes, 18 U.S.C. ß 1030, and to ensure the timely and accurate reporting of apparent violations of the statute to law enforcement authorities. Background Regulations issued by the Federal Reserve, OCC, FDIC, OTS, and NCUA generally require banks, thrifts, credit unions, the U.S. branches and agencies of foreign banks, and other types of financial institutions to file Suspicious Activity Reports (SARs) whenever they detect any known or suspected federal criminal law violation or suspicious activity. The SAR system facilitates the reporting of suspected criminal activity and money laundering in a standard format to a single collection point, from which the information may be rapidly disseminated to appropriate law enforcement agencies. SARs play a critical role in collecting information about criminal activity affecting the financial community. Under the five financial institutions supervisory agencies' current SAR rules, a financial institution is required to report any known or suspected criminal law violation involving an insider, regardless of amount. A financial institution is also required to report any known or suspected federal criminal law violation that involves or aggregates more than $25,000 in the event no suspect can be identified--a threshold that drops to $5,000 if a potential suspect can be identified. The current SAR form includes in Part III, Box 37, a listing of 17 various categories of criminal law violations and suspicious activities that a financial institution can check. The categories include check, credit and wire transfer fraud, defalcation/embezzlement and mysterious disappearances, and also include a general category under "Other" that is to be used in the event the offense or activity does not appear to fit any of the delineated types of crimes. There is no category in Part III, Box 37, specifically reserved for violations of the provisions of the U.S. criminal code relating to computer crimes--18 U.S.C. ß 1030 (Fraud and Related Activity in Connection with Computers). Criminal Law Relating to Computers Computers and computer networks are at the heart of operations of a modern financial institution. Criminals--both inside and outside of financial institutions-- recognize the potential vulnerability of computer systems. Consequently, financial institutions must be cognizant of the federal computer crime law, 18 U.S.C. ß 1030. This statute specifically includes as a "protected computer," among other computers shielded by the statute, any computer exclusively for the use of a financial institution, or, if not exclusively for such use, used by or for a financial institution where the conduct constituting the offense affects that use. Financial institutions should pay particular attention to three provisions of 18 U.S.C. ß 1030. Section 1030(a)(2) specifically prohibits intentionally accessing a protected computer to obtain certain kinds of information without authority or in excess of authority. Not only does it generally prohibit improperly obtaining information from any "protected" computer, but it specifically prohibits improperly obtaining information contained in a "financial record" of a financial institution. The provision may also apply to an individual who hacks into a financial institution computer system. "Financial record" is defined as information derived from any record held by a financial institution pertaining to a customer's relationship with the institution. Another provision applicable to financial institutions is the prohibition on using a "protected" computer without authorization or in excess of authorization to commit fraud. The provisions of 18 U.S.C. ß 1030(a)(4) criminalize the knowing use of a protected computer without authorization or in excess or authorization with intent to defraud, and by means of such conduct furthering the intended fraud and obtaining anything of value. Thus, an individual who intentionally uses another person's home banking software and purloins that person's password in order to transfer money fraudulently into his or her personal bank account has committed a crime. The third provision--18 U.S.C. ß 1030(a)(5)--with applications to financial institutions is the prohibition on intentional access without authorization that results in "damage" to a protected computer. Damage is defined to include any impairment to the integrity or availability of data, a program, a system, or information that causes loss aggregating at least $5,000 in value during any one-year period. An example may involve a disgruntled former employee who maintains a "back door" into the computer system and uses it to introduce a virus that disrupts the system. Another example may involve an intruder who causes a system outage by flooding an institution's computer system with e-mail requests for information. Other provisions of 18 U.S.C. ß 1030 applicable to financial institutions include subsection (a)(6), which outlaws trafficking in passwords knowingly and with intent to defraud. Subsection (a)(7) prohibits transmitting threats to cause damage to a protected computer with intent to extort money or any other thing of value from any legal entity, specifically including financial institutions. This prohibition applies regardless of whether any actual damage is caused, or whether the offender actually had the ability to cause such damage. A violation of 18 U.S.C. ß 1030 can result in a fine or imprisonment for up to ten years. Guidance A financial institution should report on a SAR any activity that appears to be violative of 18 U.S.C. ß 1030. If a reportable offense is detected, a financial institution should check Box 37r, marked "Other", and describe as completely as possible in Part VII, the narrative section of the SAR, the nature of the illegal or suspicious activity. --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/ Ask me about FC98 in Anguilla!: <http://www.fc98.ai/>

1 0