December 2003 - cypherpunks-legacy

Re: DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Sat, 14 Nov 1998 15:55:00 -0400 To: tboyle(a)rosehill.net Cc: dbs(a)philodox.com Subject: Re: DBS, Privacy, Money Laundering nonsense. Mime-Version: 1.0 From: Ryan Lackey <ryan(a)venona.com> Sender: <dbs(a)philodox.com> Precedence: Bulk List-Subscribe: <mailto:requests@philodox.com?subject=subscribe%20dbs> X-Web-Archive: http://www.philodox.com/dbs-archive/ Also Sprach Todd Boyle (tboyle(a)rosehill.net) > > * If thieves could hide the money they stole, there would be substantial > increase in frequency and severity of theft; I think this is definitely true. Particularly if it is *easy* to hide the money stolen, as criminals may be expert in a particular field of crime that is *not* financial -- it's already easy for a white-collar criminal to hide money, using the same skills used in white-collar crimes of other sorts, but not so easy for an armed robber. > * Reducing trackability of money increases the severity and frequency > of collusive crimes. Reducing trackability and improving the velocity of money *does* do this, but it's a side effect of the more important (and wider spread) effect of useful forms of money: increasing the severity and frequency of all kinds of collusion and cooperation! This is what money is for -- exchange. That criminal exchange uses DBS is just saying that criminal exchange is a form of exchange. > > In mean time, managing the out-of-control government sector is your civic > duty, to your less intelligent wives, Heh...I'd be afraid of saying this if I were married or ever planning to be :) On an archived list, no less... :) > > You need a coherent argument on this problem. You need measures within > the DBS technology itself, to address the need. Opponents of DBS will > raise all these demagogic arguments. You'll be hooted off the podium. This technology is layered (ooh, bad word to use in relation to money and payment systems :). I think you will agree with me that the correct place for financial restraints (particularly voluntary ones, for auditing purposes, which IMO are the most important -- it allows you to say you are doing something, specify how it can be measured, and then have it measured, rather than just having some vague after-the-fact threat of enforcement if they catch you) on digital token money is not at the following layers: * Sub-atomic layer * Atomic layer * Hardware layer * Network connection layer and you seem to be making the case that it doesn't belong at the human/legal layer. However, there are two layers in the middle: * application (core DBS protocols, etc.) and * presentation (graphical clients, etc.) I believe the correct place for any voluntary restraints on DBS money is not at the DBS protocol layer, but at a higher level. This can be built into the clients people choose to use for managing their money, generate auditing reports, etc. This provides people with the freedom to use clients tailored to their legal requirements -- a corporation's internal financial system should be far more complicated and constrained than my personal wallet -- and makes it relatively easy for everything to interoperate. You can even design things at the levels higher than the DBS level to escrow parts of coins with third parties, this requiring their participation or approval for any transaction -- sort of a "registered DBS system". If you believe taxes are a worthwhile thing, a government could mandage the use of such a system where the IRS was a party to each and every transaction. This would work perfectly well technically, and would not compromise the integrity of the protocols -- it's just a business decision on the part of an issuer of electronic cash. It's easy to see how this could work with insurance schemes, split control of coins, etc. --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Privacy and the internet
by Jason Burton 17 Dec '03

17 Dec '03

Does anyone know what I should do if someone was posting sensitive information on a website? And what if the webmaster of the domain doesnt respond to the request for removal of information. IS there something that say's what is and isn't able to be published "personal information" on the internet. If someone can reply I'd appreciate it. Seeking council. Jason Burton - Starloop Security security(a)starloop.com

3 2

Will Price (NAI employee) on KRA
by Adam Back 17 Dec '03

17 Dec '03

This comment on NAI's KRA(P) membership by Will Price <wprice(a)pgp.com>, a crypto type who works for PGP was forwarded to the ukcrypto list by Ian Goodyer (uk-crypto list admin). Not sure where it was posted originally, or perhaps Will asked Ian to forwarded it. Adam ------- Start of forwarded message ------- Date: Sat, 14 Nov 1998 11:43:07 +0000 To: ukcrypto(a)maillist.ox.ac.uk From: "Ian D. Goodyer" <goodyer(a)well.ox.ac.uk> Subject: Re: Escrow - news Here is a response from Will Price who was formally from PGP inc and now of course is with NAI. ian -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 I've commented about this on this list before I believe. This appears to be a case of really old news suddenly being dredged up for no apparent wholesome reason -- which strikes me as quite odd because Wired was apparently so eager to break this ancient story that they didn't wait to ask anyone from NAI about it. NAI being listed on the KRA page is *solely* a result of our TIS acquisition. I really doubt anyone here actually called some KRA person and officially renewed our membership. Frankly, I doubt anyone here actually knows who to talk to there -- if there even is a "there". As I have said before, due to the TIS acquisition, NAI now has a bunch of products which contain key escrow features. Eliminating or modifying these features such that they work in a less big brother-like fashion will take significant time -- indeed entire TIS products were based around managing key escrow infrastructures. Don't get me wrong, TIS had a lot of other great products, but it will take time to redesign and rethink some of them in the context of export and key escrow. I'm not sure there's much point in withdrawing from KRA when those products still exist. These issues have no effect whatsoever on the PGP group. As always, we continue to publish full source code which effectively solves all the export issues for us. Robert Guerra wrote: > I just picked this up from another mailing list that I am on. Perhaps the > folks at NAI can clarify things? > > - ---------- Forwarded message ---------- > Date: Fri, 13 Nov 1998 10:55:06 +0000 > From: Ross Anderson <Ross.Anderson(a)cl.cam.ac.uk> > Reply-To: ukcrypto(a)maillist.ox.ac.uk > To: ukcrypto(a)maillist.ox.ac.uk > Subject: Escrow - news > > (1) Network Associates has quietly rejoined the Key Recovery Alliance > - - see http://www.kra.org. - -- Will -----BEGIN PGP SIGNATURE----- Version: PGP 6.0.2 iQA/AwUBNkySo6y7FkvPc+xMEQIuygCfYosXGISVrKd4dYWwM8xOrVdd4WAAn3dT XvDG6FMapZpjmvjucF67fwM5 =xa+R -----END PGP SIGNATURE----- Will Price, Architect/Sr. Mgr., PGP Client Products Total Network Security Division Network Associates, Inc. Direct (408)346-5906 Cell/VM (650)533-0399 <pgpfone://cast.cyphers.net> PGPkey: <http://pgpkeys.mit.edu:11371/pks/lookup?op=get&search=0xCF73EC4C> ------- End of forwarded message -------

2 3

Privacy and the internet (fwd)
by Jim Choate 17 Dec '03

17 Dec '03

Forwarded message: > Date: Sat, 14 Nov 1998 04:46:03 -0500 > From: Jason Burton <talon(a)who.net> > Subject: Privacy and the internet > > Seeking council. > That's exactly what you should do, get a lawyer. ____________________________________________________________________ Lawyers ask the wrong questions when they don't want the right answers. Scully (X-Files) The Armadillo Group ,::////;::-. James Choate Austin, Tx /:'///// ``::>/|/ ravage(a)ssz.com www.ssz.com .', |||| `/( e\ 512-451-7087 -====~~mm-'`-```-mm --'- --------------------------------------------------------------------

1 0

100S OF FREE PICS'N'LINKS EVERY DAY!
by STUFFED SUN NOV 15 17 Dec '03

17 Dec '03

+ 30 SUPERB, HI-RES, HOT PHOTOS + 5 SUPER SEXY STORIES + HARDCORE SEX WITH ZOOM + MY BUTT COLLECTION + ABSOLUTE XXX + CATIJANA'S PUSSY PICS + EXCESSIVE + SEX CARNIVAL + WAANAADOOUS + DILDO MANIA + A1 HARDCORE + TITS 4 FREE + BONUS PIC 1 -> http://www.stuffed.net/home/20453.htm + BONUS PIC 2 -> http://www.stuffed.net/home/4919.htm + BONUS PIC 3 -> http://www.stuffed.net/home/1906.htm + BONUS PIC 4 -> http://www.stuffed.net/home/5819.htm + BONUS PIC 5 -> http://www.stuffed.net/home/1663.htm + MUCH, MUCH MORE! ----> http://stuffed.net/home/ <---- This email is never sent unsolicited. Stuffed is the supplement for the Eureka newsletter you subscribed to. Full instructions on unsubscribing are in every issue of Eureka! ----> http://stuffed.net/home/ <----

1 0

Welcome to the Risk Professionals Discussion Area!
by garp＠chadmarc.com 17 Dec '03

17 Dec '03

Thank you for participating in our conferencing system, John. Please save this message. It contains important information, such as your login name and password (see below). Our web conferencing offers online Help for all major features. If you have questions about a feature, look for the help button on the menubar. Here is your login information. Be sure to keep it somewhere safe! Your Login Name: cypherpunks Your Password: cypherpunks You can change your password, email address, and other items by selecting "Profiles" from the "More" button on the menubar. Please be sure to come back and visit us at: http://chat.bccg.com:8080/~GARP We hope you enjoy participating in our conferences! Sincerely, garp(a)chadmarc.com

1 0

Re: DBS, Privacy, Money Laundering nonsense.
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text From: "Michael Alexander" <mfa(a)alpha.univie.ac.at> To: <dcsb(a)ai.mit.edu> Subject: Re: DBS, Privacy, Money Laundering nonsense. Date: Sat, 14 Nov 1998 20:52:53 +0100 MIME-Version: 1.0 X-Priority: 3 X-MSMail-Priority: Normal X-MimeOLE: Produced By Microsoft MimeOLE V5.00.0810.800 Sender: bounce-dcsb(a)ai.mit.edu Precedence: bulk Reply-To: "Michael Alexander" <mfa(a)alpha.univie.ac.at> >From: "Black Unicorn" <unicorn(a)schloss.li> > That's on the order of $600 >trillion per year, just in SWIFT. (Add another $1.3 billion for CHIPS and >$989 million for Fedwire daily. Oh, don't forget the foreign exchange as a minor correction, SWIFT 's main service is to exchange payment messages to feed into e.g. Fedwire or CHIPS so that would be double counting >The payment system today eats up over 1.5% of the GNP primarily because of >nonsense regulations like CTR's and other transaction reporting ... >1% of the GNP. Instant 1% growth for changing a system of clearing. Think >about that for awhile. slowly on that: payment systems costs represent what economists call 'specific taxes' that is they inflict deadweight losses on the economy. More efficient payment instruments such as some being based on bearer certificates would per se lower GDP but lead to higher demand in theory. Its effect would be as instant as a cut in other broad ones such as income or capital gains that is it involves lag. On the actual percentage of payment systems costs as % of GDP my estimates are way higher. By simply taking clearing float days of the major retail, business and interbank instruments, the figure is more like >2% with current (low) interest for the U.S. and even higher for Europe. This does not take into account that a more efficient payment system with a higher money velocity would lower the demand for transaction money among other effects. Michael For help on using this list (especially unsubscribing), send a message to "dcsb-request(a)ai.mit.edu" with one line of text: "help". --- end forwarded text ----------------- Robert A. Hettinga <mailto: rah(a)philodox.com> Philodox Financial Technology Evangelism <http://www.philodox.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

NSA on OS Flaws
by John Young 17 Dec '03

17 Dec '03

An NSA team presented at NISSC98 in October "The Inevitability of Failure: The Flawed Assumption of Security in Modern Computing Environments:" http://jya.com/paperF1.htm (62K) Abstract Although public awareness of the need for security in computing systems is growing rapidly, current efforts to provide security are unlikely to succeed. Current security efforts suffer from the flawed assumption that adequate security can be provided in applications with the existing security mechanisms of mainstream operating systems. In reality, the need for secure operating systems is growing in todays computing environment due to substantial increases in connectivity and data sharing. The goal of this paper is to motivate a renewed interest in secure operating systems so that future security efforts may build on a solid foundation. This paper identifies several secure operating system features which are lacking in mainstream operating systems, argues that these features are necessary to adequately protect general application-space security mechanisms, and provides concrete examples of how current security solutions are critically dependent on these features. Keywords: secure operating systems, mandatory security, trusted path, Java, Kerberos, IPSEC, SSL, firewalls. ----- The paper advocates greater research on vulnerabilities of operating systems which allow malicious attackers to circumvent application-level security, including cryptographic protection. Ways to get around hardware and software crypto are outlined. Covert channels are a prime concern, as well as benign use inadverdently allowing malicious intrusion. An extensive list of references trace the twenty-five year history of OS flaws and examine why so little has been done to correct known deficiencies which undermine seemingly unbreachable applications. Readings about DTOS, Fluke, Flash and other developments of the NSA-sponsored Synergy program are illuminating. The recent republication of early compsec documents by CSRC is appropriate to this topic, particularly, "Subversion: The Neglected Aspect of Computer Security," by Philip Myer, June 1980, a thesis at NPS: http://csrc.nist.gov/publications/history/myer80.pdf Not that NSA would ever exploit OS weaknesses not warned about. ----- Thanks to JM/RH for pointing to the NISSC papers.

1 0

No Subject
by Anonymous 17 Dec '03

17 Dec '03

Shouldn't we be using "Mr. Cordian's" real name? Matt Blaze (mab(a)research.att.com) also occasionally known as "M.F. Tones", and even less often as "Mr. Rouge" (There should be an accent mark there actually).

1 0

nm web site
by bill payne 17 Dec '03

17 Dec '03

Saturday 11/14/98 6:13 PM John Young http://www.jya.com/index.htm J Orlin Grabbe http://www.aci.net/kalliste/ As a result of jy's persuasive arguments http://jya.com/whpfiles.htm, we are going to put up a web site. But unlike you-all's sites ours will be somewhat positive 1 masm mixed language programming ... and Microsoft bugs 2 8032 forth programming and hardware 3 pc hardware 4 pro se litigation against the government 5 cypto nonsense 6 ... But, most important, we have learned by your pioneering web information dissemination efforts. And mistakes at other websites. Like bouncing balls. You guys, in my opinion, are the some of the most brilliant, perhaps with the exception of the X-rated sites, at getting the info out there. And yes, we will use THUMBNAIL photos. Of schematics, main boards, .... etc. Simplicity exudes brilliance. Perhaps there is a converse? Thoughtfully, I hope bill

1 0