December 2003 - cypherpunks-legacy

Commercial privacy proxy server available
by Greg Broiles 17 Dec '03

17 Dec '03

See <http://www.iproxy.com/>; their service agreement isn't very pro-privacy (they don't want you to use it for porn, and reserve the right to disclose records to law enforcement or third parties, pursuant to warrant/process *or* informal request), but it's an interesting development. -- Greg Broiles | US crypto export control policy in a nutshell: gbroiles(a)netbox.com | http://www.io.com/~gbroiles | Export jobs, not crypto.

1 0

Secure payments on the Internet the focus of internationalconference June 19-20 in Washington
by Robert Hettinga 17 Dec '03

17 Dec '03

--- begin forwarded text Date: Fri, 16 May 1997 15:17:31 -0400 From: Debra Greenberg <101664.3477(a)compuserve.com> Organization: FBMA America Inc. MIME-Version: 1.0 To: rah(a)shipwright.com Subject: Secure payments on the Internet the focus of international conference June 19-20 in Washington X-URL: http://www.shipwright.com/#contact Hello, Mr. Hettinga -- I'm a fairly recent fan of e$, having learned about it only a month ago. Aware as I am of the rules of Netiquette, I was hoping for your advice or assistance regarding how I might let other readers know about an important conference coming up June 19-20 in Washington on the subject of secure payments and the Internet. Sponsored by Digital Equipment Corp., Hitachi, CyberCash and VeriFone, the conference will address payment systems, security issues, digital signatures and certification authorities, regulatory issues, standards development, emerging technologies, and other topics. Keynote speakers include Ira C. Magaziner, Senior Advisor to the President for Policy Development; William Melton, CEO, CyberCash; and Frank V. Cahouet, CEO, Mellon Bank, among others. In addition to discussions on electronic purse, chip cards, micropayments, credit cards on the Internet and other payment systems, and in addition to progress reports on BIPS, NetBill, Integrion, Mondex and other high-profile rollouts, the conference will feature discussions on: -taxation of Internet commerce (Karl Frieden, Arther Andersen / Walter Nagel, MCI Communications) -risk management in business-to-business bill payments on the Internet (Anne Friedman, Chase Manhattan / Sandra Runyon, Southwestern Bell / Scott Smith, Jupiter Communications -establishing trust in electronic transactions (Lori Fena, Exec. Director, Electronic Frontier Foundation) - the US Postal Service's electronic postmarking and CA initiative - proposed changes to the ACH network to support Internet payments In all, there will be about 40 presentations. The CyberPayments 97 conference (which is accompanied by an exposition titled "i-Money" takes place June 19-20 at the Sheraton Washington Hotel and is organized by the National Automated Clearing House Association, which is actively involved in promoting all types of payment systems, including Internet payments. A full conference brochure can be found at www.nacha.org I hope you'll find the conference interesting enough to share with your readers. Thank you in advance for your consideration of this information. Sincerely, Debra Greenberg Managing Director FBMA America Inc. (on behalf of the National Automated Clearing House Association) 101664.3477(a)compuserve.com --- end forwarded text ----------------- Robert Hettinga (rah(a)shipwright.com) Philodox e$, 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire' The e$ Home Page: http://www.shipwright.com/

1 0

Re: Just Say "No" to Congress
by lucifer＠dhp.com 17 Dec '03

17 Dec '03

Vladimir Z. Nuri wrote: > >> anyone who disbelieves in the authority of the US government > >> yet sends them their tax money is a hypocrite. > > > > Horseshit. That's no different from saying that anyone who > >disbelieves in the authority of armed robbers yet gives them > >their wallet is a hypocrite. > > Do you actually put any thought into your posts? > > > > ok truthmonger, after someone has stolen your money, do you > report it to the police, or do you just sit around and > curse the evildoer? what is your response when your money > is stolen? I kiss it goodbye and forget about it. The police are too busy pursing imaginary crime to bother with real crime. I caught a kid breaking into my camper by the Rose Garden in Berkeley. I handcuffed him to the bumper and gave him the option of my calling his mother or the police. When the Berkeley police cruised by I explained the situation and they had no problem with it, but I got a pile of shit from various Berkeley bleeding-hearts while we waited for his mother. I would have turned the kid loose before turning him over to the police, since I regarded him as a lesser criminal than many of them. I've lost a few thousand dollars worth of goods to thieves, but criminal cops have cost me tens of thousands of dollars in the legal system. TruthMonger

1 0

PI/GILC UK Crypto Conference Cybercast
by Dave Banisar 17 Dec '03

17 Dec '03

For those of you interested in hearing a live cybercast of the Privacy International/GILC conference on UK cryptography policy, theURL is: http://www.encryption.co.uk Speakers will include Phil Zimmermann, Whit Diffie, Ross Anderson, and Carl Ellison. The Department of Trade and Industry and the National Criminal Intelligence Service will also present. The event is being hosted by the London School of Economics. A copy of the agenda is available at: http://www.privacy.org/pi/conference/dti/

1 0

CC fingerprints
by harka＠nycmetro.com 17 Dec '03

17 Dec '03

-----BEGIN PGP SIGNED MESSAGE----- http://cnn.com/TECH/9705/16/t_t/magnetic.security/index.html Catching counterfeit credit cards Researchers find way to check magnetic 'fingerprints' ST. LOUIS, Missouri (CNN) -- Researchers at Washington University here have come up with a way to spot counterfeit credit cards by detecting the unique "fingerprint" on the back of each card. <snip> Their solution, called the Magneprint system, reads the millions of tiny magnetic particles, which are unique on each card, says Professor Ronald Indeck. Each magnetic stripe on the card has two important areas. The first looks like a bar code, which contains the account number. The rest is a random pattern of magnetic information -- a signature that is different on every card and impossible to duplicate, Indeck says. <snip> The inventors say the Magneprint system can be used to stop other kinds of fraud, involving airline tickets, currency, and checks. It's expected to be made available to card companies later this year. ========================================================================== -----BEGIN PGP SIGNATURE----- Version: 2.6.2 iQEVAwUBM311bjltEBIEF0MBAQHq1Af9EIo98F80FaAbiYJv9JBfR8QIFpwIHnCG HPZAyRFPz8Yx1AMApGc0i5JckqanriXzAEE/+3K1YiLcpL0X0yxUEA6wBc31nYG1 6so/mWdeaBMy81/Coa+534vPcWpPN4/TyBsiGitNzeh4dVit2yYg/AwW2NV092B2 p6ERgI91UtIxVov18CG2wpt960H2q4QNGnl5pI43xhHeutsZHvt97eDpoMTqaR6v nam1TpolXxQSxcubmOfUFyvI1hZN3bUx472OnfcrtuuNHMPsoGX11J9Z2NtTzwjx FbcpDJ0KCQtTlY1ViGHI60XqFFFWXUQ/pTZgXF8bVeOsIzOkicU0Ug== =Y3gr -----END PGP SIGNATURE-----

3 2

Re: Civil Disobediance
by nobody＠hidden.net 17 Dec '03

17 Dec '03

On Fri, 16 May 1997, tzeruch(a)ceddec.com wrote: > On Thu, 15 May 1997, Huge Cajones Remailer wrote: >> "All that matters is how we die: shall we offer our bodies >> helplessly, like cattle, to the knife, or, refusing passively to >> await the end shall we turn the strength of our anger to one last >> battle, til, daring and doing, we fall, drenched with their blood, >> amongst the heaped bodies and weapons of our dying enemies?" -- >> Livy Book XXV > > They couldn't move with their wealth out of the way, so the > alternatives were limited. The passage above appears in the discussion of the betrayal to the Carthaginians of the Roman commander Gracchus by his "friend" Flavus Gracchus makes this declaration to his men before they fought their enemies to the death. The protection of personal wealth was only weakly connected with the events described. Dr. Roberts

1 0

Re: Civil Disobediance
by nobody＠hidden.net 17 Dec '03

17 Dec '03

On Thu, 15 May 1997, Adam Back wrote: >Dr Roberts writes: >> Perhaps there is a way to turn the training on the trainers? Civil >> disobediance is the best way to do this. Were a relatively small >> number of people, a thousand for instance, to post the "RSA in 3 >> lines" code to the world, it would be highly unlikely that anybody >> at all would be prosecuted, > Many 1000s of people have exported it. This was a step in the right direction. The response of the USG has been to pretend it isn't happening. However, if 1000 people announced publically and openly that on a certain date they were all going to post it to this and similar lists, it would have a strong political impact, particularly if followed regularly by longer works of mathematics. Of course, if the "RSA in 3 lines" posting is considered a done deal, it may be time to move on to longer postings. The fact is the USG has been reluctant to make any overt moves. Instead, they have tried to quietly put in "the crypto fix" without making too many waves. Over and over again we have seen their lack of confidence in their ability to get away with making some math illegal. It may be the case that a number of mass postings of mathematics, which anybody can look at and see to be harmless, is all that it will take to finish off the whole ridiculous scheme. Simple ridicule has its value, but what I intend is the use of organized civil disobediance as a political action, and one which is almost impossible for thugs to respond to, particularly in time of peace. The nice thing about this form of civil disobediance is that it occurs on the Net in the most public way so that it will be very difficult for the newspapers to misrepresent what is going on. > Well, it does seem to me at times that people in the US are being > too timid about the whole situation. I mean if everyone just openly > ignored the stupid laws, you might think they would go away by > default, just to catch up with reality. Ironically, the very people who lay awake at night worrying about whether factoring is hard are the least likely to take risks! > Much hand-wringing is spent putting no-export warnings on code, > obfuscating the download process to discourage non-US people, and > warning others not to export. Nobody wants to be the first one to cross the line and be arrested. Fortunately, posting is easy and anybody can participate. Nobody has to be (in any meaningful way) the first to go. There is simply no way that the government will be able to lock up 1000s of professors, grad students, businessmen, programmers, or politicians for sharing mathematics when in the consensual hallucination we call the news, the country is being overrun by violent criminals. Maybe July 4 would be a good date? Dr. Roberts

1 0

Re: Martin Hannigan Pervert Pedophile
by dlv＠bwalk.dm.com 17 Dec '03

17 Dec '03

kibo <kibo(a)thecia.net> writes: ... > > > That's not as misguided as it seems. Common carriers are regulated > > > heavily, and many ISPs don't generally seek that regulation. > > > > > That is a telephone type of "common carrier." but anybody with a > "common carrier status" is not going to get regulated. All it means > is a hands-off approach to users postings. > > Even for a death threat, I will not terminate any user, because > the law is not mine to enforce. And this "copyright" shit is the > same argument. SPA needs to be attacked and undermined. The ISP cannot determine that a particular patterns of 1's and 0's constitutes a "death threat" and/or a "copyright violation". --- Dr.Dimitri Vulis KOTM Brighton Beach Boardwalk BBS, Forest Hills, N.Y.: +1-718-261-2013, 14.4Kbps

1 0

Re: http://www.dataet.com/public/source/vsacmv20/
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

Igor, In a message dated 97-05-17 01:04:54 EDT, you write: << Thank you VERY MUCH for releasing the source code. This shows that you are serious about your program and truly appreciate how important is the process of review as far as your credibility is concerned. I have downloaded your code and looked at it. Looks rather interesting (especially the part below). What I did not understand, however, is what is SetVal and how it works. Also, I was not clear how you set variables AE1, AE2, ..., AE10 and so on. As far as I understand, you use these variables to select the particular encryption method. Do you normally select only one method on some random basis or you use several passes? Also, some may be interested to look at this particular encryption method (I added some indentation and comments for readability). I believe that it is not particularly strong. >> Hi. Thanks for taking a look at the source code. Actually, SetVal is just a name used for many parameters of functions and procedures within VSACM. The documentation of VSACM V2.0 describes what SetVal represents in each function or procedure. Attached to this message is the help file of VSACM. As for the AE1, AE2, etc. variables, they're set with the VSACMSetEnableTC1001, VSACMSetEnableTC1002, etc. procedures. If you take a look at VSACMProcessOperation function in LibUnit.pas and the Internal function in IntUnit.pas, you'll notice how relatively uncomplex algorithm extensions are combined to form a powerful algorithm. The procedure TC1001 (in StdUnit.pas) you mentioned is basically a pseudo-random byte XORer. TC1001 is NEVER used as the sole encryptor of a file. You'll also notice that, at a minimum, single passes of TC1001, TC2005, TC1005, TC3001, TC3004, and TC3005 are used to encrypt/decrypt a file. No, an algorithm extension is not chosen randomly. Some of the procedures are "scramblers". Others are "incrementors". Others are "avalanchers". Again, it is best to analyze VSACM as a whole in a systematical (chronological) manner instead of analyzing each procedure of function in each source code file one by one. By the way, what do you think of the key hashing procedure (VSACMSetKey) and the memory deallocation and destruction procedure (VSACMInitialize) and the masking tables in IntUnit.pas? Did you find any "backdoors" or ways to hack a decryption date or time lock applied to a file without applying the correct key? (There aren't any). How about any flaws? Also, for others who may be reading this, if you still think VSA2048 is still a "flawed" or "crappy" or "sucky" or "snake-oiled" encryption algorithm, why don't you PROVE it by cracking the file located at http://www.dataet.com/public/source/vsacmv20/breakit.dat (if you are in the U.S.)?!?! (All words, no action!!!) Well? The file was encrypted using a 120-bit VSA2048 key. The key isn't even 128 bits in length! I don't know about you, but I would think VSA2048 is pretty good if not even one cypherpunk out there can decrypt the message. As for my previous line about the decryption contest being limited to the cypherpunks (@toad.com), I have changed my mind. The contest is open to any person (in the United States). I will post contest details to cypherpunks(a)toad.com again. I appreciate the comments. Thanks. Regards, Jeremy Yu-Ramos DataET Research

1 0

Re: http://www.dataet.com/public/source/vsacmv20/
by DataETRsch＠aol.com 17 Dec '03

17 Dec '03

In a message dated 97-05-17 13:37:36 EDT, you write: << why don't you PROVE it by cracking the file located at http://www.dataet.com/public/source/vsacmv20/breakit.dat >> It's "crackit.dat". Sorry.

1 0