May 2004 - cypherpunks-legacy

Paying through the mouse
by R. A. Hettinga 20 May '04

20 May '04

<http://www.economist.com/finance/PrinterFriendly.cfm?Story_ID=2693526> The Economist Online payments Paying through the mouse May 20th 2004 | SAN JOSE, CALIFORNIA >From The Economist print edition PayPal is turning into a huge online-payments business ONE of the most powerful forces in e-commerce is the "network effect": the more people who flock to a particular website, the greater its appeal. The latest beneficiary of this phenomenon is PayPal, which now handles online payments at an annualised rate of more than $17 billion. PayPal is not a bank, but for online buyers and sellers it performs much the same function. It already has 45m account-holders worldwide, one-quarter of the number of the mighty Citigroup. Next time, online The company began in Silicon Valley in 1998. Its e-mail system for payments became so widespread on internet auction sites that the biggest firm in this business, eBay, set up a rival, Billpoint, in the hope of snaffling for itself some of the value of transactions. But Billpoint never matched PayPal's popularity, so in 2002 eBay bought PayPal for $1.5 billion in shares. PayPal's ambition is to become the global standard for internet payments and it is expanding overseas in eBay's footsteps. In the first quarter of 2004, the value of items sold on eBay was $8 billion, 51% more than a year earlier. Meg Whitman, eBay's chairman, told analysts recently that the company reckons one in three online shoppers in America now has a PayPal account. Although PayPal's customers mostly buy via eBay, usage elsewhere is also growing-estimated at well over $1 billion-worth of transactions in the first quarter of the year. Besides purchasing from other dotcoms, you can pay your taxes in York County, South Carolina or send a donation to the Pat Brody Shelter for Cats in Lunenburg, Massachusetts. PayPal also does gift vouchers. The payment mechanism is simple enough. Newcomers to PayPal provide details of a credit card or bank account. These are verified with a nominal transaction. Thereafter, a buyer can e-mail a payment directly to a seller. This is immediately debited from the buyer's credit card or bank account, and a credit is made to the seller's PayPal account. Money in a PayPal account can be withdrawn by cheque or transferred to a bank account. Individuals and small traders can receive credit-card payments without obtaining a merchant account. PayPal's cut comes from charging recipients between 2.2% and 3.4%, depending on the country, and levying fees for currency conversions. In the first quarter of 2004, PayPal's revenues were $155m, 69% more than a year before. PayPal has helped slash the time internet users spend completing transactions and has greatly increased confidence in trading online, says Matthew Bannick, the company's general manager of global payments. It can take several weeks for cheques to arrive in the post and for payments to clear, but online payments are made instantly, which means goods can be shipped straight away. "It has improved the velocity of trade," adds Mr Bannick. Another benefit, he says, is that buyers do not have to impart banking or credit-card information to merchants. Security remains the prime concern of internet shoppers. An NOP survey that PayPal commissioned in Britain, where the company opened its first overseas site last year, found that more than one-third of internet users are reluctant to spend more than #50 ($90) online. To overcome their concerns, payment protection is now offered in America (up to $500) and in Britain (up to #250) on goods sold by eligible traders (those who have built up good reputations within eBay's ranking system). This now covers more than 60% of all listings on eBay's American site. PayPal wants to expand internationally, to continental Europe and Asia. Although it has not said so, the likeliest next local site is Germany; China, eBay's fastest-growing market, looks like a good long-term possibility. Such growth will bring new challenges. People in different countries favour different ways of making payments offline: the French like cheques, for instance; in Germany, bank transfers are common. This might translate into different online habits. Countries also regulate financial services differently. PayPal has no plans, though, to become a bank, even though it performs some similar functions. Customers in America can earn interest on their PayPal balances by allowing PayPal to place the funds in a pooled savings account or by enrolling into PayPal's money market fund. It has been licensed as a money-transmitter in American states and in Britain. Regulation as a bank would require more costly and complicated compliance. Nevertheless, the company has faced regulatory challenges, not least because it could be used for the illicit transfer of funds. Soon after it acquired PayPal, eBay ended its services to online gambling merchants because of complaints from federal prosecutors that this violated America's Patriot Act, which Congress passed after the September 11th terrorist attacks to harden money-laundering rules. Last year, eBay paid $10m to settle the charges. Because most of its payments are small, big sums stand out. This should help PayPal comply with the authorities. Now it is interested in handling even smaller amounts. Late last year it introduced lower processing fees for micro-payments, to make it more feasible for online merchants to accept tiny payments for digital-music downloads. The success of portable music players, such as Apple's iPod, suggest that this too will be big online business. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Weblinks sponsors the Senior National Cricket Team Uniforms
by R. A. Hettinga 20 May '04

20 May '04

<http://www.radioaxa.com/local_news.htm#locnews2> Radio Anguilla Thursday, 20 May, 2004 12:23 PM Weblinks sponsors the Senior National Cricket Team Uniforms Anguilla's newly formed Telecommunications Company Weblinks, has taken the initiative to sponsor a number of uniforms for the Anguilla Senior National Cricket team. The National team will participate in the Leeward Islands Cricket Tournament - slated to begin on May 28. Speaking during a presentation ceremony and cocktail last night at Paradise Cove Resort, President of the Anguilla Cricket Association Mr Gerard Gumbs underscored the importance of the development of society through sports. "I am proud to say that as local Anguillians, they have seen the need to contribute further to the development of the Anguillian society by contributing wholeheartedly to the sponsorship of the uniform for the local Cricket Team. These guys are truly Anguillians at heart who believe they can make a difference in helping to nurture a good society through their contribution to the sport of Cricket. Let us not underestimate the value that playing sports has on the lives of our people, especially our young people. Sports is still today, an aspect of our life that calls for tremendous personal discipline, on and off the field of play. If you check professional sportsmen, most of them talk about being role models within their community and giving back to their communities. It is through efforts such as this sponsorship that we here in Anguilla can mold young people into productive men and women, as interaction through sports helps to build character, respect and discipline." President of the Anguilla Cricket Association Mr Gerard Gumbs. In making the presentation, Weblinks representative, Mr Kennedy Hodge stated that he hopes Weblinks will someday be able to provide sponsorship for all expenses of the National Team. The Company has this year provided team members with three warm up t-shirts, playing shirts, warm up pants and a travelling shirt. Weblinks is a locally owned and based company that has been in operation since late 1999. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: IRS May Help DOD Find Reservists
by Major Variola (ret) 20 May '04

20 May '04

At 04:11 PM 5/18/04 -0700, Bill Stewart wrote: >At 12:49 PM 5/18/2004, R. A. Hettinga wrote: >> >> FORT WORTH, Texas - The Defense Department, strapped for troops for >>missions in Iraq and Afghanistan, has proposed to Congress that it tap the >>Internal Revenue Service to locate out-of-touch reservists. >> > >Wow! It was "EXAMINED BY LAWYERS!" That's almost as reassuring as >saying it was "Generated by a Computer"! :-) >There's a wide range in the types of methods they could use >to find this information, some of which are the camel's nose in the tent >and others of which are half the camel, but all of which are pretty much bad. On the positive side, the inconvenience to the now pudgy, middle-class vets will increase resistance to the colonialism. >I'm *not* a veteran (I was 1H in the last draft lottery), Perhaps you were in those BZ experiments and have forgotten.. >address of my neighbor's legality-challenged son, and getting it wrong, >which led to the police pounding on my door at 6am with a warrant. Good thing that claymore was being rewired, eh? :-)

1 0

[David_Heinrich@urmc.rochester.edu: [mises] praxeology and game theory]
by Gabriel Rocha 20 May '04

20 May '04

possibly of interest to some here... ----- Forwarded message from Pro-Choice <David_Heinrich(a)urmc.rochester.edu> -----

1 0

New biometric approach secures ID cards
by R. A. Hettinga 20 May '04

20 May '04

<http://www.newscientist.com/news/print.jsp?id=ns99995010> New Scientist New biometric approach secures ID cards 19:00 19 May 04 Exclusive from New Scientist Print Edition. Subscribe and get 4 free issues. A novel biometric identification system could counter many of the objections to ID card schemes such as the one being proposed by the UK government. The system can unequivocally link a person to a particular ID card without having to match their biometric characteristics to data stored either on the card or on a central database. A biometric is a unique measure of some facet of a person's body - such as a fingerprint or an iris scan. By 2005, the International Civil Aviation Organisation wants such data incorporated in newly issued passports. And the UK government wants it in ID cards from 2007. The information will also be stored on databases. A person enrolling into a biometric scheme based on iris recognition first has to peer into an infrared scanner which records an image of one of their irises. This is then processed to convert it into a string of digits - that person's "biometric reference template". This is obtained by dividing the image into hundreds of squares and measuring the light intensity in each one. This is then stored on a central database, as in the proposed UK system, or on the individual's ID card. Sufficiently similar Later, when that person needs to prove their identity, a fresh scan is taken and processed, and the resulting data is matched to the stored reference template. If the two are sufficiently similar, the ID is authenticated. An exact match is not required, because there are always likely to be some differences between scans, caused by variations in measurement conditions, like lighting. The danger, security experts say, is that if someone's reference template were to be captured it could be used illicitly. For example, a criminal could simply send the template to a service provider such as a bank as if it had originated from a scanner. Now Gavan Duffy of Generics Group, based in Cambridge, UK, has devised a technique that avoids any need to store the biometric reference template. It relies on a statistical trick that removes the variability in the results when an iris or fingerprint is scanned. "We're enhancing its stability," Duffy says. String of digits In conventional systems, when an iris image is divided into a grid and converted into a string of digits, the values stored for the brightness vary within a range. Problems occur when the brightness value falls close to a threshold between two levels. This makes it likelier that during one scan it will fall short of this threshold, while under different lighting conditions it might rise far enough to put it in a different range. For example, if the scale of light intensities is from 0 to 10, a reference reading in a certain grid square might be 3.9. This would normally be rounded down to a 3. But in a later scan, that grid point might be measured as high as 4.1 and so be recorded as a 4, creating a mismatch between the scanned template number and the reference template number. Generics' trick is to remove this uncertainty by providing an "offset" value for each data point in the grid. Each offset value is chosen so as to shift the value of the original scan to the middle of its range. In the above example, the grid square would have an offset of 0.4 assigned to it, to shift the reading of 3.9 to the middle of its range, which is 3.5. If a later scan happened to produce a reading of 4.1, applying the offset it would bring it down to 3.7, which would be recorded as a 3, just as in the reference. "We can, with high reliability, generate the same number," says Duffy. Irreversibly encrypted Because the scan gives the same result time after time, the reference template can be combined with data recorded on the card to create a "digital signature" unique to the user. By irreversibly encrypting this signature it is possible to ensure that the biometric data is unrecoverable and not open to misuse. The offset data is stored on the card, unencrypted, as it is no use to anyone but the owner. When someone needs to prove who they are, a reader combines the scan with the offsets to make a template. This is then combined with the personal data on the card to produce a fresh signature. If the user is genuine, the new signature should be a perfect match for the stored one. Privacy campaigners are guardedly impressed: "This looks like a good solution. They are just storing information that needs the iris or fingerprint to be present for the offset information to be any use," says Ian Brown, of the Foundation for Information Policy Research. Though he stresses FIPR is opposed to ID cards, he says Generic's scheme seems to be a lesser evil. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Re: [p2p-hackers] Onion Routing Economy
by R. A. Hettinga 20 May '04

20 May '04

--- begin forwarded text

1 0

Yahoo releases internet standard draft for using DNS as public key server
by R. A. Hettinga 20 May '04

20 May '04

--- begin forwarded text

1 0

Re: ID Pass? But I Am Mayor..
by Major Variola (ret) 20 May '04

20 May '04

At 11:47 AM 5/19/04 -0400, R. A. Hettinga wrote: >Bournemouth-born Mrs Rey, 47, said: "I'd have thought going in my robes, >wearing my chains and going with the mace-bearer would be enough." I don't think that wearing your S & M gear reduces your security risk...

1 0

Re: al-qaeda.net node downtime
by Major Variola (ret) 20 May '04

20 May '04

At 05:18 AM 5/18/04 -0400, Riad S. Wahby wrote: >I'm moving from Massachusetts to Texas, and unfortunately that means Congrats on being able to exercise your 2nd amendment rights a little bit more..

2 1

Yahoo releases internet standard draft for using DNS as public key server
by lynn.wheeler＠firstdata.com 20 May '04

20 May '04

yahoo draft internet standard for using DNS as a public key server http://www.ietf.org/internet-drafts/draft-delany-domainkeys-base-00.txt misc past news refs: http://docs.yahoo.com/docs/pr/release1143.html http://blogs.ittoolbox.com/linux/technologist/archives/000241.asp http://www.computerweekly.com/Article127082.htm http://zdnet.com.com/2100-1104_2-5164279.html http://www.ecommercetimes.com/perl/story/32995.html a few past threads on using DNS as a public key server http://www.garlic.com/~lynn/aadsmore.htm#pkiart2 Public Key Infrastructure: An Artifact... http://www.garlic.com/~lynn/aepay4.htm#comcert2 Merchant Comfort Certificates http://www.garlic.com/~lynn/aepay4.htm#comcert4 Merchant Comfort Certificates http://www.garlic.com/~lynn/aepay6.htm#gaopki4 GAO: Government faces obstacles in PKI security adoption http://www.garlic.com/~lynn/aadsm8.htm#softpki2 Software for PKI http://www.garlic.com/~lynn/aadsm8.htm#softpki10 Software for PKI http://www.garlic.com/~lynn/aadsm8.htm#softpki11 Software for PKI http://www.garlic.com/~lynn/aadsm8.htm#softpki12 Software for PKI http://www.garlic.com/~lynn/aadsm8.htm#softpki14 DNSSEC (RE: Software for PKI) http://www.garlic.com/~lynn/aadsm8.htm#softpki16 DNSSEC (RE: Software for PKI) http://www.garlic.com/~lynn/aadsm9.htm#cfppki5 CFP: PKI research workshop http://www.garlic.com/~lynn/aadsm15.htm#28 SSL, client certs, and MITM (was WYTM?) http://www.garlic.com/~lynn/aepay10.htm#31 some certification & authentication landscape summary from recent threads http://www.garlic.com/~lynn/aepay10.htm#81 SSL certs & baby steps http://www.garlic.com/~lynn/aepay10.htm#82 SSL certs & baby steps (addenda) http://www.garlic.com/~lynn/aepay11.htm#37 Who's afraid of Mallory Wolf? http://www.garlic.com/~lynn/2000e.html#40 Why trust root CAs ? http://www.garlic.com/~lynn/2001c.html#8 Server authentication http://www.garlic.com/~lynn/2001c.html#9 Server authentication http://www.garlic.com/~lynn/2001d.html#36 solicit advice on purchase of digital certificate http://www.garlic.com/~lynn/2001d.html#41 solicit advice on purchase of digital certificate http://www.garlic.com/~lynn/2001e.html#26 Can I create my own SSL key? http://www.garlic.com/~lynn/2001e.html#40 Can I create my own SSL key? http://www.garlic.com/~lynn/2001e.html#46 Can I create my own SSL key? http://www.garlic.com/~lynn/2001g.html#2 Root certificates http://www.garlic.com/~lynn/2001g.html#19 Root certificates http://www.garlic.com/~lynn/2001h.html#3 PKI/Digital signature doesn't work http://www.garlic.com/~lynn/2001m.html#37 CA Certificate Built Into Browser Confuse Me http://www.garlic.com/~lynn/2001n.html#57 Certificate Authentication Issues in IE and Verisign http://www.garlic.com/~lynn/2002e.html#56 PKI and Relying Parties http://www.garlic.com/~lynn/2002m.html#64 SSL certificate modification http://www.garlic.com/~lynn/2002m.html#65 SSL certificate modification http://www.garlic.com/~lynn/2002p.html#18 Cirtificate Authorities 'CAs', how curruptable are they to http://www.garlic.com/~lynn/2002p.html#19 Cirtificate Authorities 'CAs', how curruptable are they to http://www.garlic.com/~lynn/2003l.html#36 Proposal for a new PKI model (At least I hope it's new) http://www.garlic.com/~lynn/2003l.html#43 Proposal for a new PKI model (At least I hope it's new) http://www.garlic.com/~lynn/2003l.html#51 Proposal for a new PKI model (At least I hope it's new) http://www.garlic.com/~lynn/2003l.html#53 Proposal for a new PKI model (At least I hope it's new) http://www.garlic.com/~lynn/2003l.html#60 Proposal for a new PKI model (At least I hope it's new) -- Internet trivia, 20th anv: http://www.garlic.com/~lynn/rfcietff.htm --- end forwarded text -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0