- cypherpunks-legacy - lists.cpunks.org

Big Brother moves to Oregon
by Alan Olsen 17 Dec '03

17 Dec '03

Here is something you may not have heard about. The new drivers licences in the state of Oregon have a digital picture on them. You get one on your licence and the state keeps on on file. Any time the police need to pull up information on you, your picture comes up along with it. (The police are supposed to have this capability in their vehicles any day now, if not already.) This plan is being put into place as fast as they can and over 70+ million over budget. (They expect to have all of the Department of Motor Vehicles offices hooked up in a couple of months.) And the "Drivers Licence Number" has been replaced with a "Customer Number". (Had to have a bit of newspeak creep in there somewhere I guess...) Oregon used to be a nice place to live. Lately they have been the experementing ground for some of the most draconian laws in the country. "Welcome to the New Global Village. You are Customer Number 6." --- | "Spam is the Devil's toothpaste!" - stuart(a)teleport.com | |"The moral PGP Diffie taught Zimmermann unites all| Disclaimer: | | mankind free in one-key-steganography-privacy!" | Ignore the man | |`finger -l alano(a)teleport.com` for PGP 2.6.2 key | behind the keyboard.| | http://www.ctrl-alt-del.com/~alan/ |alan(a)ctrl-alt-del.com|

2 1

RE: permanent invasion of privacy
by blanc 17 Dec '03

17 Dec '03

From: attila In his Society essay, Lykken writes, "I will testify in support of a parental licensure bill to be introduced at the next session of the Minnesota State Legislature. ........................................................... Someone needs to remind this Senator Lykken what happened in Romania, when the beleaguered citizen-units finally took their 'noble', social engineering leader Ceausescu, put him up against a wall and shot him. History could repeat itself. Ah well, but really the most that this proposed bill would accomplish would be a lot of discussion and a lot of attention being brought to the general awareness about where individuals stand relative to their *elected* government (in 4 years - out!). Can you imagine the usenet discussions . . .all over the world. You know, he could be doing everyone a favor by inciting fury in the savvy masses who would, in the process of complaining, educate the ignorant ones about the ethics of social engineering and the precautions against it, as well as about the character of people like this Senator. A problem can be an opportunity in disguise! .. Blanc

3 2

File vs. Communication Key Escrow
by Douglas Barnes 17 Dec '03

17 Dec '03

Jumping on the bandwagon a bit here... Walt makes a plausible business case for key escrow for software that encrypts static information for archival purposes. Has anyone been able to come up with a good business case for key escrow of communications keys? Note that if you're concerned about communications history, that this is really just a special case of static information that is archived. Note that all key escrow proposals to date have focused almost entirely on "escrow" of keys used in communication. The recent attempts to manufacture a business case for this by confusing these two very different situations is part of the tactics we have come to expect from the government when dealing with this issue. If anything good can be said about the badly written, vague and clearly unconstitutional new regulations from the Department of Commerce, it's that they're less mealy-mouthed and weasling than previous attempts to explicate the government position on cryptography. At 11:23 PM 12/16/96 -0800, stewarts(a)ix.netcom.com wrote: >Walt Armour <walt(a)blarg.net> wrote: >> If I encrypt a $10 million dollar proposal and then get 86'd in >> a car accident I would like to go to my grave knowing that the >> company could get the proposal back. .... > >Anyone who stores a $10m proposal on only one machine, >without making backups on somebody else's machine, preferably >out of the building, is asking for the Clue Fairy to send him >disk drive gremlins and software from Bill Gates to scribble on his disk, >and his company should probably consider 86ing him before he >strikes again :-) > >Slightly more seriously, there are certainly corporate reasons to >store backups of keys for important data, such as backup tapes >and communications. GAK-style technology is the wrong level approach >for communications - GAK-style access to keys is useless unless >you've also backed up the data, so if your corporate officers need >the data, give it to them encrypted with their own keys. >Similarly, if you want backup access to keys used to encrypt files, >back up the keyrings, maybe using a secret-sharer if you want to require >multiple people to access the backup, or just have the backups of >the files encrypted with the keys for the backup server. > >> BUT in regards to the general populace, I do not advocate any form of >> key escrow/recovery. > ># Thanks; Bill ># Bill Stewart, +1-415-442-2215 stewarts(a)ix.netcom.com ># You can get PGP outside the US at ftp.ox.ac.uk ># (If this is posted to cypherpunks, I'm currently lurking from fcpunx, ># so please Cc: me on replies. Thanks.) > >

1 0

Re: Hard to Tax Scenario
by reinhold＠world.std.com 17 Dec '03

17 Dec '03

Re: Hal Finney's exegesis on Robin Hanson's scenario of Ann, virtual MD >On the other hand, if tax evasion is nearly universally practiced, >perhaps there are strong cultural pressures against turning someone in. > On the contrary, in a world of anonymous payments and nyms, there is a significant value for connecting nyms and true names and, hence a thriving market in any information that might lead to a connection. Bounty hunters maintain an ongoing lifestyle analysis on every true person. Hot lists of people whose visible consumption and reported work don't jive circulate widely. Ann can't walk down the street in a new pair of shoes without 5 people sending in an mpeg to claim the micro-payment. And she lives in terror as she watches the offer price for info about her rise. By the way, as a covert MD with a receptionist cover, whom does she date? Arnold Reinhold

2 1

TIS_sue
by John Young 17 Dec '03

17 Dec '03

12-16-96: "TIS' Key Recovery Technology First To Enable General Purpose Export For Very Strong Encryption" In a development that may signal the beginning of the end of the long standing encryption export control controversy, TIS today announced that products using very strong cryptography with its RecoverKey technology have been approved for general purpose export control under new export regulations. "Encryption - BSA tries new lobbying tack" BSA intends to abandon its efforts to negotiate with the Clinton administration on encryption export rules and will instead lobby Congress for new legislation. The best hope lies with Rep. Bob Goodlatte who plans to reintroduce a House bill proposing the relaxation of controls at the next session next month. "U.S. Emissary on Cryptography to Keynote RSA Data Security Conference" "The RSA Conference is an opportunity for me to provide some insights on my mission which includes fostering a consensus on the development of an international key management infrastructure," said Ambassador Aaron. "Pretty Darn Private" PGP last week unveiled PGP Cookie Cutter, a browser plug-in that lets users selectively block Web "cookies." "Smart card-PC standard proposed" The eight documents of the joint specifications address three major areas: They provide an interface to card readers; establish a common programming interface and control mechanism; and maintain compatibility with existing devices, leveraging the ISO structure that has been set in place over the past decade. Information is available on the Web at www.smartcardsys.com. "Web Service Provider Attacked" A SYN-flood attack against WebCom knocked out more than 3,000 Web sites for 40 hours this weekend during the busiest shopping season of the year. ----- TIS_sue (19 kb)

5 6

UPDATE: Financial Cryptography 1997 (FC97), Anguilla, BWI
by Robert Hettinga 17 Dec '03

17 Dec '03

Financial Cryptography 1997 (FC97): The world's first financial cryptography conference, workshop, and exhibition. CONFERENCE UPDATE: December 13, 1997 (The Banker's Edition...) FC97 is sponsored by: The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> FC97 Conference and Exhibition, February 24-28, 1997 FC97 Workshop for Senior Managers and IS Professionals February 17-21, 1997 The Inter-Island Hotel Anguilla, BWI Conference Reservations: <http://www.offshore.com.ai./fc97/> As previously announced, the world's first peer-reviewed conference on financial cryptography, FC97, will be held Monday through Friday, February 24-28, 1997, from 8:30am until 12:30pm, at the Inter-Island Hotel on the Carribbean island of Anguilla. In conjunction with the conference, the Inter-Island Hotel will also be the site of an intensive 40-hour workshop for senior managers and IS professionals during the week preceding the conference (February 17-21), and an exhibition for financial cryptography vendors, from 10am-6pm during the week of the conference itself. The goals of the combined conference, workshop, and exhibition are: -- to provide a peer-reviewed forum for important research in financial cryptography and the effects it will have on society, -- to give senior managers and IS professionals a solid understanding of the fundamentals of strong cryptgraphy as applied to financial operations on public networks, and, -- to showcase the newest products in financial cryptography. In addition, plenty of time has been left open in the afternoon and evening for sponsored corporate functions and activities, for business networking, and, of course, for recreational activities on Anguilla itself. Conference participants are encouraged to bring their families. The Conference Ray Hirschfeld, the conference chair, has picked an outstanding group of professionals and researchers in financial cryptography and in related fields to review the papers for this conference. They are: Chairman: Rafael Hirschfeld, CWI, Amsterdam, The Netherlands Matthew Franklin, AT&T Laboratories--Research, Murray Hill, NJ, USA Michael Froomkin, U. Miami School of Law, Coral Gables, FL, USA Arjen Lenstra, Citibank, New York, NY, USA Mark Manasse, Digital Equipment Corporation, Palo Alto, CA, USA Kevin McCurley, Sandia Laboratories, Albuquerque, NM, USA Charles Merrill, McCarter & English, Newark, NJ, USA Clifford Neuman, Information Sciences Institute, Marina del Rey, CA, USA Sholom Rosen, Citibank, New York, NY, USA Israel Sendrovic, Federal Reserve Bank of New York, New York, NY, USA Some of the names may be recognizable to you. If they're not, included in that list are the inventor of Millicent, the project manager of EU's CAFE digital cash project, the holders of Citicorp's digital cash patent, two famous scholars in cryptography and digital commerce law, the President of International Association for Cryptologic Research, and the Chairman of the Taskforce on the Security of Electronic Money for the G-10 Central Banks. The actual agenda of the conference will be determined by the papers the program committee selects, so we won't have a final schedule for the conference until the middle of January. However, the conference committee is selecting papers in what it considers the union, and not the intersection, of the fields of finance and cryptography. The Final Call for Papers was issued a few weeks ago, and the submission process for papers is now closed. The committee chairman sends his thanks to all of you who submitted papers for consideration. Given the volume of submissions, and the quality of the authors, this inaugural conference should be a very interesting one indeed. To refresh your memory, the program committee solicited papers in the following topic areas: Anonymous Payments Fungibility Authentication Home Banking Communication Security Identification Conditional Access Implementations Copyright Protection Loss Tolerance Credit/Debit Cards Loyalty Mechanisms Currency Exchange Legal Aspects Digital Cash Micropayments Digital Receipts Network Payments Digital Signatures Privacy Issues Economic Implications Regulatory Issues Electronic Funds Transfer Smart Cards Electronic Purses Standards Electronic Voting Tamper Resistance Electronic Wallets Transferability Financial Cryptography '97 is held in cooperation with the International Association for Cryptologic Research. The conference proceedings will be published on the web by the Journal for Internet Banking and Commerce. <http://www.arraydev.com/commerce/JIBC/>. For further information on the submission process, which is, again, now closed, please see the program committee's web-page at <http://www.cwi.nl/conferences/FC97>. As we mentioned before, the conference will be covered by Wired Magazine, and will be the featured conference in it's January 1997 "Deductible Junkets" section. So, if you have already decided to come to FC97, please register and make your plane and hotel reservations as soon as possible. Conference, workshop, and exhibit space is extremely limited. Wired's January issue comes out near the end of December, and we expect there to be something of a rush at that time. The price of a pass to the conference sessions and exhibits is $1,000 U.S. You can pay for your FC97 conference ticket with Visa or MasterCard at the regstriation site: <http://www.offshore.com.ai/fc97/> The price includes breakfast at the conference, some stipends for presenters who need them, and the logistics of having a professional conference with high-bandwidth internet connectivity in a location like Anguilla. In looking around, however, the conference organizers *did* notice that FC97 price is in keeping with other business and professional technology conferences of similar total session length. You can register, and pay for, your conference ticket at: <http://www.offshore.com.ai/fc97/> The Exhibition Concurrent with the conference will be the the FC97 Exhibition, a small trade show for financial cryptography products and services. Each booth will have high bandwidth access to the internet, and will get 2 conference passes. Booth prices start at $5,000 US. Please contact Julie Rackliffe at <mailto: rackliffe(a)tcm.org> for further information . As space is limited, please register as soon as possible if you plan to be there. The Workshop We are especially honored to have Ian Goldberg as the leader of the FC97 Workshop, which will run one week prior to the conference, February 17-21, 1997. Ian, the cryptographer at Berkeley who was made famous last year (in articles in both the Wall Street Journal and the New York Times) for breaking Netscape's transaction security protocols, will be running an intensive, 5-day workshop for senior managers and technology professionals. Someone likened it to a financial cryptography "boot-camp". While the workshop is still being developed, and will depend on the skills of the planned participants, workshop topics will include, but not be limited to: Overview and background of cryptography Survey of existing and proposed Internet payment systems Details on some specific payment systems Issues involved in setting up a secure Internet site A step-by-step walkthrough of setting up an ecash-enabled Web server. Ian has recruited a strong roster of instructors with credentials similar to his own, and, as he plans to maintain a 5-1 student/teacher ratio, the size of the workshop will be restricted and advance registration will be required. Further information about the workshop can be found at: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> The planned price for the workshop is $5,000. This covers lab space, hardware, network access, software, and, of course, 40 hours of instruction and structured lab activity. The lab itself will be open 24 hours a day, if demand warrants it. Sponsorship Opportunities FC97 offers sponsorship opportunities at all levels. Corporations are encouraged to to be an exclusive sponsor for lunch or dinner, each of which will be followed by a recreational activity of some kind. Sponsors will have the opportunity to permanently attach their name to these networking functions, which the organizers hope will be a large part of the conference experience. There are 10 such events being planned, and 10 corporations will be accepted for sponsorship. Corporate sponsors of these events will also get a substantial initial discount on exhibit space, and complimentary conference tickets. In-kind sponsorship is also available at all levels of support, with opportunities for companies to provide networking, bandwidth, hardware, radio pocket modems and equipment, as well as design and print services, transportation, and other things. If you've got it and you think we'll need it, please contact us. The sponsorship contact is Julie Rackliffe <mailto: rackliffe(a)tcm.org>. Air Transportation and Hotels Air travel to Anguilla is typically done through San Juan, St. Thomas or St. Maarten/Martin. There are several non-stop flights a day from various US and European locations. Connection through to Anguilla can be made through American Eagle, or through LIAT. See your travel agent for details. American Eagle Airlines has agreed to increase their flights as needed to accomodate any extra traffic the conference brings to the island. Anguilla's runway is 3600 feet, with a displaced threshold of 600 feet, and can accomodate business jets. Obviously, you should talk to your aviation staff for details about your own aircraft's capabilities in this regard. Anguilla import duties are not imposed on hardware or software which will leave the island again, so, as long as you take it with you when you leave, you won't pay import duties. Hotels range from spartan to luxurious, and more information about hotels on Anquilla can be obtained from your travel agent, or at <http://www.offshore.com.ai/fc97/>. Registration for FC97 Again, to register and pay for your ticket to FC97 see: <http://www.offshore.com.ai/fc97/> For information the selection of papers for at FC97 see: <http://www.cwi.nl/conferences/FC97> If you're interested in Exhibit space, please contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in sponsoring FC97, also contact Julie Rackliffe: <mailto:rackliffe@tcm.org> If you're interested in the FC97 Workshop for Senior Managers and IS Professionals, see: <http://www.cs.berkeley.edu/~iang/fc97/workshop.html> That should be enough for now. Stay tuned for more information on FC97 as it develops. See you in Anguilla! The FC97 Organizing Committee: Vince Cate and Bob Hettinga, General Chairs Ray Hirschfeld, Conference Chair Ian Goldberg, Workshop Chair Julie Rackliffe, Conference, Exhibit, and Sponsorship Manager And our sponsors... The Journal for Internet Banking and Commerce <http://www.arraydev.com/commerce/JIBC/> Offshore Information Services <http://www.offshore.com.ai/> e$ <http://www.vmeng.com/rah/> ----------------- Robert Hettinga (rah(a)shipwright.com) e$, 44 Farquhar Street, Boston, MA 02131 USA "The cost of anything is the foregone alternative" -- Walter Johnson The e$ Home Page: http://www.vmeng.com/rah/

1 0

Re: Securing ActiveX.
by Phillip M. Hallam-Baker 17 Dec '03

17 Dec '03

Bill Frantz <frantz(a)netcom.com> wrote in article <59721c$t8o(a)life.ai.mit.edu>... > At 7:19 AM -0800 12/17/96, Blake Coverett wrote: > >I would be happier running an ActiveX control with Peter Trei's signature > >on it > >than I would an unsigned control in a sandbox. (This kind of a trust decision > >is probably the normal case in the intranet world. ActiveX as it sits is > >quite > >sufficient for rolling out internal intranet applications.) > > While I might agree about Peter, I wouldn't agree if the signature was > Microsoft's (or any other large software vendor). There is just too much > room for bugs and or Trojan horses to enter via that route. I fail to see what the fuss is about. there are clearly advantages to having a good operating system architecture which provides protection for running applications and allows fine grained control over access to sensitive resources. The problem with the Java Sandbox model is that its all or nothing. In order to protect the user it allows the applet access to nothing that is important. As a result the applet can perform no function that is of importance. "Give us your corporate strategy and billing record and we will give you dancing beans on your screen" as one wag put it. I am still waiting to see a Java applet that does anything usefull. Most do no more than an animated gif would. The most elaborate are little more than carbon copies of the standard computer games. The download problem really is not that hard. The big problem is content. So far nobody appears to have the remotest idea how to use Java and I expect it to be about five years before the model emerges. From hypercard to the Web took ten so don't expect it to be overnight. The Microsoft bashing could be given a rest. Bill G. wins only because the rest of the market gave up. Stick a non computer litterate person in front of UNIX, Lotus 1-2-3 for MS Dos or Wordperfect for MS-Dos. If you don't realse then why Bill won you should try another career. MS-DOS and Windows are crappy O/S because they lack the type of memory protection that VMS and UNIX have. This was in part incompetence but mostly Intels disastrous design for the 80286. Meanwhile Apple managed to produce an inexcusably bad O/S without protection on a chip that had excelent provision for it. If you want your applet to do anything of use then the Java security model is inadequate. It is usefull for the software developer to have a rich security model since it makes it much easier to build secure software. Under VMS there are 32 different priviledges allowing fairly fine grained control. It is possible in some cases to access a wider range of resources by nafarious tricks but its hard to do something bad by accident. Phill

1 0

Van Eck's TEMPEST Paper
by John Young 17 Dec '03

17 Dec '03

As a supplement to Joel McNamara's exemplary new TEMPEST page, and thanks to Steve Schear, we've put Van Eck's 1985 paper on TEMPEST at: http://jya.com/emr.pdf (702 kb) It's a finely detailed paper on EMR snooping with copious graphics. As Joel and Seline note, it may be purposely misleading on TEMPEST, (as appropriate to TEMPEST legends; Seline's may be bent as well, but who knows what the disinfoes know). Read Joel's page for the bright light facts.

1 0

Re: Ping of Death?
by ! Drive 17 Dec '03

17 Dec '03

read about it here http://www.sophist.demon.co.uk/ping/ At 02:39 PM 12/17/96 -0700, you wrote: >Anyone heard of the Ping of Death, aka the Ping Bomb. It's a large chunk of >hostile code, disguised as a mere ping, that can lead to server rebooting. > >James Glave > >Technology Assignment Editor, Wired News, http://www.wired.com/ >Producer, Packet, http://www.packet.com/ >Phone: 1.415.276.8455 >Fax: 1.415.276.8499 ------------------------------------ pgp KeyID 3D932EA9 pub key available via mailto:pgp-public-keys@keys.pgp.net subject: get drink(a)aa.net

1 0

Computer crime prompts new parole restrictions
by Lile Elam 17 Dec '03

17 Dec '03

Hi all, I saw this article in the nando.net paper today and was interested in your thoughts on it. It looks like people on probation will be limited in there use of encryption and access to the Internet. To me, it seems like this could be equated to preventing people on probabtion from using something like a phone. I am having problems with it because I feel these limitations are too severe. I mean, a good way someone on probabtion to make a living is to learn how to use the web and prehaps get a job as a html coder. There is a hacker I know of (Kevin Poulsen) who is prevented from using computers during his current probation and it really has limited his options alot. I curated and maintain a website for him at URL: http://www.catalog.com/kevin/ where this issue is dicussed. It also seems to me that preventing people on probation from using encryption would be difficult especially when encryption is used in webservers (ie Netscapes Secure Server). One could accidentally access one and not know that he was sending/receiving information via an encrypted channel. thanks, -lile http://www.nando.net/newsroom/ntn/info/121796/info1_7523.html ---------------------------------------------------------------------------- Computer crime prompts new parole restrictions ---------------------------------------------------------------------------- Copyright © 1996 Nando.net Copyright © 1996 The Associated Press WASHINGTON (Dec 17, 1996 07:42 a.m. EST) -- The U.S. Parole Commission has approved restrictions on the use of computers by certain high-risk parolees. The Justice Department announced Monday that the panel voted this month to authorize such restrictions as requiring certain parolees to get prior written approval from the commission before using an Internet service provider, computerized bulletin board system or any public or private computer network. Other restrictions would: prohibit particular parolees from possessing or using data encryption programs, require some parolees to agree to unannounced inspection of computers by probation officers, require some parolees to compile daily logs of computer use or to pay for equipment to monitor their computer use. "Unrestricted access to the Internet and other computer online services can provide sophisticated offenders with new opportunities for crime and criminal associations," said Edward F. Reilly Jr., commission chairman. "We cannot ignore the possibility that such offenders may be tempted to use computer services to repeat their crimes." The commission noted a surge in "how-to" information on child molestation, hate crime and the illegal use of explosives available on the Internet and on computer online services. Copyright © 1996 Nando.net Do you have some feedback for the Nando Times staff?

1 0