- cypherpunks-legacy - lists.cpunks.org

What are the flaws with FV payment system?
by Kip DeGraaf 17 Dec '03

17 Dec '03

I only received this an hour ago. I would very much like to attend, but can't put my fingers on the detailed analysis of FV's flaws in their system, which I would like to bring up in person at this seminar. Could someone please point me in the right direction? ---------- Forwarded message ---------- Date: Thu, 10 Oct 1996 09:51:56 -0400 From: Sue Davidsen <davidsen(a)umich.edu> To: michlib-l(a)mlink.hh.lib.umich.edu Subject: Seminar Announcement Commerce on the Internet 7:00 PM Thursday, October 10, 1996 Room N130 New Business Building, MSU Dr. Nathaniel Borenstein, Chief Scientist, First Virtual Holdings, Inc., is known worldwide as a leading developer of Internet technologies, including the MIME standard and the First Virtual Payment System. In this presentation on commerce on the Internet he will discuss: The limitations of current encryption schemes The technical aspects of the First Virtual payment scheme The future of commerce on the Internet Dr. Borenstein contributed to the development of numerous Internet technologies including the MIME standard (used for email attachments and Web content typing), Andrew, metamail, ATOMICMAIL, and Safe-Tcl. Dr. Borenstein devised the First Virtual payment system, a popular mechanism for conducting commerce on the Internet. [a lot of cute biographical details left out, I'm not impressed]

4 4

EUB Caution
by John Young 17 Dec '03

17 Dec '03

The Times [Of London] October 11, 1996 Investors cautioned over bank on Internet By Robert Miller The Bank of England has issued a blunt warning to UK investors to "think carefully" before handing over their money to an offshore bank that is advertising for depositors on the Internet. European Union Bank (EUB) is a tiny institution backed by American investors and based in Antigua. Until last month it was chaired by Lord Mancroft, 39, an Old Etonian. Lord Mancroft, who confirmed that he had met Michael Foot, the Bank's director of supervision, yesterday about EUB, said: "I understand their concerns." He added that his contract as chairman of EUB had expired last month. The sharp warning to UK investors from one of the Bank's most senior directors reflects the concerns of City watchdogs about the possible proliferation of financial services being offered on the Internet and which fall outside their regulatory scope. If any such firm failed investors would not be covered by the UK compensation schemes. The Bank said of EUB: "This bank is not authorised in the UK and has not sought authorisation. As with other offshore deposits we would advise intending depositors to carry out appropriate due diligence." [End]

1 0

Re: "Drift net fishing," GAK, FBI, and NSA
by azur＠netcom.com 17 Dec '03

17 Dec '03

>A clarification regarding something I wrote a few days ago: > >dlv(a)bwalk.dm.com (Dr.Dimitri Vulis KOTM) writes: >> Another possibility is to issue a charge card (payable in full at the end of >> the month, getting revenue from the annual fee), rather than a credit card, s >> it could claim not to be subject to certain Federal Reserve's regulations tha >> have to do with credit card disputes. But then it probably can't be Visa/MC a >> can't use their clearginhouses. > >A charge card (like the original AmEx, not like Optima) is not the same as >a debit card. I have a debit card, tied to my checking account, and using >mastercard's clearinghouse. To issue a debit card, the organization needs >to keep checking accounts. Even if it doesn't pay interest, doesn't make >commercial loans, etc, it still would be subject to weird Fed regulations >and probably couldn't maintain anonimity. > >But the lack of a dispite resolution mechanism is really the killer. > How about companies that issue credit cards, but don't extend credit? The kind customers must maintain a postive balance at all times in order to charge against their account. -- Steve

2 1

Binding cryptography - much work, little point ?
by peter.allan＠aeat.co.uk 17 Dec '03

17 Dec '03

Eric_Verheul writes: > In our scheme any third party, which is probably never a TRP, can check > equality of the sessionkeys send to the primary recipient (the TRP) and > the second recipient (the real adressee), i.e. *without* needing secret So could anyone anyway by asking the TRP. The TRP returns a Yes/No answer, withou disclosing the session key. Is your binding scheme motivated mainly by avoiding that workload on the TRP ? Or by the fact that everybody might prefer a different TRP ? I suspect the scheme is incomplete anyway. After skimming the web page I see that the aim is to show the same session key has been encrypted under different ElGamal pubkeys. Now who's to say those pubkeys belong to anyone ? Or is this what is meant by "such as Margaret's identity" ? You'd list the ids of the TRPs and also prove that the pubkeys used were theirs .... ? Now to the politics... E__Allen_Smith writes: > Quite simply, you've invented a system that makes censorship more > possible. As a scientist, I try to avoid areas that have such negative > effects The usual Big Problems for GAK 1) What's in it for the user ? 2) What happens when the Feds recover meaningless data ? 2 does not seem to be addressed except by proposing restrictions which Eric dismisses as follows: Adam Back: >system because their stated aims are untrue: they *do* want to outlaw >non-escrowed encryption for domestic US traffic, and they *do* want to Eric Verheul: > Who is they, governments as a whole? If you simplify discussions in this > way, I might as well say: "you guys only want to help criminals". I understand > your fears, but don't exaggerate. -- Peter Allan peter.allan(a)aeat.co.uk

2 1

Re: (2) LET'S MEET DIMITRI
by attila 17 Dec '03

17 Dec '03

In <Pine.SUN.3.91.961010143953.7428A-100000(a)crl.crl.com>, on 10/10/96 at 02:40 PM, Sandy Sandfort <sandfort(a)crl.com> said: . attila sez: . .> WOW! Dimitri as the featured roast, Dean Martin style, would be .> enough for me to seriously consider leaving my high desert Utah .> safe house! . .Will you pledge a few bucks, though? . after I figure out how to allocate the $400+ it takes to get out of here --the disadvantage of living nowhere: $119 each way just to deal with SLC for transfer plus SLC to SFO/SJO it's too late in the year to even consider crossing the sierras on my chopper, ...other than airplane, the sole means of transport. sold my category D twin tprop since I do not have a valid medical endorsement from the FAA or the required certified copilot for Cat II or IIIA landings if SFO is pure blind slop. so, it's commerical time. so far, being in the high desert away from population in an enclave of 100 families as ornery as I, has been a blessing. travel had become more than old. hopefully you can make this one hang together --particularly, if I can be the roastmaster --and choose the panel... <g>

1 0

RE: "Internet II" and Clinton
by Blanc Weber 17 Dec '03

17 Dec '03

From: Timothy C. May * a government attempt to reassert some sort of control over the Internet, a la the "we paid for the Arpanet, so we can control what it's used for." ................................................................ That's also what I've been thinking about, regarding the efforts to get all the schools wired. "It's our project and we can control it if we want to." I could almost paranoically get cause & effect confused, thinking that the program for free internet access is merely an excuse for assuming the control over the internet that the governors are aspiring to achieve, rather than it being merely a contingent consequence of their involvement with it. I deplore the fact that so many people are lured into signing up for internet access ( Hurry, Hurry, you don't know what you're missing on Usenet!!!) without being mentally prepared for what they can expect to see there. Then they must suffer the shock of realization of what is available, free & uninhibited. (Ooops. "They didn't tell us about *that* stuff being there, (whine) take it way!") But you just have to know that, once the governors decide to become the Determining Factor in setting up everyone for internet access, they will also become the determining factor in what everyone gets to see, and therefore gets to post or send through the channels. .. Blanc

1 0

Constitutional Convention
by azur＠netcom.com 17 Dec '03

17 Dec '03

Have any on the list been following ballot measures aimed at term limits? In Nevada, one of (I believe 45 states) with such initiatives on the November ballot, the measure seeks to limit some state offices and requires the state to call for a Consititutional Convention to limit terms of Federal Senators and Reps. If these pass we could be in for some wild times as every disaffected group (e.g., pro-life) seeks to codify new Amendments in agreement with their pet cause. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Re: Burma bans modems
by azur＠netcom.com 17 Dec '03

17 Dec '03

> UPI reports that in July a diplomat, Leo Nichols, died in prison > after he was sentenced to a lengthy term for illegal possession of > fax machines. > > It's clear from this action that the SLORC, i.e. the "State Law and > Order Restoration Committee" (sic!) understands full well the > benefits and importance of the Internet and other forms of > electronic communication to open societies, and is determined to > deny these benefits to its citizens. Given its recent history and > the quasi-imprisonment of Daw Aung San Suu Kyi, this new action is > perfectly consistent with the government's previous abysmal > record. > Look, look, up in the sky! Its a B2, not its an F-117, no it AP-man! The Great Mandala is in motion. Ladies and gentleman place your bets. PGP Fingerprint: FE 90 1A 95 9D EA 8D 61 81 2E CC A9 A4 4A FB A9 --------------------------------------------------------------------- Snoop Daty Data | Internet: azur(a)netcom.com Grinder | Sacred Cow Meat Co. | --------------------------------------------------------------------- Counter-cultural technology development our specialty. Vote Libertarian. Just say NO to prescription DRUGS. "Of all tyrannies, a tyranny sincerely exercised for the good of its victims may be the most oppressive." -- C.S. Lewis "Surveillence is ultimately just another form of media, and thus, potential entertainment." -- G. Beato

1 0

Swan song...
by Perry E. Metzger 17 Dec '03

17 Dec '03

Well, folks, after four or five years here, I'm finally leaving. I've picked this moment for two reasons. First, the signal to noise ratio here is now too low to be measured without expensive lab equipment -- as bad as Usenet, or even worse. Second, I now have two candidate sites to host a new cryptography & cryptography politics mailing list to replace this one. The new list will be run very tightly. Some people will doubtless label me a fascist and say I'm impinging on their ability to be "free". Those that feel that the best use of their freedom is to urinate into their own drinking water are entitled to their beliefs -- but they will not be welcome on the new list.* It is time to get back to cryptography. You all remember cryptography, don't you? Its the "cipher" in CYPHERpunk. Years ago, on cypherpunks, Phil Karn noted, after Stuart Baker of NSA named his nightmare vision of strong crypto embedded in every $20 phone and every fax machine, "Gentlemen, I believe we have our design specification." One cannot imagine that sort of thing being said here now. Four years ago, PGP 2.0 was released, and the first shot was sent across the bow of those that would stop us. It is more than time to fire off another round or two. Cypherpunks file lawsuits! Cypherpunks develop protocols! Cypherpunks write RFCs! Cypherpunks start companies! Cypherpunks WRITE CODE, damn it! Cypherpunks don't wait for the administration to move -- they move first! They move FASTER! Cypherpunks don't wait for someone else to deploy cryptography -- they deploy it themselves! Cypherpunks do not sit on their asses and pull their puds while discussing warmed over theories about personal freedom. Cypherpunks BUILD THE TOOLS TO IMPLEMENT THE THEORY! Cypherpunks don't fantasize, they create! In short, CYPHERPUNKS DO! They don't live for blather. Cypherpunks Mark I used to be a glorious place. Son of Cypherpunks may fail, but we must make the attempt to create it. In short, Cypherpunks is dead, Long live Cypherpunks! I will post pointers to the new list within ten days -- on or before October 20, 1996. Perry * Those that feel that peeing into their own drinking water is a good idea are directed to http://www.envirolink.org/orgs/coe/snuffit2/living_water.jpg and http://www.envirolink.org/orgs/coe/snuffit2/lifewater.html where you will find others who agree with you.

6 6

Re: exporting signatures only/CAPI (was Re: Why not PGP?)
by azur＠netcom.com 17 Dec '03

17 Dec '03

>Jim Bell <jimbell(a)pacifier.com> writes: >> At 08:49 AM 10/11/96 +0100, Adam Back wrote: >> > [...]. Microsoft's CAPI arrangement is that they will not >> > sign non-US CAPI compliant crypto modules (Examples of enforcement of >> > no-hooks interpretation). >> >> Does that fix the "export only the signature" problem (for the >> government)/opportunity (for the rest of us)? You know, present Microsoft >> with the software, don't tell them it's already out of the US, and they sign >> it. Export the signature only (who cares if this is legal!) and edit the >> international software to contain the signature. > >Export the lot, signature included :-) > >(I doubt exporting only the signature once the story came out would >offer you any more protection legally than exporting the software). > >As you say who cares if it's illegal: things get exported all the >time. > >The problem however, is finding a non-US site to hold the hot potato >once it has been exported. For example 128 bit Netscape beta was >exported a while ago. I don't see it on any non-US sites. This is >due to Netscape's licensing requirements, you need a license to be a >netscape distribution site, the license doesn't include the right to >mirror non-exportable versions on non-US sites. > That's one good application for remailers, and .warez newsgroups. at. >If the exported software is `PGP3.0 for CAPI' or whatever, I think it >should be fair to conclude it will be cheerfully mirrored by all, and >Phil Zimmermann won't be complaining. (PGPfone is on ftp.ox.ac.uk, >plus other places, for example.) So yes, I agree, for software with >appropriate distribution licenses. > >Another approach, which has been discussed lately is the use of a >patch to usurp Microsoft as the signatory for CAPI modules. I wonder >what Microsoft would say about an unauthorised patch, to fix an ITAR >induced `bug' in windows. Bill Gates doesn't sound pro-GAK. If they >aren't going to complain, perhaps such patches could be distributed >widely outside the US also. > >The new owner of the CAPI signatory key would need a good reputation, >and presumably a policy of signing any (non-GAKked) CAPI modules >signed by microsoft, and anything else that anyone wants signed. > An excellent suggestion.

6 6