- cypherpunks-legacy - lists.cpunks.org

Re: Getting certificates.
by James A. Donald 04 Sep '03

04 Sep '03

-- James A. Donald: > > Outlook and outlook express support digital signing and > > encryption -- but one must first get a certificate. > > > > Now what I want is a certificate that merely asserts that > > the holder of the certificate can receive email at such and > > such an address, and that only one such certificate has > > been issued for that address. Such a certification system > > has very low costs for issuer and recipient, and because it > > is a nym certificate, no loss of privacy. Dave Howe > then generate one. it won't be accepted as legitimate by the > majority of clients though That scarcely matters. Almost no one uses PKI client certificates. All client certificates in actual use are rejected by default, and one always has to explicitly tell the client to accept. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG KkjE3D30eoM+hwpAF+AM2EZj/DxNiCTm2v0ALwuy 4UbHmZOBy/WI0yibAaB4UHUypY1guhHUSbQ/cFNPO

1 0

re: Getting certificates.
by James A. Donald 04 Sep '03

04 Sep '03

-- 3 Sep 2003 at 20:16, Anonymous via the Cypherpunks wrote: > Here is an interesting post regarding the CA issue: > > http://lists.spack.org/pipermail/wordup/2003/000684.html > > You may want to look at http://www.cacert.org. It may do what > you want. Their free client certificates are no different from Thawte's. True name, with the number of the beast branded upon it. The giveaway is that they want to get their CA preloaded into outlook express and IE. To get that, one must first worship the beast. Establishing true names, however, is too much like hard work, which is why very few people have been prepared to do it. --digsig James A. Donald 6YeGpsZR+nOTh/cGwvITnSR3TdzclVpR0+pr3YYQdkG tvYlPJRcqo6WpcnJV+UoskrpqMAjhfJBgGyIDKtO 4lu+EE81UdLOihMlOIZFKZbPYYYlp9BIfRfdHBM7K

1 0

Reputation research
by Steve Schear 03 Sep '03

03 Sep '03

http://databases.si.umich.edu/reputations/ "We are much beholden to Machiavelli and others that write what men do, not what they ought to do." -Francis Bacon

1 0

re: Getting certificates.
by Anonymous via the Cypherpunks Tonga Remailer 03 Sep '03

03 Sep '03

On Wed, 3 Sep 2003, James A. Donald wrote: > -- > SSH server public/private keys are widely deployed. PKI public > keys are not. Reason is that each SSH server just whips up its > own keys without asking anyone's permission, or getting any > certificates. > > Outlook and outlook express support digital signing and > encryption -- but one must first get a certificate. > > So I go to Thawte to get my free certificate, and find that > Thawte is making an alarmingly great effort to link > certificates with true name information, and with the beast > number that your government has assigned to you, which imposes > large costs both on Thawte, and on the person seeking the > certificate, and also has the highly undesirable effect that > using these certificates causes major loss of privacy, by > enabling true name and beast number contact tracing of people > using encryption. > > Now what I want is a certificate that merely asserts that the > holder of the certificate can receive email at such and such an > address, and that only one such certificate has been issued for > that address. Such a certification system has very low costs > for issuer and recipient, and because it is a nym certificate, > no loss of privacy. > > Is there any web page set up to automatically issue such > certificates? > > The certs that IE and outlook express accept oddly do not seem > to have any provision for defining what the certificate > certifies. > > This seems a curious and drastic omission from a certificate > format. > > Since there is no provision to define what a certificate > certifies, one could argue that any certification authority > that certifies anything other than a true name connected to a > state issued id number, the number of the beast, is guilty of > fraud. This would seem to disturbingly limit the usefulness > and application of such certificates. It also, as anyone who > tries to get a free certificate from Thawte will discover, > makes it difficult, expensive, and inconvenient to get > certificates. > > --digsig > James A. Donald Here is an interesting post regarding the CA issue: http://lists.spack.org/pipermail/wordup/2003/000684.html You may want to look at http://www.cacert.org. It may do what you want.

1 0

Money launderers go online
by R. A. Hettinga 03 Sep '03

03 Sep '03

<http://australianit.news.com.au/common/print/0,7208,7134699%5E15319%5E%5Enb…> Australian IT Money launderers go online Simon Hayes SEPTEMBER 02, 2003 LEGISLATION may be needed to help police and the Tax Office keep track of transactions made using internet-based payment services, a government watchdog has warned. Officials from Austrac, which monitors the financial system and identifies suspicious transactions, said there were many legitimate uses for internet-based payments systems, but they could be misused to provide an outlet for money laundering or tax evasion. It was not a concern with alternative payment systems "but with the potential to ensure that our law enforcement, revenue and national security programs don't suffer", Austrac director Neil Jensen said. "In the current system there's a chance it's not caught by the legislation." Alternative online payments systems are growing in popularity, particularly as a means of paying for internet auctions. "All of these things developing now need to be looked at, and looked at carefully," Mr Jensen said. Austrac officials told a recent hearing of the joint parliamentary committee on the Australian Crime Commission that the growing "array of alternative payment systems", such as the popular e-gold, escaped reporting requirements that caught bank-based transactions. Deputy director Liz Atkins told the committee that systems such as e-gold, which allows users to secure a cash deposit against gold held in a US vault and then use it to make online purchases, were being used to evade Austrac's network. "E-gold and other, similar types of mechanisms have been of great interest, particularly to the Australian Taxation Office," she said. "People use them to avoid our reporting mechanisms on international funds transactions. "It is quite easy to use these mechanisms by buying e-gold and then having credit cards or debit cards on international accounts so that our reporting systems are completely avoided. "There is quite a lot of concern within the broader law-enforcement agencies, including revenue and regulatory agencies, about these sorts of mechanisms." Ms Atkins said web payment systems, in conjunction with foreign credit cards, could help Australians avoid reporting transactions. Mr Jensen said Austrac could track part of the transaction, since funds had to pass through the banking system to be deposited in the account, but it was limited in what it could do after the deposit was made. New laws might be needed to bring non-bank payment systems under control, he said. Australian Institute of Criminology research deputy director Russell Smith said the internet had made it far easier for people to avoid the traditional banking system. Although most alternative payments systems were US-based and subject to strict regulation, much offshore banking took place in less regulated countries. "Part of the problem is harmonising regulations so different countries have similar controls," he said. "Some rogue states don't become involved, and thus can be used for criminal purposes." This report appears on australianIT.com.au. -- ----------------- R. A. Hettinga <mailto: rah(a)ibuc.com> The Internet Bearer Underwriting Corporation <http://www.ibuc.com/> 44 Farquhar Street, Boston, MA 02131 USA "... however it may deserve respect for its usefulness and antiquity, [predicting the end of the world] has not been found agreeable to experience." -- Edward Gibbon, 'Decline and Fall of the Roman Empire'

1 0

Searching for uncopyable key made of sparkles in plastic
by Peter Wayner 03 Sep '03

03 Sep '03

Several months ago, I read about someone who was making a key that was difficult if not "impossible" to copy. They mixed sparkly things into a plastic resin and let them set. A camera would take a picture of the object and pass the location of the sparkly parts through a hash function to produce the numerical key represented by this hunk of plastic. That numerical value would unlock documents. This was thought to be very difficult to copy because the sparkly items were arranged at random. Arranging all of the sparkly parts in the right sequence and position was thought to be beyond the limits of precision for humans. Can anyone give me a reference to this paper/project? Thanks! -Peter

4 3

RE: Random musing about words and spam
by Vincent Penquerc'h 03 Sep '03

03 Sep '03

> However, I immediately abandoned the idea, as a quick glance over the > content of my legitimate email - to and from developers, > technical mailing > lists, etc., revealed that almost all of my legitimate email > also contains > seemingly random bits of gibberish and pseudowords. You can still do it and use such a rule with SpamAssassin or others, while keeping a low score so that it slightly influences the results but not too much. Haven't tried it, but Bayesian filters might score good on that kind of real text with random whole phrases, as tech email usually mixes the two together (most spams I get that use these code letters do it all at once, not interspersed with other normal text). -- Vincent Penquerc'h

1 0

Re: JAP back doored
by Steve Schear 02 Sep '03

02 Sep '03

http://www.heise.de/newsticker/data/jk-02.09.03-005/ German police have searched and seized the rooms (dorm?) of one of the JAP developers. They were on the look for data that was logged throughout the period when JAP had to log specific traffic. The JAP-people say that the seizure was not conform with German law. They suggest that the police was afraid that they wouldn't gain the right to use this data before a normal court. So they "stole" it to make things clear. And since the JAP team did cooperate with them the previous time they now have the logs to get seized. I'll bet the logs weren't encrypted. Fools. steve Anarchy may not be a better form of government, but it's better than no government at all.

2 1

Re: Searching for uncopyable key made of sparkles in plastic
by R. A. Hettinga 02 Sep '03

02 Sep '03

--- begin forwarded text

1 0

Needed a WiFi "FidoNet"
by Steve Schear 02 Sep '03

02 Sep '03

It would seems that the means may soon be at hand for using WiFi, or WiFi-like, equipment to create ad hoc, meshed, non-commercial networks. These, I believe would present particular difficulties for monitoring (law enforcement and otherwise) since routing and interconnections would be dynamic and there would be no ISP nor (potentially) any use of the Internet backbone. The DoD funded some research in the 80s and 90s (e.g., SRI's Packethop and MeshNetworks) which resulted in Metricom, Tetherless Access and Nokia's RoofTop's networks. Now some students at MIT have taken up the cause http://www.technologyreview.com/articles/print_version/wo_guizzo082903.asp. If a digital bearer cash system were to become available a means for pricing bandwidth and encouraging the establishment of such an infrastructure could well follow. steve "Any sufficiently advanced technology is indistinguishable from magic" -- Arthur C. Clarke

2 1