- cypherpunks-legacy - lists.cpunks.org

CDR: Save on your TAXES!
by sdoggg＠msn.com 20 Oct '00

20 Oct '00

I have saved thousands on my taxes with this enterprise, and now you can too! For more information call 415-273-6123 Call TODAY! the longer you wait the more you lose.

1 0

CDR: It's all property, folks (was Re: Insurance (was: why
by David Honig 20 Oct '00

20 Oct '00

At 07:51 AM 10/20/00 -0400, Sampo A Syreeni wrote: >On Thu, 19 Oct 2000, R. A. Hettinga wrote: > >>My lungs are property. If some one injures them, I have a tort. I don'tt >>even need legislation. > >Well, you are apparently the one doing the damage - who the fuck told you to >breathe in the first place? You *are* paying your Kyoto II Individual Carbon Dioxide Emission Tax to the UN, aren't you?

2 1

Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)
by Bob Jueneman 20 Oct '00

20 Oct '00

Let's put this problem in perspective, and try to avoid the "chicken little, the sky is falling" syndrome. It's quite unlikely that someone would come up with "Eureka!" type of solution to factoring large numbers that would end up completely breaking RSA, or that some way would be found to completely break the integrity of SHA-1. Instead, we would be much more likely to see a nibbling around the edges, and a gradually decreasing confidence in existing algorithms, with more than enough time to replace them. In fact, we have already seen that. MD2 is now deprecated, and MD5 is being pretty widely supplanted by SHA-1. Likewise, DES has been broken and people are recommending that triple-DES be used, and soon AES. And OAEP is recommended to get around some hypothetical million-question attacks. But the sky hasn't fallen, and the sun still comes up in the morning. Even if some catastrophic weakness were somehow revealed that any high school kid could take advantage of with a single PC, there are still checks and balances. The kid still has to have money in the bank to pay for the item, and all of the usual velocity checks, etc. that are used to combat fraud would still be in place and would work. And good old-fashioned detective investigations and forensics would still be applicable. Any good security system has defenses in depth, and is not subject to the balloon-popping problem. that doesn't mean that we shouldn't try to make systems be as perfect as possible. But if they aren't (and they never are), that shouldn't be the end of the world as we know it. Let's not invent a hypothetical Y2K problem. Bob Robert R. Jueneman Security Architect Novell, Inc. -- the leading provider of Net services software. >>> Tony Bartoletti <azb(a)llnl.gov> 10/19/00 04:09PM >>> At 04:58 PM 10/19/00 -0400, Arnold G. Reinhold wrote: >>Yes, that is why Tony's remark was somewhat tongue-in-cheek and used >>"solid mathematical foundations" within quotes. > >Eye twinkle doesn't come across in e-mail, I'm afraid. My apologies to >Tony. This is obviously one of my hot buttons. No problem. I often employ a quoted "x" to convey "so-called x", a shortcut that can lead to misunderstandings. >>>It is all hypothesis and empirical argument. A lone >>>mathematician working in his attic could come up with an algorithm >>>that would blow some or all of the existing systems out of the water. >>>Who get to cover that financial risk? >> >>The buyer. CAs (read Verisign's CPS or any CA's CPS, or bank contracts >>and -- above all -- see the US UCC) are not responsible for producing correct >>results but just for using correct methods. Where "correct methods" are >>what others consider correct -- even if they are proved wrong later on >>by a one mathematician working in his attic. > >I'm not sure those contracts would stand up in court if there were massive >public losses due to a collapse of the PKI. (Anyway CA CPS's stretch to >notion of a "mutual agreement" pretty far. I purchase a $10 cert and am >bound by over 100 pages of gobbldygook that only a handful of people on >the planet can be expected to fully understand?) > >But I am less concerned with CA legal liability then with who is left >holding the bag when a massive subversion of the banking system is >perpetrated, and how big that could be. I'll wager the taxpayer/consumer will foot the bill, one way or another. Derivative to the Second Law of Thermodynamics, it is easier to destroy wealth than it is to create it. So, on average, work/energy is required to create or recreate wealth. The collapse of a future global PKI, or of the integrity of banking transactions, would represent a huge shift from order into chaos, a decoherence of identities and orderliness amounting to a huge destruction of wealth. Recovery thus will require the recreation of wealth, in one form or another. This will require a correspondingly huge input of work. So, who does most of the work, in general? You know the answer ;) ___tony___ Tony Bartoletti 925-422-3881 <azb(a)llnl.gov> Information Operations, Warfare and Assurance Center Lawrence Livermore National Laboratory Livermore, CA 94551-9900

2 1

CDR: Re: why should it be trusted?
by Gil Hamilton 20 Oct '00

20 Oct '00

Nathan Saper gropes: >On Thu, Oct 19, 2000 at 01:02:44AM -0400, Steve Furlong wrote: > > Nathan Saper wrote: > > > <<Nathan seems to be arguing that insurance companies should be forced > > to cover people at a rate to be set by someone other than the insurance > > company. Tim May objects to this plan.>> > >Close. I am arguing that insurance companies shouldn't be allowed to >deny coverage based upon factors that the insuree does not have >control over. For example, I smoke, so I really can't blame an >insurance company for charging me extra, because that's a factor I >have control over. So, by extension, people who are 98 years old should be able to purchase life or health insurance at the same rates as those who are 22 years old. After all, they have no control over their age. Your position is internally inconsistent as well as dishonest and unfair. If you believe that people are entitled to medical care simply because they exist, then at least admit that to yourself and advocate that government should provide it through tax collections. The "Big Rich Insurance Company Who Can Afford It" is simply passing the costs on to the rest of us anyway. But why should this burden be placed on the managers and stock holders of the insurance company? It isn't *their* fault that the prospective insured has a genetic predisposition to heart disease (or whatever). > > > Most insurance companies are worth millions, if not billions, of > > > dollars, and they make huge profits. Insuring all of the people that > > > they now deny based on genetic abnormalities would still allow them to > > > make decent profits. The poor old widow whose mutual fund owns the insurance company stock is being deprived of income thanks to your mandate. How is that fair? > > > And many people are denied coverage outright, therefore removing the > > > possibility of simply paying for their coverage. > > Of course you said "coverage", not "care", but the alleged problem is > > that people can't get medical _care_. Who cares if they have _coverage_, > > so long as their medical needs are taken care of? > >Coverage is most often less expensive than care. Therefore, one may >be able to afford the coverage, but not afford the care, if it ends up >being required. Again, this is being dishonest. Coverage is less expensive than care only because *someone else is paying for it*. It is the care that is needed, not "coverage". Mandated "coverage" is simply care that someone else is being required to provide. Any insurance company obviously prefers to minimize "coverage" that *it knows* is going to require care to be paid for. > > As I wrote before (like, a couple of hours ago), most of the people who > > insist on a right to "affordable" medical insurance seem to expect to > > get a lot more out of the insurance company than they put into it. They > > should just be honest and go on welfare if they're looking for a > > handout, rather than attempt to claim the moral high ground. > > > >Isn't this the whole idea of insurance? You pay them x dollars, and >if you end up getting sick, they most likely have to pay more than x >dollars to treat you. The insurers are banking on the fact that the >majority of the people who have insurance don't get sick. > >So, yes, the whole idea of insurance is to get out more than you put in. No. The idea of insurance is to *insure* yourself (and family, etc.) against unexpected catastrophic losses by pooling risk. This is why the current American system where virtually everyone's insurance pays for virtually every visit to the doctor is such a bad idea. People should be paying for their ordinary, year-in year-out health care. Insurance should only enter the picture if "large" unexpected expenses are incurred. This type of insurance would have a huge positive effect on health care prices in this country. Prices keep spiraling upward because the individual doesn't have any incentive to control costs. The individual's only motivation is, as you stated, "get out more than you put in". Since the individual is not motivated to control costs, neither is the doctor (excluding HMOs which are an effect of this whole issue). Given an unknown condition, the doctor is inclined to order any test or administer any treatment that *might* be beneficial, no matter how unlikely. After all, this covers his ass: the more tests or treatments tried, the less likely the doctor is to be sued for "negligently" failing to consider an option. - GH _________________________________________________________________________ Get Your Private, Free E-mail from MSN Hotmail at http://www.hotmail.com. Share information about yourself, create your own public profile at http://profiles.msn.com.

3 2

CDR: Re: why should it be trusted?
by brflgnk＠cotse.com 20 Oct '00

20 Oct '00

It was said: -- begin quote -- >As to care, as I've said a lot before, care is most often more >expensive than coverage. Clearly this can't be true or every health insurance company would be going out of business. Coverage has to be more expensive than care of they wouldn't be in the business of providing coverage. -- end quote -- You've missed the essential gamble of insurance: care given to an individual insured party is usually more expensive than the premiums paid by that individual. The gamble is that the aggregate premium collected from all the insured in the pool will exceed the aggregate cost of care for those in the pool that collect benefits. That the insurance business is profitable proves the gamble usually pays off.

1 0

CDR: NYT Account Request
by forgot＠lga2.nytimes.com 20 Oct '00

20 Oct '00

You have requested your ID and password for The New York Times on the Web. Please follow the instructions below. If you have any questions or problems, write to forgot(a)nytimes.com. Please DO NOT REPLY to this message. 1. Please make a note of your subscriber ID: sciferpunk 2. Next, to change the password for this account, using your Web browser go to this unique URL: http://verify.nytimes.com/guests/forgot/forgot?key=40177689_16329707 This page will allow you to choose a new password. Make sure you have copied the address EXACTLY as it appears here. (If you're getting an "Error" page, the address was probably entered incorrectly. See "Help With Copying and Pasting" at the bottom of this e-mail.) 3. Follow the instructions on the screen to choose a new password. After you have entered a password you will automatically enter our Web site. The New York Times on the Web Customer Service forgot(a)nytimes.com ******************** Help With Copying and Pasting 1. Using the mouse, highlight the entire Web address, (e.g. http://verify.nytimes.com/guests/forgot/forgot?key=40177689_16329707) shown above in step 2. It's essential to highlight the entire address, even if it extends over two lines. 2. Under the Edit menu at the top of your screen, select "Copy". 3. Go into your Web browser (open it if it's not already opened). 4. Click in the "Netsite" or "Address" bar -- the place in your Web browser where it says what Web address you're currently looking at -- and delete the address that's currently there. 5. In the blank "Netsite" or "Address" bar, paste the address by selecting the "Edit" menu at the top of your screen and choosing "Paste". 6. Press Enter. 7. Follow the instructions to choose a new password. ******************** If you did not request your ID and password for your NYT Web registration, someone has mistakenly entered your e-mail address when requesting their password. Please simply ignore this message, or, if you wish, you may go to the address above to select a new password for your account.

1 0

CDR: Re: Non-Repudiation in the Digital Environment (was Re: FirstMonday August 2000)
by Ed Gerck 20 Oct '00

20 Oct '00

Bob Jueneman wrote: > Let's put this problem in perspective, and try to avoid the "chicken little, the sky is falling" syndrome. > > It's quite unlikely that someone would come up with "Eureka!" type of solution to factoring large numbers that would end up completely breaking RSA, or that some way would be found to completely break the integrity of SHA-1. Well said. SHA-1 works as a many-to-one function and this alone makes it impossible to break if well applied. Simply, no global inverse function exists for a many-to-one function (even though a local inverse may exist, but in this case SHA-1 would not have been well applied). This is a mathematical fact. Matters with RSA are still unproven, though, but it is not probable that it will be broken any time soon in a wide scale. However, this is not what concerns me at all. PKI is the problem. It does not work and it will not work on a global scale. E-commerce itself has moved away from PKI for no other reason. The problem then is the E-sign Act and state legislation following on its heels, which not only blurs IMO what a digital signature is but also does not deal adequately with the liability issues for the different parties involved. In this scenario, what if we see a blind push for a global PKI and also include non-repudiation as an "absolute authentication" based on some mythical "trusted machines" -- as has been suggested recently in the good name of e-commerce? Cheers, Ed Gerck

1 0

CDR: ADL lists anarchy symbol as racist
by anonymous＠openpgp.net 20 Oct '00

20 Oct '00

http://www.adl.org/hate_symbols/racist_anarchy_symbol.html

8 9

CDR: Re: Non-Repudiation in the Digital Environment (was Re: First Monday August 2000)
by Bob Jueneman 20 Oct '00

20 Oct '00

Let's put this problem in perspective, and try to avoid the "chicken little, the sky is falling" syndrome. It's quite unlikely that someone would come up with "Eureka!" type of solution to factoring large numbers that would end up completely breaking RSA, or that some way would be found to completely break the integrity of SHA-1. Instead, we would be much more likely to see a nibbling around the edges, and a gradually decreasing confidence in existing algorithms, with more than enough time to replace them. In fact, we have already seen that. MD2 is now deprecated, and MD5 is being pretty widely supplanted by SHA-1. Likewise, DES has been broken and people are recommending that triple-DES be used, and soon AES. And OAEP is recommended to get around some hypothetical million-question attacks. But the sky hasn't fallen, and the sun still comes up in the morning. Even if some catastrophic weakness were somehow revealed that any high school kid could take advantage of with a single PC, there are still checks and balances. The kid still has to have money in the bank to pay for the item, and all of the usual velocity checks, etc. that are used to combat fraud would still be in place and would work. And good old-fashioned detective investigations and forensics would still be applicable. Any good security system has defenses in depth, and is not subject to the balloon-popping problem. that doesn't mean that we shouldn't try to make systems be as perfect as possible. But if they aren't (and they never are), that shouldn't be the end of the world as we know it. Let's not invent a hypothetical Y2K problem. Bob Robert R. Jueneman Security Architect Novell, Inc. -- the leading provider of Net services software. >>> Tony Bartoletti <azb(a)llnl.gov> 10/19/00 04:09PM >>> At 04:58 PM 10/19/00 -0400, Arnold G. Reinhold wrote: >>Yes, that is why Tony's remark was somewhat tongue-in-cheek and used >>"solid mathematical foundations" within quotes. > >Eye twinkle doesn't come across in e-mail, I'm afraid. My apologies to >Tony. This is obviously one of my hot buttons. No problem. I often employ a quoted "x" to convey "so-called x", a shortcut that can lead to misunderstandings. >>>It is all hypothesis and empirical argument. A lone >>>mathematician working in his attic could come up with an algorithm >>>that would blow some or all of the existing systems out of the water. >>>Who get to cover that financial risk? >> >>The buyer. CAs (read Verisign's CPS or any CA's CPS, or bank contracts >>and -- above all -- see the US UCC) are not responsible for producing correct >>results but just for using correct methods. Where "correct methods" are >>what others consider correct -- even if they are proved wrong later on >>by a one mathematician working in his attic. > >I'm not sure those contracts would stand up in court if there were massive >public losses due to a collapse of the PKI. (Anyway CA CPS's stretch to >notion of a "mutual agreement" pretty far. I purchase a $10 cert and am >bound by over 100 pages of gobbldygook that only a handful of people on >the planet can be expected to fully understand?) > >But I am less concerned with CA legal liability then with who is left >holding the bag when a massive subversion of the banking system is >perpetrated, and how big that could be. I'll wager the taxpayer/consumer will foot the bill, one way or another. Derivative to the Second Law of Thermodynamics, it is easier to destroy wealth than it is to create it. So, on average, work/energy is required to create or recreate wealth. The collapse of a future global PKI, or of the integrity of banking transactions, would represent a huge shift from order into chaos, a decoherence of identities and orderliness amounting to a huge destruction of wealth. Recovery thus will require the recreation of wealth, in one form or another. This will require a correspondingly huge input of work. So, who does most of the work, in general? You know the answer ;) ___tony___ Tony Bartoletti 925-422-3881 <azb(a)llnl.gov> Information Operations, Warfare and Assurance Center Lawrence Livermore National Laboratory Livermore, CA 94551-9900

1 0

CDR: Encryption export rules finalized
by George＠Orwellian.Org 20 Oct '00

20 Oct '00

See: http://www.pscu.com/Newsbytes/2000/156920.html http://www.nandotimes.com/technology/story/body/0,1634,500270563-500421503-…

1 0