- cypherpunks-legacy - lists.cpunks.org

Genetic Algorithms and password cracking
by an31122＠anon.penet.fi 20 Aug '93

20 Aug '93

Hi, If my understanding of GAs is correct (not a given), they operate by progressively narrowing the search space until they arrive at the solution. More clearly, each generation uses information gleaned from previous generations to guide the current search. The operation depends on being able to take two sets of input parameters and decide which operates better than the other. I'm not a cryptographer, so I don't know whether there is a way to find out if an answer is "close" to the actual. If not, GAs will probably be of little use. ------------------------------------------------------------------------- To find out more about the anon service, send mail to help(a)anon.penet.fi. Due to the double-blind, any mail replies to this message will be anonymized, and an anonymous id will be allocated automatically. You have been warned. Please report any problems, inappropriate use etc. to admin(a)anon.penet.fi.

1 0

T. Wells & Anonymity
by L. Detweiler 20 Aug '93

20 Aug '93

My last response to Mr. Wells was in private and I hoped he would take that course himself in future communication, but as it stands he now has screamed insults at me twice in a row in this forum, and I must address his latest unanswered letter; most of these following points are from my private letter. The fundamental issue at stake is: is Mr. Wells routinely and regularly monitoring the content of the email he forwards via his so-called `anonymous server'? The answer is: definitely. To do so is very ethically borderline, IMHO, no matter who his `family'. This was enough to alarm me seriously to the point of writing a very vehement letter condemning this type of `surveillance'. Yes, he has provided this service for a long time, he is doing so voluntarily, he has a select group of participants with a particular sensitivity and need, `most' of whom are satisfied with it, this I all acknowledge. However, it's evident to me that all users of anonymous services have a set of unconscious expectations, foremost among them that the operator will not routinely be reading their mail. I pointed out to Mr. Wells that breaking the violation of trust in privacy may lead the operator to breach the trust in anonymity. Merely the knowledge of content can lead the operator to serious quandaries that can be wholly avoided in completely adhering to privacy. Furthermore, an operator who does not strive to adhere conscientiously to the set of unconscious user expectations, even if working on a voluntary basis, is actually doing his users a disservice. Mr. Wells' rambling letter, replete with references to his personal philosophy of Objectivism, is a complicated set of rationalizations that amount to `yes, I regularly monitor my server's email traffic, in fact I consider it my duty.' Given his unswerving obstinacy to this practice, I asked that he make this policy clear in his introductory statements to the server, but he has consistently failed to reassure me that he actually has done so, making me wonder to what extent of the readers in the newsgroup and of his server (a substantial overlap according to him) are aware of this very serious matter of `systematic observation'. Are any people using this server as a plain vanilla server, or do they all realize that they are establishing a very strong personal arrangement of trust with this operator, who considers their relationship analogous to the protective Platonic intimacy between a therapist and his patients? Who will personally censor messages he thinks will unduly upset them? Mr. Wells tells us that `this is neither the time nor the place to discuss the wherefors and whys of abuse recovery; you'll just have to take it as a given that the rules used for understanding people in general won't work so well when applied to this newsgroup, or to my anonymous service.' Mr. Wells, I don't claim to be a specialist in the area as you insinuate yourself, but I believe there are fundamental laws of respect and candor that are appropriate -- *necessary* -- for *all* people, and my concern is precisely that you may be not be adhering to it in this case in presenting your policies. Your polarized dance of defensiveness and offensiveness indicates to me clearly a nerve has been struck. Mr. Wells' letter is full of seemingly contradictory statements. He seems to think that `confidentiality' and `privacy' are `two distinct functions', and suggests that in his regular email monitoring he actually achieves a `tighter, higher standard of confidentiality' than Helsingius or Kleinpaste's servers. Also, his attitudes on the limitations of his actual commitments to the people who use his service are extremely disturbing. He says `Their rights do not extend to arbitary protection of their confidentiality or privacy' and the actual protections granted are `mine to choose' and `not implicit in an anonymous server'. I find these comments simultaneously highly revealing and alarming. From my point of view the sheer all-encompassing trust awarded a server operator by users requires every conceivable commitment on the latter's part to *transcend* the common denominator in user expectations of privacy. Mr. Wells says he personally handles `half the traffic' of the sexual abuse recovery newsgroup, and that `most' of its users and his `potentially legitimate' correspondents are satisfied, and that most people who have `expressed dislike for my policies' are coincidentally `outsiders'. His service is `integral to a specific community'. Perhaps so, but how would he react to another server operator specifically serving that group? His statements seem to reflect a perverse pride in his monopoly on the group's anonymity and secret knowledge of its participants. IMHO, this is precisely the kind of extremely compromising position encryption would effortlessly avert. Finally, I'm extremely disappointed in Mr. Wells transparently vitriolic rhetoric to deflect the primary issues of systematic monitoring and truth in advertising to ugly subsidiary sideshows, such as with his expert diagnosis of me as `mentally unbalanced'. This classicly ridiculous ad hominem insult is particularly ironically insensitive coming from someone who professes to tiptoe around areas requiring the utmost delicacy in human interaction in supporting people with mental anguish! Yes, my mind is indeed teetering on the brink of a breakdown -- from Mr. Wells blows, who says of me, `he should consider himself honored that I bothered to tell him where he went wrong.' -- such words bespeak an attitude of shocking, sickening arrogance and intolerance. Caveat emptor! P.S. I will respond no further to Mr. Wells in this forum.

5 4

Parallel DES Decrypt Experiment
by nobody＠shell.portal.com 20 Aug '93

20 Aug '93

> Recent postings have gotten me to thinking: If we wrote a > easily portable UNIX program to decrypt DES in parallel across > our many machines, how fast could we go? > What do y'all think? I say do it as an experiment. That's how I always justified doing crazy stuff as a child. Besides, as a non-programmer, I am exempt from actually doing any work on the project.

1 0

"Clipper" in Norway (FYI)
by HELGE RENE URHOLM 20 Aug '93

20 Aug '93

The Department of Defence in Norway have given permission to develop a new crypto-chip to use in all public and confidential data, which has been collected about persons and groups. The algorithm is secret. The chip has been compared with the American Clipper-project. The Department of Defense will be administering the keys, and the user will have no choice whether they want to use the chip or not. They are even trying to enforced the health system to use this chip. Last week Hans Olav Oestgaard (head of the Norwegian secret service) said he wanted a law which enforce companies and single persons to encrypt all information such that the secret service can access the information in a simple way.

1 0

Violent Revolution?
by nobody＠alumni.cco.caltech.edu 20 Aug '93

20 Aug '93

++> From: koontzd(a)lrcs.loral.com (David Koontz ) + >Cypherpunks are providing the basis for long-range, (relatively) secure + >communication between those activists and thinkers who may have the + >power to bring down the State and restore the individual autonomy this + >nation was originally devised to foster. ++> As I understand it the Libertarian Party qualifies membership to ++> exclude any endorsement of violent overthrow of government. 1] I didn't see that the writer said anything about Libertarians. 2] I didn't get the impression that the writer was specifically calling for the violent overthrow of the government, only that he/she believed that actual violence _might_ eventually come. ++> While some ++> portion of those affected by this policy may well have gone ++> underground... Of course, I cannot personally say with any accuracy, but I feel strongly that a private ("underground," if you prefer) network of those discussing radical options must exist as a direct result of more secure communication. I have no evidence of this, but it seems like such an obvious and irresistable consequence that I can't picture it NOT happening, especially considering the numbers of pissed-off people using computer networks these days. ++> I don't believe that cypherpunks as a committee of the ++> whole are willing or ready to do so. 1] I didn't get the impression that the writer was saying that Cypherpunks were part of any such conspiracy, if it even exists, but only that Cypherpunks tech aided their communications. 2] I have also never been clear on how formal an organization Cypherpunks actually are - if they actually have a platform or a membership roster or secret handshakes or have turned the word "Cypherpunks" into a registered trademark with marketing licensed for logoed adjustable size baseball caps and childrens' lunchbox sets. Is there sufficient officialness for the result of a nut with "CYPHERPUNKS!" on his chest in Magic Marker biting off Hillary Roddam's left thumb at a press conference to be the forfeiture of Tim May's personal fortune under RICO? I wonder. ++> Then again as someone pointed out yesterday, cypherpunks aren't just ++> libertarians... Whatever gave you the idea that they were? ++> Some ++> portion, however large of those receiving this mailing list, may not ++> agree with this political leaning and may not consider it germaine to ++> their participation. Certainly true enough, but who claims to "speak" for cypherpunks anyway? ++> Avoiding the appearance of endorsing the violent overthrow of ++> government is prudent policy for any organization. Hell, yes. If I were signing my name to stuff, I'd be as benightedly pro-Statist in my posts as David Sternlight himself.

1 0

Re: Physical to digital cash, and back again
by hfinney＠shell.portal.com 20 Aug '93

20 Aug '93

I agree with Anonymous that there are problems with the actual use of digital cash in the near term. But it depends to some extent on what problem you are trying to solve. One concern I have is that the move to electronic payments will decrease personal privacy by making it easier to log and record transactions. Dossiers could be built up which would track the spending patterns of each of us. Already, when I order something over the phone or electronically using my Visa card, a record is kept of exactly how much I spent and where I spent it. As time goes on, more transactions may be done in this way, and the net result could be a great loss of privacy. Paying in cash is still possible through the mail, but it is insecure and inconvenient. I think that the convenience of credit and debit cards will overcome most people's privacy concerns and that we will find ourselves in a situation where great volumes of information exist about people's private lives. This is a place that I could see digital cash playing a role. Imagine a Visa-like system in which I am not anonymous to the bank. In this model, imagine that the bank is granting me credit similar to a credit card. But instead of giving me just an account number which I read over the phone or send in an email message, it gives me the right to request digital cash on demand. I keep some digital cash around and spend it for transactions as I described in my previous posts. When I get low I send some email to the bank and get some more dcash. Every month I send a check to the bank to cover my account just as I do with my credit cards. My relations with the bank are very similar to my current relationships with the credit card companies: frequent withdrawals and a single payment each month by check. This has several advantages over the system which we are heading towards. No records are kept of where I spend my money. All the bank knows is how much I have withdrawn each month; I may or may not have spent it at that time. For some transactions (e.g. software) I could be anonymous to the vendor; for others the vendor might know my real address, but still no central location is able to track everything I buy. (There is also a security advantage over the ridiculous current system in which knowing a 16 digit number and an expiration date allows anyone to order anything in my name!) Furthermore, I don't see why this system could not be as legal as current credit cards. All that really differs in this system is the inability to track where users spend their money, and as far as I know this ability was never an important legal aspect of credit cards. Certainly nobody will admit today that the government has a vested interest in moving towards an environment in which every financial transaction is tracked. Granted, this does not provide full anonymity. It is still possible to see roughly how much each person spends (although nothing stops a person from withdrawing much more cash than he will spend in a given month, except per- haps for interest expenses; but maybe he can lend the extra digicash itself and gain interest on that to compensate). And it is oriented around the same customer/vendor model that Anonymous criticized. But I maintain that this model represents the majority of electronic transactions, today and in the near future. It's worth noting that it is not trivial to become a merchant who can accept credit cards. I went through this with a business I had a couple of years ago. We were selling software through mail order, and this makes the credit card companies very nervous. There is so much phone fraud in which credit card numbers are accumulated over a few months, then large amounts of charges made against them. By the time the user receives his monthly statement and complains, the vendor has disappeared. In order to get our credit card terminal we went to a company which "helps" startups with this. They seemed like a pretty shady outfit, themselves. We had to fudge our application to say that we'd be selling something like 50% of the units at trade shows, which apparently counted as over-the-counter sales. And we had to pay about $3,000 up front, as a bribe, it seemed. Even then we probably couldn't have done it if we hadn't had an office in the business district. Under the digital cash system, this might be less of a problem. The main problem with digital cash is double-spending, and if you are willing to go with online verification (reasonable for any business which is going to take anything over several hours to deliver the merchandise) this can be completely prevented. So there is no longer any possibility of merchants collecting credit card numbers for later fraud. (You still have problems with non-delivery of merchandise, though, so not all risks are eliminated.) This might eventually make the system more widely available than current credit cards. I don't know whether this system could be used to support illegal actions, tax evasion, gambling, or whatever. That is not the purpose of this proposal. It does offer the prospect of improving personal privacy and security, in a framework that might even be legal, and that's not bad. Hal Finney hfinney(a)shell.portal.com

1 0

Encrypted cypherpunks list
by hfinney＠shell.portal.com 20 Aug '93

20 Aug '93

A reminder to old subscribers, and a notice to new: I have some software running on this system (related to the remailer software) which can be configured to send a PGP-encrypted version of the list to subscribers. This way you can receive this "subversive" material without any local system operators knowing what you are doing. Send me your address and PGP public key if you'd like to be put on the encrypted list. Hal Finney hfinney(a)shell.portal.com

1 0

parallel DES thread
by nfe＠scf.nmsu.edu 20 Aug '93

20 Aug '93

nobody@alumni... please write me. nfe(a)freedom.nmsu.edu

1 0

Re: mailing list <-> newsgroup ?
by mbriceno＠aol.com 20 Aug '93

20 Aug '93

gtoal(a)gtoal.com writes: >Admittedly, if [Cypherpunks] comes in with your real mail it would be a pain. It does come with my regular mail and yes: it is a pain. >But I'd rather keep it as email than news just to keep that cretin >Sternlight out :-) I stopped reading the PGP news group. This Sternlight guy is monopolizing-and thereby destroying- the discussion. Better stay a mailing list. --Marc

1 0

Fiat currency: Re: Electracy: Evil Revisited
by wcs＠anchor.ho.att.com 19 Aug '93

19 Aug '93

(Most of this is diatribe, and I wasn't sure whether to Cc: cypherpunks, but there's some relevance to creating digital currency near the end.) Paul Moses writes: > Sorry, but today's currency system is anything but a democracy. Thank God. > It works because it is entrusted to a COMPETENT elite. Gack, sputter, foo, bletch! The currency system works so *badly* because it's trusted to an elite who can abuse it for their own power and enrichment. It works as well as it does because currency *is* a market, so it's subject to the usual price (all the market will bear) and power is subject to the usual limits (overabuse leads to revolution), and the elite is competent enough to know how much it can get away with. Yes, an incompetent elite is usually worse (e.g. the old Argentina or Israel), and democratically controlled fiat currency is inherently incompetent (the Golgafrinchians in HHGTTG declaring leaves to be money, etc., and their current US version, the Populist Party.) But fiat currency, anywhere, any time, can always be abused, and eventually is. Hard currency, such as gold, or silver, is subject to market fluctuations, but there's some inherent value, and a fair amount of local stability. Consumable commodity currencies, such as tobacco, alcohol, cows, and grain, have their obvious drawbacks, but they're very useful in pre-industrial societies (including the US up to the mid-1800s), and use reappears in badly trashed economies (immediate post-WWII Germany, when the alternative was fiat scrip deutschmarks, which were rapidly being printed and inflating.) In all of the non-fiat systems, the value of the "currency" is variable, but *you* decide what value *you* place on it, relative to the market. In fiat systems, *somebody else* (maybe "everyone", maybe an oligarchy) decides not only what value they place on it, but what value YOU must place on it. It's backed, not by trust, but by theft and threat of violence or default; witness the US confiscations of gold and legal tender laws, or the current Russian replacement of old rubles with limited quantities of new ones. Non-fiat soft currencies, including Green Stamps, private banknotes, etc. work ok because the issuers realize they are subject to the constraints of the market, so they have to maintain the goodwill of their customers, either through backing with harder currencies, goods or services, or through expectations of future backing with them. That's easiest to maintain if you're a provider of services, or if you're (for example) providing a convenient storage/exchange of other currencies. In addition to US and other government fiat currency, I also use a variety of private currencies - checks and credit cards, which are agreements to provide quantities of real silver money, (or substitute Federal Reserve private banknotes instead); New York Subway Tokens and New Jersey freeway toll tokens, which are agreements to provide services; Joe's Coffee Pot money, which is an agreement to provide addictive drugs :-). I know and trust Joe, and he'll either provide the coffee out of the accumulated coffee profits, or his own pocket, and I'd only be out a buck if he defaults anyway. I somewhat know and distrust the New York and New Jersey transportation bureaucracies, but they'd take too much political heat if they defaulted, and the price for their services never decreases :-), so I'm willing to risk 1-20 bucks, and tokens are a bit cheaper than cash in NJ. I use credit cards mainly for convenience; merchants are willing to give me stuff in return for my signature on a credit card bill because they trust the credit card provider to generally pay up. Merchants in the US generally accept US traveller's checks, because they can get cash for them cheaply and quickly; merchants in Central or Eastern Europe either didn't take them, or gave me less than face value for them. If we're going to start using digicash, and want people to accept it in return for goods and services, we either need to back it with services (like email or remailing or software support or freeway tolls), or we need to back it with other-currency transport/delivery/storage services the way credit cards and travellers checks do, or find some other reason for people to want the digicash and trust its value-stability. > [Elitist stuff about mob rule under democracy, deleted] I agree with most of what you say there. I'd be happy to have a system where the public could BLOCK new legislation, or get rid of old legislation, but just not make new stuff; the catch is how to implement it in a way that doesn't get the positives and negatives mixed up. Bill Stewart

1 0